{ "Event": { "published": true, "date": "2021-06-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-25", "timestamp": 1624665781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "aef9c0e8-ed4a-47ed-9cc4-8f0511d61f95", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87487323-d555-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624584888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584888, "uuid": "305579cc-1196-44d5-ab9e-2e1b12d787ac", "comment": "Malware payload", "value": "26f9ce8936f12944a0bbd3e8758cba01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584888, "uuid": "bf3321e6-f6c9-4e76-800e-32bd930ff0b2", "comment": "Malware payload", "value": "00028abdb20a478f15791b39f7f2179b0b75ebcd8fee2d6032a9475252251057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584888, "uuid": "1bee97c4-54a8-4126-941b-1cb209b8883e", "comment": "Malware payload", "value": "41069a780c8ad6010d0cc31b8eb722f416ce208c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584888, "uuid": "01b6cef0-dc32-4b16-9602-60687401239b", "comment": "Malware payload", "value": "94313f7bea3b6c051ad39118b12435ec73a292cd2501ef1f436577683e1a2fa86e2699e53050019971e3f7a382a54bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584888, "uuid": "fb12b1cf-04c2-4fc2-b73c-cf6c8191cbdb", "value": "54450200A6A1D031F5FB12F89975D2AC6A3D3AF09B6051CF12D5DAEE5634AD2EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584888, "uuid": "886903e2-e0b2-4247-9b89-443eda2adc6f", "value": "95c98b49c73bee041cc2512ce9afe8b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584888, "uuid": "c8c8ad8d-7509-46ff-be2a-d9ef0d3cfce3", "value": "24576:QZ9OL2Btwign8EZizHwmO9Rlg7CVliOI3oNiR23VLYl87LHgCQObj:VcwIzQ1zgoMOaoNigVLK87LHgCQAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624584888, "uuid": "d8606771-13e0-4310-8b66-e60c1290f0a0", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624584888, "uuid": "fca18e35-f463-4acf-b4e4-16af27aad3a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584888, "uuid": "e63ff256-f922-4b38-bb2b-e0d3b54da576", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.31095.2421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95732f9-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624601320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601320, "uuid": "892cedea-48aa-4aa1-907e-7f117f0f26f3", "comment": "Malware payload", "value": "ae67558c89fd1a57cedfdc850aa4092d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601320, "uuid": "cdb17d47-d544-4872-90e5-c721805f7486", "comment": "Malware payload", "value": "003ce8e6dfc082ac6d4b702818b5f15c7f662a5822fbbc171176f5b21c7c9e98", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601320, "uuid": "d1b0bc8e-b2f7-4d06-9879-f506fed5af3b", "comment": "Malware payload", "value": "92ca8fa7daca2a56da24a3a99e8cb494b3d059c9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601320, "uuid": "d87f0a96-b46e-4ab3-b80d-c1cfc5d21baf", "comment": "Malware payload", "value": "6b7fb0e6a31b9f745085eb5a0b77dd0f73a80e25995bb6f341c00c77e3ad32d055fe3ed4caa728567493c81359c874a7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601320, "uuid": "d4261f3e-6e5f-4cd5-9665-62ac9df9b0be", "value": "C7629E540267912ED748F17DE440A78D4BD374C381624919CA50E068FAFAEBBB75DF38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601320, "uuid": "81573b89-642c-46f9-98c0-7e8b98602f74", "value": "384:T4q3zVL6H5VuoXp8qmtKoktRkFQV4wASQD/73OYksd7sp2:vzwH5GqmtKoaRwQJASQDT3Ssn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601320, "uuid": "eed71f25-6e6f-4035-9da8-21da0c22ed53", "value": 15115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601320, "uuid": "c52b22a8-bd99-4765-9cba-0f1555f5494e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601320, "uuid": "e797158f-540f-4675-a095-78ec0ddd4cd3", "value": "PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98044f09-d5b2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624624859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624859, "uuid": "d3b5cc6b-a34d-4163-9905-38d180fba14e", "comment": "Malware payload (RedLineStealer)", "value": "80e54b87d8ac4232657e7f5457507745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624859, "uuid": "2d421e63-f282-4d33-8ccf-46aeab039b78", "comment": "Malware payload (RedLineStealer)", "value": "00e544d06b651113348167a9261cdd3978f5d2eee3c78a51c4b0ce3dcdab3031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624859, "uuid": "b0567efb-6de0-438a-9184-b7cebc526341", "comment": "Malware payload (RedLineStealer)", "value": "fcd5ee03b9fdfdd234ef2966329878c568b840cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624859, "uuid": "dc8eb13d-0c39-4284-b4df-b7655208282a", "comment": "Malware payload (RedLineStealer)", "value": "a7b9568273a5634f1302424bb157fa9009e2148de8b8aae0868b57d23d19c52a35e566767581104d188c4366399dfc84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624859, "uuid": "206ff837-5dbe-4e60-a4ab-d2add32517dd", "value": "D5957B5D3BE5C3E5F3A41075B075123E0E2C2E5268E6EBCC3EACB58C162ED4529F1A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624859, "uuid": "8654126a-fd82-4337-a4e4-66a7e84fecba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624859, "uuid": "2add3998-d5ee-44ed-add9-524c2dc0b5d9", "value": "24576:hFy7O1brwerQIWONYxBqSOFITfCF2yOLwfAyX0gV2ozVwTGhP17:665rweFWONYxcSMITfCFbkh2VwTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624859, "uuid": "7fc1def3-a9ef-44ca-b61d-b852a491cfc9", "value": 1877528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624859, "uuid": "677330f1-cbfd-4b0e-8497-3e4d2ef5f949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624859, "uuid": "9642ebee-20c6-4a0c-9490-553de99f2b23", "value": "80e54b87d8ac4232657e7f5457507745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc9a79f-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624641485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641485, "uuid": "d07f7a95-78cc-4871-846c-ca2914040e7a", "comment": "Malware payload", "value": "e1b741eba40f47815cc444ebf03a5fbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641485, "uuid": "dd5ae0d3-0f34-40fc-bef1-527b9f988c56", "comment": "Malware payload", "value": "0189cf71c882ce8ecb56d1651aa156f4d4d52cbeeaf424049e5bb4a6c4d4fde5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641485, "uuid": "30b7fa01-f9a9-4602-b751-c73ae1306cd8", "comment": "Malware payload", "value": "a8b7d5f0a86088759e8d1f88a164b1aa04f6371e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641485, "uuid": "b5594b66-4732-45ad-b465-3a2562ef239f", "comment": "Malware payload", "value": "7c4243d1fb39836afaaf3ee1b28d9e89def32b09dd0be1049ccce68dd5ae736d3b728a8b57e03410c08cec336c90f366", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641485, "uuid": "e2f04a13-a2dd-4008-aea5-4399f4b5dd60", "value": "08C2F1CB2D2B4AC4DF997A78B091F497700E6F06A1D4201ACE22740A0B6D0CBF4ED9E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641485, "uuid": "4b971672-863c-4f12-ae6c-4ecc6f8a6b65", "value": "768:249cmoNfR9McB3o8f0x0QM9GoRL9Oo5NETM:24u1NfR6oY8f0qQALAjTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641485, "uuid": "ed2ff1ca-2d82-48f7-af80-fd409f41d0d5", "value": 27480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641485, "uuid": "84bee24e-e09d-4672-b7ab-dc0aff2e25fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641485, "uuid": "917179a1-1b79-4957-888f-6c0f0736c46f", "value": "e1b741eba40f47815cc444ebf03a5fbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9276f5-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624650902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650902, "uuid": "4350d814-28a5-4ab1-a697-54c9644f8d5c", "comment": "Malware payload (Mirai)", "value": "24512b0d632d8cb78428fe3f2ef00a80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650902, "uuid": "8e5a61e4-4bfa-4724-a912-56ca77de904d", "comment": "Malware payload (Mirai)", "value": "01f8a6b06c36e33a7f8c293782af6d4860553a9828b1e08719d7bdce6c4a15f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650902, "uuid": "8689ac1b-0499-4c13-9289-1b6511a7c15a", "comment": "Malware payload (Mirai)", "value": "e6173e192d609fbbc66c94a2394812bb8b9c38af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650902, "uuid": "6cb9654d-a098-4490-aef3-c11062fe8eec", "comment": "Malware payload (Mirai)", "value": "964aa8b22b87e816980fbc1ec278b33c443692d50ac61329dd8bc41fa4d89fbbe4d35c9a8517d6a0582a713f7e686da0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650902, "uuid": "48723bfb-d8c4-4582-a827-a99db3c2ee20", "value": "5323F2432093B913E03098FA85618C8EB65A97BDB1BF7BA725490E154C35D93ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650902, "uuid": "c55a8fb9-70ba-40e4-923d-e64cb2be77b7", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFKc9q3UELWt/iw+kvBGg6+fYtrBHd:E12O1LCNguovDPH7TcrKLWhiw+kvBGgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624650902, "uuid": "45335f50-197b-4f90-8242-c02e974129f1", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624650902, "uuid": "1a6682fc-b0ea-433e-b934-4dbc07fc94fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650902, "uuid": "6f753dd4-f5a3-40f4-860f-16b83d1c0138", "value": "24512b0d632d8cb78428fe3f2ef00a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ec779f-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588166, "uuid": "a54d5cfc-fa3f-4b81-b20a-5ba24020e697", "comment": "Malware payload (Gafgyt)", "value": "7354196772464225c5cd1430c889745c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588166, "uuid": "8879c509-6a10-4b77-a140-fb9941f82aeb", "comment": "Malware payload (Gafgyt)", "value": "0216a72aaf7e36793270474dff418e98daf04502cf5a4de8e6c4d30f2ff28757", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588166, "uuid": "25be5010-080f-4e83-838c-b700beafa5fd", "comment": "Malware payload (Gafgyt)", "value": "ade15a3a0d60153b59daf97eea289cf92f64fd05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588166, "uuid": "c7983253-f542-490f-934f-a870cbda73aa", "comment": "Malware payload (Gafgyt)", "value": "e8f3e5d2a5637ac9f637099cc3487e95cf2005782225c396e9c43f46efacc5c6ec2505857502ca4da5abe96f817d5fba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588166, "uuid": "1c9fb3b4-60f7-4474-a46c-cb359a1b6917", "value": "1403E15E12AF8970E8038174AF6F19269FF4DEE6DB03200B1E5508662DD7274256BCCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588166, "uuid": "0d7d1a19-9895-48a0-a285-f46a2f139d9c", "value": "768:r3vQt95AVa0N1ozyy4bhKBM1TbfbdrOqEGTlXCGcExeQT5H8:TQYa0N2a1Tbfbp+GdT5H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588166, "uuid": "3f38c621-efb3-49d5-b4cf-681e73fe06ce", "value": 41184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588166, "uuid": "d6969a35-d0fd-4d5c-bc9c-fd1e11af63f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588166, "uuid": "b4048fb6-c5b7-4c89-a361-894b045a1295", "value": "7354196772464225c5cd1430c889745c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfed0be-d5bd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624629751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629751, "uuid": "640439dc-ca25-4ab4-8b66-2959e0ed26a7", "comment": "Malware payload", "value": "9bd62e936a8593a1dc9428264f97225e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629751, "uuid": "36b4cb88-5b1b-43e6-b4e8-9429ae6f2c96", "comment": "Malware payload", "value": "025d3d6bfc516d8a37b9034fa0e7e07bd20c46ea38867c113ee7db7224ced2f0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629751, "uuid": "a8e5182c-a193-43eb-ab58-402de3fd12d5", "comment": "Malware payload", "value": "d871833022bdf8b351c0d47a7dbf75c1714cb18e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629751, "uuid": "2d6e58b3-afd2-43a4-9184-b54c57553f0d", "comment": "Malware payload", "value": "431123eb3fb85e706096483a13766425bb39eaded9ef62a0cc2dcc67c0a6023a910d4eaa6706aff068f2fbf96865272f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629751, "uuid": "c53dfb06-117e-45c5-b990-c5e22ae6f1d6", "value": "12F423FB3882C87D2FCF768277D2AA834D6656B11FB6A0A5112704E575F64BA6C0103F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629751, "uuid": "edbbb12d-56b9-4b25-9bce-c85d17e7118d", "value": "12288:7k0/QoHmDrti83FOAQkm4P3oXNsa/J6HaM2jD2FOGJFlWclAh8tK2FFy1ipODYnX:7j4IGvZMMoXNsa/waNclDPR08CD58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624629751, "uuid": "ca3470e4-f8ba-4081-a215-f592145c5c1a", "value": 725389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624629751, "uuid": "c495dbfc-d2d9-4bf7-93b0-decdc881e9ca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629751, "uuid": "83fb271a-281b-4252-9e9f-4b8fae098b13", "value": "fyi.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc57d1f-d566-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624592224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592224, "uuid": "9b5f1a0c-3aeb-4ba1-89cf-66c08b97c8f4", "comment": "Malware payload (Smoke Loader)", "value": "95af0f01d610c0285f1a473487a1887c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592224, "uuid": "a3ae4edd-cff8-450a-a3d2-31e42e67f010", "comment": "Malware payload (Smoke Loader)", "value": "02926bc699d257781c2d857e770a172d067018d176c361995650efe54ed37b63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592224, "uuid": "2753d76b-ba58-4e18-b0fb-28065da0ab8d", "comment": "Malware payload (Smoke Loader)", "value": "34578e55bf2bd406b0a89ae70b53d4eefdb1373d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592224, "uuid": "cb47a663-7ae1-445d-abe7-217b41b1c6cd", "comment": "Malware payload (Smoke Loader)", "value": "34a1b8c58b5afb8825a52e3573a2d85eb7b49b06864e49fa98158b0d9ed552de18fa22c2115b0e990d19a2514ca34861", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592224, "uuid": "f100fbd5-7dae-4e5f-ae02-c38d2c0433f9", "value": "89748D00AAA1C035F6B312F48976A36CA93E7EB15F3440CB52D5EAEE56346E5EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592224, "uuid": "dc4660eb-88fd-4535-8e81-d9fbcece976b", "value": "3696836e697e34abe8d01359a9095212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592224, "uuid": "4da4330b-c63d-4402-8e39-978a0cae56df", "value": "6144:SNu8aFAAG+ULJHUUb5iOG0KbdWS2N3rRMQeOqwZiKok:/8aFAAG+ULJHUUtPKbdWS2hrRMGjXo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624592224, "uuid": "a1708cb1-addf-40fc-95a7-029525be9d27", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624592224, "uuid": "7c1f2d4e-ac59-4322-be10-56df97283dbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592224, "uuid": "46216eb8-158b-408e-8b54-ed19f4684c17", "value": "95af0f01d610c0285f1a473487a1887c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be48c718-d5c4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624632654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632654, "uuid": "8468e908-5e9d-4456-bdf7-cc319344a5ed", "comment": "Malware payload", "value": "518f254a9cec64f0da8321ff941f34ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632654, "uuid": "dabef25f-4465-4704-9858-5f7db3b5fd47", "comment": "Malware payload", "value": "0440c4517e17200e6ab7fb29c5d3aa5f64059d6c22d9b3438b1ef390e2483a95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632654, "uuid": "3cd400f8-4d9f-4eb3-b979-f6407d5cd93f", "comment": "Malware payload", "value": "38a15d8e67d7f635872e4600e65cc7361852970f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632654, "uuid": "f4a80b93-e0e0-4ec3-8293-3d6ee5c1a240", "comment": "Malware payload", "value": "4a13dadc0474022aa4175c0e726e61760f1a1446af345484724387bc0ae7e81593b963c4e5af7a4fd62594e3a364610b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632654, "uuid": "a6653521-8bdb-4430-a9eb-ced145aa364c", "value": "E7F2E0739188B0B2DA541831B0E906C7337D1EBCF4D3721506CC976CB66A0A7AABF50A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632654, "uuid": "4b4f80ad-bc6d-4d05-bc6d-dd3169e92c90", "value": "768:inhWYMpSp93FZKG0E0hdyS2SNXcp9+5fh/JXWU6CC3Uc:inhWYMopoG0E0h92S6p9+dh/JXWUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632654, "uuid": "da6ab01f-b62f-4d88-92f9-d1c996514979", "value": 36940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632654, "uuid": "d627f973-4ecf-4bc4-a2b4-4415983be736", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632654, "uuid": "1c50d94a-7dfa-4a69-a5d8-cd90c21b3087", "value": "518f254a9cec64f0da8321ff941f34ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc85266-d5dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642824, "uuid": "202309de-00f3-4ae2-bdb6-1c58b6ace42a", "comment": "Malware payload (Mirai)", "value": "ed785cdaf127785517092c4265d47bfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642824, "uuid": "a834f7ef-a5d8-4fe8-9ff9-502480c5fc84", "comment": "Malware payload (Mirai)", "value": "04696ecbbe0684f4a6502cf136137aea1ac1b1db35624f9dcba9dbb3ffd8e959", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642824, "uuid": "a169c1e1-f2ea-4cf3-a81a-f17b3b55eebd", "comment": "Malware payload (Mirai)", "value": "036928a8a26743078d5860bde027d7aade8a3c52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642824, "uuid": "e385d1a5-8468-4e2b-b39c-b943565fd8a2", "comment": "Malware payload (Mirai)", "value": "5abe5850cb6d6d04fb1bd388cd5a41d9d1efec4f95cb84020579bb4273d33c90c6f670cde536aea237581eb71b220b67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642824, "uuid": "db32b19b-1f34-441b-a43f-b5344aab5639", "value": "73332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642824, "uuid": "c63801cc-67e6-4c96-80c0-d63a39923e94", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638g0:mL/4f8F1ef0YgFvimzpZi2UJJnHY8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642824, "uuid": "da113221-1637-4cce-93e9-917d40b9ddf2", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642824, "uuid": "5ff5e535-d663-4bb4-bb06-e3cac96c53b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642824, "uuid": "bc07242a-f962-4b3d-a33a-5fcd0316449e", "value": "ed785cdaf127785517092c4265d47bfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49da1959-d605-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660376, "uuid": "30a3a828-a9ce-4926-a2eb-3d7fa1d39340", "comment": "Malware payload (Mirai)", "value": "7d62bc8bef8caa0433aa441bd1c98808", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660376, "uuid": "66df1653-e2c4-4fe6-af8d-ba80653c107f", "comment": "Malware payload (Mirai)", "value": "04aab169864706bc212cd7ef6e3459e409d97c0c8a9c2d90ce6881c993e28c6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660376, "uuid": "9ae62d60-2160-4c8a-8d85-be3a88b89bc7", "comment": "Malware payload (Mirai)", "value": "d81e31c90873568dd31ada8a2ae48b5e439e0b28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660376, "uuid": "fc6be691-4a77-42e2-b10b-7887599eb1b1", "comment": "Malware payload (Mirai)", "value": "e00ec1eca061a06452dce697de5680c470291560a3707f5be3086d80b9ad6accbcb829658c7d23e3b55cd4914c5ae05c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660376, "uuid": "c7741773-4713-4aa9-9b31-c0fd08999bf4", "value": "5313F1FF821282EEED5D95B5ABBA43FA1B510909F012DC00964CD79B9FC86A0B9431F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660376, "uuid": "b6017095-19d9-4afb-a4a0-e786851e9d3a", "value": "768:yCqXn5GLHK7Q4eYvfR691sL4B8pNyJ+2XkbxRrnXoEpSywtnDykzs3tkujU0JgGu:yiHKfsHsL4BXEbx9rpxms9BwsVJu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660376, "uuid": "3865f95c-6845-4942-8c42-c2d00db15cd5", "value": 44332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660376, "uuid": "cb3bb29c-95e4-4722-a3ca-c3d40810a61d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660376, "uuid": "7d3b86a5-30b2-4626-867b-f75dadda49e0", "value": "7d62bc8bef8caa0433aa441bd1c98808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084f8dea-d5b5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624625907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625907, "uuid": "f1c77b2d-39c8-427a-ba0a-b67955cbcf65", "comment": "Malware payload (AgentTesla)", "value": "544c8fa4e8d85bb3f27af52d8cb0e4ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625907, "uuid": "7d7fc109-06b8-4dc8-908c-41ae11a0f112", "comment": "Malware payload (AgentTesla)", "value": "04c79b74381493a851ae3b24af86686ed875eb5f8d729a1effac0430c1d0ecb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625907, "uuid": "b2a3a517-5a0e-47d8-af3b-6786d4108227", "comment": "Malware payload (AgentTesla)", "value": "340075344f8c267972d252d18b97919e48e6531e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625907, "uuid": "d20591c4-9dbe-478c-94cd-e1aa3134fd6f", "comment": "Malware payload (AgentTesla)", "value": "e5c6ca8913b827b2c82ee2cc1b875e146eb69ec6999211cde6e9108adf13d76a768f736aa13ac4d64fb137cdb843c915", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625907, "uuid": "9851d492-e62d-43b7-94ec-23e76a064a06", "value": "E6A49DAC36A435EEC46BD6BA9AA82C64EA65747B131B9507901301DD9E0DFC7CF108F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625907, "uuid": "f4bdc7a7-0a75-430a-b56f-9ad971ec05ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625907, "uuid": "ba3fd904-630a-4de2-9f07-bb2265b43938", "value": "12288:C73CCYj+xgT0sFV/iPycuiushYaW35mM90Hk3qsCdpT3Zl9:2YjcsBvc9H65mMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624625907, "uuid": "7d4fe4d2-d07d-4c01-9356-97a42de28546", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624625907, "uuid": "808484fa-b407-43e6-b8e9-1b17012a3861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625907, "uuid": "b1418d55-4da6-4e78-bcbb-787742058f6f", "value": "IDN\u00b004129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9361b1-d57e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602291, "uuid": "adb671a4-098a-43b8-972c-99823ca24b64", "comment": "Malware payload (AgentTesla)", "value": "12b19794813be526b7f3c58a4508b9d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602291, "uuid": "e7a5e8d7-381c-406b-9cc2-53206b8da8b4", "comment": "Malware payload (AgentTesla)", "value": "065a971c432b0b52e8f26e693844feeee8811b2f09bab52ab98a3d9aa37da7cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602291, "uuid": "d8aaafc2-ce01-4ccc-8ce7-45a08db155c9", "comment": "Malware payload (AgentTesla)", "value": "29ee407e7d076d59c52c996b88dafa1e29096df3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602291, "uuid": "252be416-455f-4307-b635-28f4e5351f17", "comment": "Malware payload (AgentTesla)", "value": "e18739a3dcb9715e33971c26af1973bbe72452035f736a559d2754027b596ec916458ae082c172dcf9613acf12750232", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602291, "uuid": "a1450bd1-ac6a-488f-a6fc-e2891be1a148", "value": "9A94F10467FA1726F1BE9BF946D071918BBFB1672616E58C0DC120CB5A62F40CE81E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602291, "uuid": "8869564b-b89d-4cd0-82cf-b3eae92260f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602291, "uuid": "f69a1114-e6c8-4d3c-9e55-8b13e2ca9550", "value": "12288:89LxR/LgdKZpaMd10CI43SFPTCVkOxjNYV2fNyMz:sLxRjlZpaMYCI43ObOxj6Yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602291, "uuid": "cb98ee77-6cd6-4a6c-a5fe-a4643230a7b6", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602291, "uuid": "b4c45a80-2acf-496c-b320-0fc21f7411c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602291, "uuid": "3bc21453-a4e3-40bc-875b-8f1304616fd3", "value": "Remittance Advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19510b8f-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624642256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642256, "uuid": "4d1644ee-db8d-46be-a6c6-eef347e44fc2", "comment": "Malware payload (BitRAT)", "value": "67fa8a579c4b6fa26f6b39b63089631f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642256, "uuid": "88b253fb-33e8-45b1-b0d8-361859621ae2", "comment": "Malware payload (BitRAT)", "value": "06eaa572cc393d8121367c6bbebaa97068e738bd2ceee60d32b8d894af68a595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642256, "uuid": "51bc831c-cc65-4686-8d77-ad6f0a6751f9", "comment": "Malware payload (BitRAT)", "value": "97d73e1b5eb3118feeda917642e7b10ee095fef4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642256, "uuid": "e05cfb55-dd30-414f-ac41-a34d7ed29bf3", "comment": "Malware payload (BitRAT)", "value": "309ad05585f698159bf22f38a87bfcf1aad3c3a99c684bffa9985321c0c9ad704298604ba3da2abb91b55e4b1d7952ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642256, "uuid": "63f783c9-79f1-4921-a7ab-a5962ef6a394", "value": "CA75239E72BE5B73D40706B03E55E3E901AD9C34A96D0B0BE70A576C3E76E8649B1303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642256, "uuid": "a58af87b-4bdf-4820-b1d9-dda888111a75", "value": "6930eddef69ab61e6824340dff912310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642256, "uuid": "e67e2d10-55a6-43ce-a52b-2324f30096b1", "value": "24576:x1vUTdyqk0h3zR6ecpeiQuBTZjIszyAenUZIs8kwK+4qb5/lWkCoPUbz8m+O:xVU5y29zR6Bk6Z/zVa5bZY6PUbz85O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642256, "uuid": "a87b01dd-5ff0-4fb3-8848-2fe97ae06749", "value": 1642496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642256, "uuid": "662a8ab2-005e-4505-a719-aaa22cdd0f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642256, "uuid": "13239719-5e51-4692-9c19-073695d96001", "value": "67fa8a579c4b6fa26f6b39b63089631f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbd2c5c-d5f6-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624653940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624653940, "uuid": "114593d8-4d3b-4195-8f5d-76113a556ae0", "comment": "Malware payload (RaccoonStealer)", "value": "0fed433a7063da2222fd37db3832e33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624653940, "uuid": "3ef58d66-6044-443d-ba27-45f1ca475fe2", "comment": "Malware payload (RaccoonStealer)", "value": "070c45432f832f1b39c1882b4f5ef8729343f24665b6b5a090ee775dbc116540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624653940, "uuid": "b24bcb0e-d8d9-43a1-b51d-bb4617833b32", "comment": "Malware payload (RaccoonStealer)", "value": "e4189d7659cfc556a82fb7e2953650f6af1d7575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624653940, "uuid": "e56075b3-6f20-41c5-b2b1-9be64d5e0ce7", "comment": "Malware payload (RaccoonStealer)", "value": "51b3302f8639463ff53bb7d8e2b0778c73e1c9faedf6b51fb17aebf5f2feddf5a9b507f78a94cb6a4773b70e07a7fc44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624653940, "uuid": "e765448f-1d2d-4034-9428-924689f1a30e", "value": "8535D127A2C19437D2B32E348CBB51A898357BCC2D25D88B6AD83F489F367513B72157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624653940, "uuid": "d7b03388-c2f5-44a9-8dc5-99da446a2873", "value": "1a648ebd2094332fd6fb5f72cf1c7971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624653940, "uuid": "d90a3d4b-30e7-4824-8bd2-b44186fe55b9", "value": "24576:IscqzDQhX1lerZ4v1acwAyXIrt2go5pvxM+Yy5X1IVeY27:I4ghQZ4tyA1r3o5ZxNX1IVeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624653940, "uuid": "0b38765d-907d-467f-9d20-777698f76c05", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624653940, "uuid": "8abcbfa2-3346-439d-a0f8-f8f1c20678a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624653940, "uuid": "3621d2c3-18d8-4197-a2ea-e9bd28c2b248", "value": "0FED433A7063DA2222FD37DB3832E33E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6f9417-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624642266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642266, "uuid": "df63bc53-4390-4ec1-be6f-13092960de08", "comment": "Malware payload", "value": "ef9b686e709756981c01e31241c427e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642266, "uuid": "e4b97042-905f-4a9e-8e2d-4e1d71297493", "comment": "Malware payload", "value": "0903c546b7d2e02f5cb582c2dbee827939b008cf1232d0dbc0daf94df929cb44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642266, "uuid": "8f060105-1b78-4fc6-aaae-567b98e6e3da", "comment": "Malware payload", "value": "78ba81ed7c4926276006e33fcb9de4cdde794b15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642266, "uuid": "2c5d3db1-b345-45d9-86e0-17affb39b7b1", "comment": "Malware payload", "value": "afc67ee41245476cb3ca921701146a80b214b1c30e87bc2e6ce865b3b6e9c7719650b907a86d3f8944dedd2a576bec0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642266, "uuid": "a2edeffe-65d1-4b0c-bd89-31405be4d4ee", "value": "4EA2D06009CE80A2D1E20DB3BFFDC507826D12F5D42B353A158993D89B531A1EBF54DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642266, "uuid": "0cdfe5dc-7f4f-4626-854a-404475249e6a", "value": "384:6bzd6kwAFEqvJ1DDFnJT2NYzE6baYcmLxcqCD5rxmdGUPYI:6nEkwADB1DhnB2NnY3LxXCP3UAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642266, "uuid": "9b869dc0-5cdc-4ffa-8d64-05ebc245110b", "value": 21816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642266, "uuid": "899493b1-764a-4e2c-bcc0-b1db37bf6136", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642266, "uuid": "d03c3163-c343-4898-b512-2fad6bfcc84d", "value": "ef9b686e709756981c01e31241c427e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e0a2ef-d5f8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624654836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654836, "uuid": "8886fe00-19d2-4a46-9f0a-03983079ce94", "comment": "Malware payload (AgentTesla)", "value": "41bfa1dcad95a574ac86bbf1a9349b38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654836, "uuid": "26e6993c-c7fc-4c20-b09e-160ab1fb4be6", "comment": "Malware payload (AgentTesla)", "value": "094f918229eaea818f440c4b2e29a1a6b31f14fd598614fb32f5df196d9dfa7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654836, "uuid": "d6174ed8-c142-4c62-bdbc-f74e6d9c8cbb", "comment": "Malware payload (AgentTesla)", "value": "5377245d11717c705635624aa8ae94d4193d06ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654836, "uuid": "0f58e740-4bf2-4af7-896a-e5cfa0b9b431", "comment": "Malware payload (AgentTesla)", "value": "9eebe4c10ae9342821c5a5c733b4a298438fefd9ad9ccce40961316d9d19a11179cb0ae41d567dfcc17fafedbf615f31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654836, "uuid": "8ef90739-d2d1-40e6-8f90-bf7112510296", "value": "8AA4D08837B95FA3E4BA4BF81AA0B40083F9692B753AE55D5CC330CA05A5F104D65F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654836, "uuid": "fe16b585-aee6-49e1-acf5-2d79e840fa1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654836, "uuid": "9531fe83-cdce-40bd-859a-d1c80c637c8d", "value": "6144:e34P86jIlgv5KzK92Dx5OZcVK6RUt6V9iquNBJfJcGz3RiIv3pmVQ6apG/xZioXr:YYf92S2V+6SNHfOYRi08VQ61wxBp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624654836, "uuid": "1576e035-eb00-4746-ac42-754b887a06e6", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624654836, "uuid": "0e703c2e-3c56-4b63-a76b-a957cb982bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654836, "uuid": "c25f7b41-7ad2-4bb4-8441-30ec8023b5c0", "value": "shipment docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefa184a-d5e0-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624644654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644654, "uuid": "8ca6c594-831c-4f23-98c2-d1a5e367319d", "comment": "Malware payload (DCRat)", "value": "33de3636eb2fd37a7d053fd849312a49", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644654, "uuid": "12992695-b685-43c2-a71a-84ad367e978d", "comment": "Malware payload (DCRat)", "value": "0b13634910bb0fb08db6f26b7df2df4c91ce0b33cdb5b546cfcb58a101add6ca", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644654, "uuid": "a0888bde-aee7-466d-ba0f-82f1dd256c44", "comment": "Malware payload (DCRat)", "value": "7785c0bc29a8ceb33735d68592c33b2b2169c3d2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644654, "uuid": "e55840e1-883c-4dfb-aebe-7d140c7c73c7", "comment": "Malware payload (DCRat)", "value": "62d4471360fe4fbebab65b951cb58b2e64c579670198d9472703322fd68c03de9ae083ac494a73ba62a484b1c367fdbd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644654, "uuid": "e38cb700-1f5a-4789-beae-b764ba4a4044", "value": "16752342FED14472C563083005596B916A7BBA301B289FDFE3D88EADDA751D0FB31A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644654, "uuid": "c5fffb88-62f8-48de-ae19-58a5919c72b0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644654, "uuid": "d49976c0-2c9e-4c8d-a495-403eaa616c83", "value": "49152:KbA34jYoSv/+aWpyugStVv3DJ+QgoDl63dc:KbzgnKpyugStVvzJHRl63dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624644654, "uuid": "1304eb98-4707-4435-bfba-94f75d49db8a", "value": 1597762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624644654, "uuid": "6474a8cf-8a7e-41cc-a659-b1c6a6df8925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644654, "uuid": "4b345c11-32c9-4ff5-a814-32cdabda2f47", "value": "33DE3636EB2FD37A7D053FD849312A49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c3f3f2-d5e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624646464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646464, "uuid": "4a12a02f-b90f-4f7b-a57e-25719563a632", "comment": "Malware payload (Mirai)", "value": "3692df3f2d577a3235909acfe66c05d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646464, "uuid": "30f9989b-1560-4063-b74b-33cdcf2f83d0", "comment": "Malware payload (Mirai)", "value": "0b25a9cb735a5daafc07d6b9042c417ff704771a17eef80d1c86c69c20e009d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646464, "uuid": "696a4a20-3d22-4974-9686-1b8bd75f9ea3", "comment": "Malware payload (Mirai)", "value": "314b33866da17a63c326cd260c7c9f210988b291", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646464, "uuid": "a58a7630-e080-4be4-a92c-939e0ac31a56", "comment": "Malware payload (Mirai)", "value": "07e5babea45efbc385d434d9d1d5d8cd64d6b1531950de734c43a264e7bf6bb804bd92f52174218cae5342390f1eceb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646464, "uuid": "4a5522f1-625d-45e8-b0cc-a01796b9c5ef", "value": "2573C60E3E259FBCFB9C863547B78E219688339626E1C544E15CEA011E7024E746FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646464, "uuid": "85273f31-2ade-498f-869e-8d2741af69bb", "value": "1536:0tVXzSLZf1adIVeHImWTUGITufVttgxBJirsSrLwYcaltp:0tBzCqdZHImoUGIGiCrsSXwLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624646464, "uuid": "ad490209-1b27-4641-afda-ffdb11fbbf49", "value": 77396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624646464, "uuid": "483033a0-a5e0-43f7-9a95-a82a44bb5ea1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646464, "uuid": "0a02212f-9d73-4c85-82a8-0453afccc708", "value": "3692df3f2d577a3235909acfe66c05d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df2388c-d5cd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624636465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636465, "uuid": "3d0d1143-f436-4086-83b6-c9e3f041e7c0", "comment": "Malware payload", "value": "27d857e12b9be5d43f935b8cc86eaabf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636465, "uuid": "cc9e9739-f94a-4841-8547-df1bb637eaf2", "comment": "Malware payload", "value": "0b7996bca486575be15e68dba7cbd802b1e5f90436ba23f802da66292c8a055f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636465, "uuid": "063ed74e-1be7-4168-ba13-74632da6525f", "comment": "Malware payload", "value": "ffebffc89a0b417e56dea3fdce962ee54f7ce00f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636465, "uuid": "2b4d3b62-4310-4ea7-94a5-a70aa7b702ac", "comment": "Malware payload", "value": "b601839a0f6f2a7579c82ee18773ddf33739e8e634faf4cf691af3aa8d461d7971906c6e48bd143a7803744e8cc4759f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636465, "uuid": "4b26fab8-d2d4-4e75-b6f9-43f37ca8937a", "value": "DCA46E07BA9048BFD8C5C1348B9B96379AB3F0951735726B3684EE643A51B709F0FB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636465, "uuid": "0cdb8090-8c04-4586-89fa-969339a5b121", "value": "12288:jp429hwR3RIryG/iMTL5IG8FEVVnk0Okn:jD9hwnrhMTGG8FEvk0Okn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624636465, "uuid": "f92d961d-34fc-45ab-a915-9579293be7b3", "value": 487166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624636465, "uuid": "4871a542-f086-4ccc-9d5e-e2a8d68ef048", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636465, "uuid": "6f3316f2-3f3e-4ae8-827a-e8a876b8946a", "value": "0b7996bca486575be15e68dba7cbd802b1e5f90436ba23f802da66292c8a055f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cd3109-d596-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624612965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612965, "uuid": "a529b203-e6fa-4e9d-ad3c-5ae18beae6a4", "comment": "Malware payload (AgentTesla)", "value": "860eea2deeaffb32f5fb2cfe65cdf9d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612965, "uuid": "e72c3621-d76d-4710-8b15-a9db4d8d9190", "comment": "Malware payload (AgentTesla)", "value": "0bd55d614ee8d56fcc5688b5e7cc0245903bb774c1400d5b088482a7d7f3c1c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612965, "uuid": "a8987ba4-1641-41ed-93dc-f9ec487de815", "comment": "Malware payload (AgentTesla)", "value": "c7808fb067dca3c9a6310c97e01168a24383dd70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612965, "uuid": "9c6f9821-932b-439d-8b5f-cf874bbba2be", "comment": "Malware payload (AgentTesla)", "value": "8e3eeebb761b35ee47b3cfb879a006847bc41da467bb5b1149f08dc5d0ab75475b2bfd0c63fd94c0400d87ab32765c22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612965, "uuid": "98563b42-f038-498b-849e-1d3a81c6f6c9", "value": "AB81A4F012286C93DEA212A3D955FE271476F35FC5CF4BC0722FE9F50B1A6262691941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612965, "uuid": "3dda232c-c40a-41e6-ae48-31b831708a50", "value": "96:DdO1+b/E6sZhqrlIzcmxiT3NTCYGtNdDc189WVg3xy+NcyTRdiyZp:MMb86Dr1mxioYGNwNg3jNRTRd5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624612965, "uuid": "9a48b154-97bd-4a7e-b72d-970b419e0452", "value": 3932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624612965, "uuid": "6e823557-849a-4858-92e2-2cad7ede166f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612965, "uuid": "4af3a8b9-bd19-402a-99ba-de6227554432", "value": "Order No. ZP-168968.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5973fd0b-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631626, "uuid": "6bf94c46-43e2-48a1-914c-05d0a7d2b466", "comment": "Malware payload (Mirai)", "value": "cb7429a18aa4e84c795d06ae62a80bd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631626, "uuid": "aea8d66a-36c9-45a4-b77b-dcc64b9adde8", "comment": "Malware payload (Mirai)", "value": "0d0e3af1caf00d0248462085661400c82da419326592e1698f760afeb696cfeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631626, "uuid": "9adee8bb-c8cc-4809-aec8-29bc558b1bd4", "comment": "Malware payload (Mirai)", "value": "c4576390157a2e7173e4666bdfeabf87ab61d3a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631626, "uuid": "e3a2bef2-bc08-4184-8a86-b716b176345e", "comment": "Malware payload (Mirai)", "value": "d750dc6b1ba4e4d462c26dcaa4ba24fa36d152e93fe52c7574d1f6a5e4223b7a297c973efa53d398c4bb26cd0303bc69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631626, "uuid": "06ba8002-3e2a-4aa1-9544-69ca9ac805f3", "value": "FAF35D46FA404B13C4D62776BAAF42463332A794D3DB73039A285FB43F8666F4E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631626, "uuid": "d1007111-112d-4794-a604-07aab5185341", "value": "3072:wT9pbAMKn5HIrWLlnTMoCh1N3cPGR4DBMpmyDr+TM/9IEa98Mcm8wxQ35x:I9lAT5oqx81N3cPGyD+zDrKM/9k98hmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631626, "uuid": "53a3b8b1-0f32-4604-8c9f-9da79de8efa1", "value": 163530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631626, "uuid": "a7b088ac-8924-4666-b9a0-c2d08f14ae3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631626, "uuid": "eed92592-25e2-454c-8623-b39d878f3cef", "value": "cb7429a18aa4e84c795d06ae62a80bd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f9a189-d5a8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624620718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620718, "uuid": "bc230480-6a92-4d82-81dd-cf4a02b89343", "comment": "Malware payload (AgentTesla)", "value": "8838331ac916b96d195fe966ccfd107e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620718, "uuid": "4f444f79-6904-40c9-ae87-851c06083c3f", "comment": "Malware payload (AgentTesla)", "value": "0e6db9ee7a673205a0396715f25d339512714709f596ef220651590ef0945d57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620718, "uuid": "8b18b30b-d628-47c6-a567-2840ac61b218", "comment": "Malware payload (AgentTesla)", "value": "4c10a5736f29abcf0cf217db90903b3324adbfae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620718, "uuid": "9ceee4d7-139f-4ecc-b4d3-0751c91424d6", "comment": "Malware payload (AgentTesla)", "value": "ed2893d23d0a2866e750f71aa272925a4a5345020b63e941abd0e367a5d8ec63b11ad001a3cc0affddf7c0fac7c846ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620718, "uuid": "4c6bdffb-f47a-4898-9f59-3c3f379a196e", "value": "BEE43360B48ADC8C5C015E0ACBFF1678FAB83AC37C352557863567048D451EFECA68AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620718, "uuid": "3521515c-73ba-44a9-a779-254d90aeb87c", "value": "12288:iNUwJdj1U2kCakp4uYrFTLoXUzQBlz6SPNzRH4jUr/zC+6aN68ZSkLd8O:+UwJx1UtkpK9slz6Yl4o/0+68ZSoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624620718, "uuid": "1bdd6e1b-0783-47d7-921f-c374ab020554", "value": 671297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624620718, "uuid": "6cba173a-6094-473b-8110-2461747e25c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620718, "uuid": "0d6d2a71-fa5e-4d1c-b35c-b404fa8bbaa3", "value": "WaybillDoc_3227610761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aca33f9-d5dd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624643171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643171, "uuid": "af0503a7-ce82-4b1a-a0e3-4728e0d107f2", "comment": "Malware payload", "value": "3b903d8c6e122d1ea7ef8f35e832ed1c", "object_relation": "md5", "Tag": [ { "name": "cve-2020-7961", "colour": "#85B6B9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "online", "colour": "#0AF41D", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643171, "uuid": "ba924091-ce5d-4baf-afe2-d5c6609df1ad", "comment": "Malware payload", "value": "0e79ec7b00c14a4c576803a1fd2e8dd3ea077e4e98dafa77d26c0f9d6f27f0c9", "object_relation": "sha256", "Tag": [ { "name": "cve-2020-7961", "colour": "#85B6B9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "online", "colour": "#0AF41D", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643171, "uuid": "4330dd4b-c73f-4545-9146-032e0316e72b", "comment": "Malware payload", "value": "f9052cf47bde85abaa921273af06ec4986e181e0", "object_relation": "sha1", "Tag": [ { "name": "cve-2020-7961", "colour": "#85B6B9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "online", "colour": "#0AF41D", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643171, "uuid": "a32cd70e-970e-41b6-b0ae-45a2a066356a", "comment": "Malware payload", "value": "73bd1e651b3afc60c907dcc60cd689311a3a17ad77532904f2c901a02ae972f072d8149a3f0305dd8b39b4643109052e", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2020-7961", "colour": "#85B6B9", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "online", "colour": "#0AF41D", "exportable": true, "hide_tag": false }, { "name": "xmr", "colour": "#5F5221", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643171, "uuid": "9bc1f8f6-fb80-4eb4-aafa-1d24b8e103bf", "value": "31E2154D8071ECF52D65CC66DEE13229B4AEF188C5F7BB88AE213D3C15A4005FA715AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643171, "uuid": "f7d54389-a293-487b-b920-bc58cdeb579b", "value": "768:p7fzQ5VFNcDAFLcIwgnoYq0xFBVdHtw5N:0VF+D6cIwgosz0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624643171, "uuid": "ab4f71b0-49dc-45d9-b3fb-c6138be4a2dd", "value": 31741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624643171, "uuid": "c4fdd194-91bb-4a09-937d-d9e6aff33b35", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643171, "uuid": "c70dee13-22bd-4c2f-a2da-233a5927f1c6", "value": "d.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea871c5-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624650909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650909, "uuid": "9a371e23-ea1f-432f-b157-256320545488", "comment": "Malware payload (Mirai)", "value": "2ce3b3af3d0e3cbd555a7bb5a72f11e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650909, "uuid": "4ac79d0b-04d4-4011-b56b-6444d6f17639", "comment": "Malware payload (Mirai)", "value": "0eb44a57cd6f544a01c8b004ccd424379d0572331a30a23a0dd139df524c54e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650909, "uuid": "0b471b35-3e3d-4954-a425-53d80ec62182", "comment": "Malware payload (Mirai)", "value": "2744da2afc80b2adecea52f8d0a2813cc333f050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650909, "uuid": "762a5d39-c330-44b9-8b7c-26492076ef34", "comment": "Malware payload (Mirai)", "value": "2577d648fec8d11d61b50b8d3569997341ee5999e30405b198f7eaac87fb29e583f55fe136e5e80b4155c4dcc09b820d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650909, "uuid": "ca6387db-727b-4b49-a33f-dec3ce0d4212", "value": "98B2D01EC0AE6EB4FE9B7D356D41E2817B619BDF3A62CDC016C15B110622D281F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650909, "uuid": "d4a03a82-45fb-4117-bd5c-f7d492f50cf9", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoBfWM4uVcqgw05Vj:2AApCdvwJr69VJoA8FZtxCo86fl4uVcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624650909, "uuid": "c76b8592-2717-48f9-b87a-2aa77b8e1adb", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624650909, "uuid": "6aa3b9ed-aeea-41c8-b48e-59c7db127496", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650909, "uuid": "287b91f9-610c-46c1-9ee3-6457fc785227", "value": "2ce3b3af3d0e3cbd555a7bb5a72f11e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5dd413-d552-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624583714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583714, "uuid": "96467474-6fab-4142-8ea1-b109f6e9720f", "comment": "Malware payload", "value": "3eebe0863c6b5bedcc6d0a8418d5aa25", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583714, "uuid": "2ff9a2cd-d133-4ebb-bbdf-0dcb13eed04f", "comment": "Malware payload", "value": "0ec52afd68d149f89dd7ffadae925567e229f5aa4a78fe623fdba3bc9701110c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583714, "uuid": "76d583f3-1783-408d-8c52-3bb3ba014021", "comment": "Malware payload", "value": "583aef7ad7ab61860fbc333508fc9029b0097f34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583714, "uuid": "a1810be1-9b4a-4c0e-a898-014e0d7cc2c0", "comment": "Malware payload", "value": "76c3c6f36dd9b823179a228d480f262b9e7d8a28425cd6a4c582df50169abfe11fb025a8948e6bbf88570e81f5124cf5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583714, "uuid": "2bd854ca-4443-4efb-a1b3-4ef7ec922117", "value": "A32633D9407CBF606171A3C9AC96D42F11352E19B78CE365EC918ADB0B88B77F53281E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583714, "uuid": "91855ac3-49dc-4532-8499-199876b466a2", "value": "98304:E7UKVMKLcIM1U48cdtvHp8MnkEhf0GHYg7KpCdL5y1VOg59WKJc4FDMi6vkc:E7UWk9VdBpvlYpCx5OVL59WZe4Rkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624583714, "uuid": "f0b3dc60-8718-4f00-826c-9d5d78d7e5e5", "value": 4426280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624583714, "uuid": "bcf8219c-14fb-42cc-8629-ec50c87f016f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583714, "uuid": "1af7dba7-31ac-4bf4-adf3-6d70cf8d712e", "value": "3eebe0863c6b5bedcc6d0a8418d5aa25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d969b6-d5b5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624626010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626010, "uuid": "9d7d72c6-4bf0-4622-9be7-00f5fe22d0b4", "comment": "Malware payload (AgentTesla)", "value": "43976031f98a5138e132c07e56f51691", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626010, "uuid": "515828ed-84b9-4539-8a89-57d305275a45", "comment": "Malware payload (AgentTesla)", "value": "0fa060a6dcf51fbc643db7b939ce8d01327606c058130825684258c58ff948b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626010, "uuid": "041f597b-b653-4f94-969c-3abce64ff901", "comment": "Malware payload (AgentTesla)", "value": "62e57ab788697537dc01dcda92675737d3994920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626010, "uuid": "a6b33086-5b9f-467e-b21c-502afba2ad06", "comment": "Malware payload (AgentTesla)", "value": "e7867f1b222a03b348f336b5ff7f39ba0659bff6a8b3aee46cba93e1a4a35d82fedfba3e7459443f3dbb4536dc2c4b60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626010, "uuid": "22935523-9aef-4059-a7bd-aada0d49e6d5", "value": "1C159E24699C4319F036EABCC5B42E414EA9BD22D612D4DB2AD33E8FF733540CD5662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626010, "uuid": "ccdca40a-728a-45eb-b90f-f8289574ce4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626010, "uuid": "ff261438-912a-4160-9b2b-d2c2e81c0e9d", "value": "12288:oCAuJZaF75GF2wtJOExCcEE/2AZwfwCresa5juer08Yf1D8WRfShTmFPXOauHJgp:pABbwn/FEi24fcZak1Nf1Fh3F2a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624626010, "uuid": "6419b40b-109d-4b4e-9f87-c89e4bb20ef5", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624626010, "uuid": "b3fef2c4-9db4-49e6-ad0f-04d6bc2a77b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626010, "uuid": "b78ed028-13ae-4b56-beb4-efe6029d8bce", "value": "SHIPMENT50797 MRI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48bd9ef-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624600936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600936, "uuid": "5c9e9a0b-8b25-434c-96e3-b5daebdf1177", "comment": "Malware payload (AgentTesla)", "value": "0fa7b700938c8992016601ff8cd2274e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600936, "uuid": "8bea77e7-b5c5-43fd-a68f-0d6f88bdb71d", "comment": "Malware payload (AgentTesla)", "value": "0fbbf21579541affe4ab328fdeffa8b960d235ecaf358b4be835c6e7422fdb60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600936, "uuid": "4872bcfe-c9fc-44c8-ba84-1ed328840218", "comment": "Malware payload (AgentTesla)", "value": "08a2bea19dfb8afd428c8080ab1a157046c9351b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600936, "uuid": "aad0e054-701a-4eb8-8106-171cdd94aa8c", "comment": "Malware payload (AgentTesla)", "value": "ad4b14c1f0985bdfef2eb9578917d59930569efbbe32559c2953b5bee1b220702c92ef1826a38f62a6431c37f2c31cfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600936, "uuid": "fde2e999-2904-4177-8700-930ee58af220", "value": "2EE4332F39476573C77135BA01928B44E012F8FD5E3AF5B2B61B3AE72DFA3A46105881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600936, "uuid": "0e1b1439-7ccd-4224-bb70-0ff44a7c0e32", "value": "12288:Okk9RMTjWG1iftE59BrhNTDy8KN2N2eMfThnPOieM/sEHEB72+T0InJad:u9o/1iftE5RCQMfThPORMVHQ7UIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600936, "uuid": "b1bde901-a7bf-4c73-a9f5-a1ccd3ddc3a3", "value": 687023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600936, "uuid": "8386433a-b8c0-4c7e-af9b-108a2bed9c6e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600936, "uuid": "686f8a9d-193f-4bb8-b558-48e0e9c954e7", "value": "BAPATOH OFFSHORE SDN BHD.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc28a68-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641723, "uuid": "eebc011a-10d1-4903-bb20-3a11db69405e", "comment": "Malware payload (Mirai)", "value": "ee26b600eaa07529ed635eec767838d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641723, "uuid": "aaed3cb7-3965-4cab-b8b3-e95630bdffcf", "comment": "Malware payload (Mirai)", "value": "108213424ef33b34d55dd2ebf1ed37215bdf91aede450ba6ba1953e4cdd16652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641723, "uuid": "b0090a7c-19dc-4152-ba68-16c7d3184e37", "comment": "Malware payload (Mirai)", "value": "0a192e171e2ff69de9a084d145a8c28bde130540", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641723, "uuid": "0865bdaf-e7ad-4685-8872-5f6a0ff06080", "comment": "Malware payload (Mirai)", "value": "3d685e05d8e8a49d0094b7b4b37e59e9fab690c51b75564c9ea2d085874573c578c937319ef7d372b4aa88d1c21d370f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641723, "uuid": "41d991f1-c40f-4a77-805d-f567d800200b", "value": "F6B2D0B27015B8B7C6E500B79AEDCA83FB800EF8D0E873295465099DA6D5942BBF1247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641723, "uuid": "7ac5ffbc-454c-4ced-bae0-32d271539e7a", "value": "768:fX9nxn8o9wnBoWzEQf2EjKb3phCs3Uoz6:ftn+o9wjfBAZh/z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641723, "uuid": "6523ffa0-7d5b-4e00-995f-2c8be1bd2cf6", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641723, "uuid": "d8b8b52e-a3c5-4891-8481-34a8d2959e74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641723, "uuid": "428d9b4e-cd4a-4d4c-9e1e-0b069dd5a4f1", "value": "ee26b600eaa07529ed635eec767838d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667413f6-d5a7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624620052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620052, "uuid": "9dd5d94d-428c-4462-bd7d-39789f44a140", "comment": "Malware payload", "value": "17ee198bda8cc1368012beda4ea30268", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620052, "uuid": "088441a6-23d2-4128-8ec5-56d8a0d667a6", "comment": "Malware payload", "value": "11257a5fb23cbcdd66062dbe30430fee4074bda15348ec5309599da0c61116c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620052, "uuid": "89334eae-fffd-477b-8e78-facefa06c8fb", "comment": "Malware payload", "value": "493c2a1cc95009b296e27393a4b0f3f1ab37c8b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620052, "uuid": "0e52ad76-b57e-4127-885a-9d756dc037e4", "comment": "Malware payload", "value": "6201ab31b501078c604d352d892a45b45177d3424ba73b7e2059c742f2361e52817a3f5203073118a71ea39b0a72816d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620052, "uuid": "08c9b8d7-3acb-4b9b-bf05-b2c1234a708a", "value": "3542AFB6DE01F12CC265D5BC245E83E5FB1D62C32760A00D24B67AAD5591457C38FECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620052, "uuid": "93bed71f-76b3-44e8-b35f-069dbb7b8559", "value": "192:ScIMm8/U01QURhCNIZ1sJC15bv/0AVz2/oSlaD0sNaiOjLvVQaIh6bl:SP251QKh7ZKJCva/oeisQf4bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624620052, "uuid": "5f5381a0-0cab-4695-8d2b-0df19a7c575f", "value": 12796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624620052, "uuid": "8e7e79ad-bd56-418e-9fd8-6aae8d870eb7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620052, "uuid": "7e60af25-f81f-4171-82f6-269cc55d8170", "value": "FROM MRS SHYLOCK DORA..docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebfe7df-d5b2-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624624870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624870, "uuid": "2f9e9765-9dfb-46b8-9757-f62ada438d01", "comment": "Malware payload (AsyncRAT)", "value": "654b2f37033483ad3be1373dc3ab6bcb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624870, "uuid": "0be4552d-5645-4afd-b6ec-b7d8ec1c68b7", "comment": "Malware payload (AsyncRAT)", "value": "112d171434856db8c8da37377dd2b579006b8399cbfcad3f0c2b6af84535e169", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624870, "uuid": "12f73e8d-7a96-45af-b2da-801682b6e0cc", "comment": "Malware payload (AsyncRAT)", "value": "358eb00abf4a61bd089fb316cad9e4382c4574cd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624870, "uuid": "111f53fe-5c62-41d7-83c8-dd27fc78972f", "comment": "Malware payload (AsyncRAT)", "value": "170014565af80f3182be5be75c995356253fe02459325de500b545bc567fbbaf30269ac309b89fac89f28262a1503ad4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624870, "uuid": "185eb28b-6b93-475e-81aa-09043af90d66", "value": "BCE0CD558F6D8E06635145CBC0CF90579FD4865C277C58947559CF9325670F21D11FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624870, "uuid": "9f9887d8-6e09-466e-a54b-998fd5cd1103", "value": "6:tu+MMlGIeYVekMAJ7jFRnFFovXoqfyJHA0nS7mylQ:tu+RE4V/Mw7Rc5fyJg0S7mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624870, "uuid": "2fb3d97e-a782-4bfd-b2cf-fffcb242fa65", "value": 312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624870, "uuid": "7717ac6b-5756-4880-a40c-e7fb0ad3e3fb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624870, "uuid": "9d617d52-d415-4136-ac4e-8b0ccafd3068", "value": "25-JuneStatement_ID160364829128662.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a48209-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603162, "uuid": "8a5f2941-901f-4649-9ac0-ebcf0a71d888", "comment": "Malware payload (AgentTesla)", "value": "aecb99b99defb05d32799a70c86077b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603162, "uuid": "1bec7fbe-9c61-4357-b015-b6c1f13beb1d", "comment": "Malware payload (AgentTesla)", "value": "112da541dbc30759efdbafe2fd339a542fc9ba2e14c1bd8a8a9ea14380c2572f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603162, "uuid": "cd0a935b-8c68-4cc6-aa34-fba5e237144b", "comment": "Malware payload (AgentTesla)", "value": "c7b6f29b747c358599a30af0ef22bacf2deefd54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603162, "uuid": "eaac44bc-582a-44b3-b9bc-5ad31a5f3509", "comment": "Malware payload (AgentTesla)", "value": "965d00ac5057be3044c8b7de28df0c5a44d65489c7a7585e55cf11193f6d3ab3a8ad15f15d4994ba8d6a2ac6fda7d95c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603162, "uuid": "f1151d2d-92ec-4889-92b6-0a57e8c3f485", "value": "56E4235128B4A5BC1E22B3DE95D393716B12CCFC7A24AFB3CB41453629EA411F0397B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603162, "uuid": "844f6f47-577f-4d7a-8a30-c3939ac55529", "value": "12288:+bmHLQApq+rIUddaZmIEoRqXs+em586d2Nvs7MmTEyp9KqR2Ciu47:SmrQh+0Ud8E9XXumJ7hY9qAdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603162, "uuid": "8f35f411-4be6-42a0-bb25-cf31a6e31223", "value": 678181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603162, "uuid": "56f6f62f-e0a9-4b61-89a4-50c703431b33", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603162, "uuid": "0305ad5f-568a-4d39-88f8-1338dbb47b22", "value": "SOA 2908414.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83459d0-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631892, "uuid": "ef1a7661-784e-4fd1-a666-c95d9c8ac3f3", "comment": "Malware payload (Mirai)", "value": "bd5bb4c0ff633102fc15569528080666", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631892, "uuid": "92f8ef94-33c8-45b9-9e6a-47bbb87e4e43", "comment": "Malware payload (Mirai)", "value": "1382d894b558969caae20216f05707fe8abd2c540b0734cf6e814e3e84265016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631892, "uuid": "de21b4c9-b510-4967-8884-e4741e69a651", "comment": "Malware payload (Mirai)", "value": "1fb4ad344d8c10e89dbafea6b295a2607179306d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631892, "uuid": "a99fed70-dcb2-479d-b13a-380901b2ee1a", "comment": "Malware payload (Mirai)", "value": "a0ac7d3da276fd04ce6da542130c972826499ed857d7c04ab13d16f969cc141e2958f63b0c08c1eff2247cb3a2874b86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631892, "uuid": "6797352f-160f-406c-8d62-83b6d8338cd1", "value": "D163390177584E43D1A61EF8293F17E193FEEE8021F4F5842A0FD64A9272E33594AF99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631892, "uuid": "dd86c08b-fa17-43ac-b3c8-5874f5c4a76d", "value": "1536:O6l2t27TeIIKqxZw6wwCuXK0wSe8lajBjhK6:OOEWCXw6jKSe8Ijdo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631892, "uuid": "bcd2dea9-2b3b-49b9-a076-d8a57b497caa", "value": 68664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631892, "uuid": "2b467d70-f4b0-4200-90b9-70f8f4cfcab0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631892, "uuid": "0fef6472-5202-4b70-8c10-285cdbeb94ca", "value": "bd5bb4c0ff633102fc15569528080666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c318f4-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631888, "uuid": "55958f60-b57c-4f08-b307-6533fbba03b6", "comment": "Malware payload (Mirai)", "value": "ebbf2b8c63cfb0a6f145f296f96fa5db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631888, "uuid": "1b62a5cb-20ea-4ca1-85af-481646cca33f", "comment": "Malware payload (Mirai)", "value": "13f794cbb7373081bf60edbdfdcb2d59f420abcb39088dddf45433cfd349057a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631888, "uuid": "5b112085-8584-4ad3-a239-c18b2b8e04bf", "comment": "Malware payload (Mirai)", "value": "a0283d5253fc1f087b5627bb7fa61f01908aa110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631888, "uuid": "3ba27161-46b7-427e-abde-d6f7fd9f754c", "comment": "Malware payload (Mirai)", "value": "cbb899c585cf60ca884662df8a9ac5a6e8765241c0c1b9522973e39af572598430afc90a422fce2971d8284108cdb479", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631888, "uuid": "88ed4457-bcd8-4c84-87cc-f292a7e00fe3", "value": "E1834BD7F800DDBDF849D73A84934909B130E3A14A921B3273637D6BFD761A45826F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631888, "uuid": "be87e344-a1fe-407c-a7da-cac0ade9a5e4", "value": "1536:jBE1FUU6nfCnD0w2LHEHsiq8twbR8tMJvnyrSv/1lLEdjLX5Gjml:jy1+nqnoH4RtgDJvnyrS3zL8iml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631888, "uuid": "b4fa379a-7e8b-420a-a597-d2d5bafc2b7e", "value": 82796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631888, "uuid": "d970fc05-8ec9-434e-8511-9bb1b3ca95ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631888, "uuid": "f08a3e1b-ac71-48be-9c82-930e0a0138cb", "value": "ebbf2b8c63cfb0a6f145f296f96fa5db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3373a55-d55f-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624589310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589310, "uuid": "0bf72ec6-cb64-4153-b2cc-464c5caff273", "comment": "Malware payload (Hancitor)", "value": "3dd8fa6ce1fa1b7dc2e82bad8229da2e", "object_relation": "md5", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589310, "uuid": "d7b006cb-2c35-4859-aa28-331dad6f9b07", "comment": "Malware payload (Hancitor)", "value": "147c445fbce0df4115b587d4f6eb7818845f72935c058959cd3683ca50865d0a", "object_relation": "sha256", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589310, "uuid": "3f7416ee-9d09-4e6c-a4e2-ecf0cbd40b32", "comment": "Malware payload (Hancitor)", "value": "cdedec2343eb5d43a934c4bfa333b12a340339d6", "object_relation": "sha1", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589310, "uuid": "c04e3144-22ac-49dc-819f-cd5fd0d1ad4d", "comment": "Malware payload (Hancitor)", "value": "ed9d0fff37410d747f6a4e0906274bfb0be7c8d5be680e37d864a0223564556f3a69f152d6f8f3b8931acc8d8c78c4e0", "object_relation": "sha3-384", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589310, "uuid": "05d3f9d6-c79c-4ae2-875e-bed50ce153d3", "value": "96947B0079D1D432EAB219310F65D696537CBC540F308AEF73D83A2E9F785D2AA31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589310, "uuid": "412e5f8f-4a9e-47e7-9e99-0acac6301b87", "value": "543ad4119209f0813a5ba22168135c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589310, "uuid": "3a0919ee-4469-4529-a113-911695364a56", "value": "6144:f4A8eyBxGOenKwOCd2gya6tglz2XD98v6OZrfdAOJ7BsFcKe:fl9R/OCd2yVlQSvlFOuKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624589310, "uuid": "ebaa5118-e07f-4621-ae27-4857c23c3e78", "value": 424847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624589310, "uuid": "65c044cd-ec1a-46fb-94f1-a3cc7bedf563", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589310, "uuid": "fd826af4-9106-4283-983b-d6fc87f554bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dc86dd-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624650912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650912, "uuid": "ac5c950a-040e-4c41-a14b-4058ef743435", "comment": "Malware payload (Mirai)", "value": "f0aa34a3d1298dd52e1f685eb3ae73ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650912, "uuid": "01c8cbac-3c66-463d-bc44-6b8627ed457e", "comment": "Malware payload (Mirai)", "value": "16ab9ca82b38f4fd197865d0a44e46e79a52424ebadca9b8bf37b18343dc0f34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650912, "uuid": "e6ce685e-a47c-4da0-9c11-73bd6685a3aa", "comment": "Malware payload (Mirai)", "value": "08616a28e3da782534d8e947acbc75435e98105d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650912, "uuid": "869d9a35-5eec-4929-b5d9-05a7dda26027", "comment": "Malware payload (Mirai)", "value": "36c64a8b9bbda191ae888d4435a8d0c3150a77bd6ccfddbc9a904e0fdceaa4933edbf8a60e9d57f2150424ba476ca4dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650912, "uuid": "909b3bea-9463-444d-96a6-fac67e2760ad", "value": "47237DA7C43C6DD4D15982B8BD248A3C5B13D016A6933EF6764785628047EECFA0D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650912, "uuid": "ec82b055-eea4-4a23-9b2a-e9a2f07e88d0", "value": "768:f/eptstaT85n1Oya5wtg10sKmqRrKBXXG0QJqF5Uu7nartC+oCZ21Cu/E:f/6s+Yha5wtg5WKWq5UQahCG21Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624650912, "uuid": "b0bb9cdb-83ab-479e-b16f-a4cf5a2a7634", "value": 47560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624650912, "uuid": "c54907b6-f930-4372-98d6-a2fa7f8bb8a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650912, "uuid": "e3bfc8c8-26bc-4540-b9bb-17d5cc54a21d", "value": "f0aa34a3d1298dd52e1f685eb3ae73ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6769b1d-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588510, "uuid": "4d26cf3e-f532-4564-bf0d-e239056a1422", "comment": "Malware payload (Gafgyt)", "value": "65afa00f6727fdb197b4471705d52b45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588510, "uuid": "a843ff60-05de-467f-a728-c498118dc64f", "comment": "Malware payload (Gafgyt)", "value": "16fd6aca8fa5d0755bd11ac46b48f3e4180e872e4c2c38af7986f2d51a9da5a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588510, "uuid": "7a427a38-a06d-4002-b1e1-c7d5422406ae", "comment": "Malware payload (Gafgyt)", "value": "8e0ac559de5c49dc8620678d78f1600fb2ca34f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588510, "uuid": "758cdecb-b4b0-4c18-8c0d-89d7cd496f8a", "comment": "Malware payload (Gafgyt)", "value": "220ee61e7ba9aab293ee70f0d3257115c3c7f8e9803523d492bf30d6e2ac4054e285aaabdcc53dc0dbc948a135830b4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588510, "uuid": "490be550-7ed7-4a28-8551-49744442f913", "value": "EB5302E622A7CCB4D238683ABA2C4DD210BA06F596FB787752500B7837D19E3351305F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588510, "uuid": "c5a11428-18c7-4589-84d2-31dc53091fd1", "value": "1536:5m5Oc5ncgkeSc8Fo4F+QWmSMRAzhLwYtL++6D9h:5E5nJ3SvFXwM+hLwKv07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588510, "uuid": "a4cf2f41-7b75-4fea-89d5-7e8364b672fc", "value": 62408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588510, "uuid": "f06a5e73-e812-4572-b7ce-fcf5880424cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588510, "uuid": "92d5255b-48bb-4599-9058-ca1f3455bd08", "value": "65afa00f6727fdb197b4471705d52b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf287c54-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642561, "uuid": "b3ac041a-7482-4d40-b9c7-61abdbdf2c60", "comment": "Malware payload (Mirai)", "value": "cbc415e931aaf10cdfd5815ea06d4134", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642561, "uuid": "348c9c47-a1bd-468f-be4e-bc7fb2fbc2e3", "comment": "Malware payload (Mirai)", "value": "1942e94fe8907c989d2560c9190aefcfee149cff98fe63be310fe085700d08de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642561, "uuid": "d4ec34f3-37e4-4efc-b988-c19c4541c23f", "comment": "Malware payload (Mirai)", "value": "ed6811a00dc6e7524e660660a75f1777f2f4c97c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642561, "uuid": "ed59c98a-ab50-4f97-a9d7-f7c1d354b5e3", "comment": "Malware payload (Mirai)", "value": "a33a16e7c98d8e21a18151f73bf4f24ff1f70ec316c9c4b116857a89cf794fb7731032c5e8e00a86d643a4ebd491aafd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642561, "uuid": "8d7d1eed-4c32-40db-97bd-28d1e3681c0f", "value": "C1432925AD792E26C0D8B57E11F7C724F2E2220E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642561, "uuid": "71a5b855-2742-4292-a737-dfd6651cdbb6", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDP:eL0AxvSHfymp0xgunvCkV6vTMDauo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642561, "uuid": "49ac08f8-385f-45c5-8d04-08f66a1f6aab", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642561, "uuid": "714ba6c7-c13c-4a2c-b479-3b8155631025", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642561, "uuid": "58bb0e42-92fc-499b-95be-bfbb74ac5912", "value": "cbc415e931aaf10cdfd5815ea06d4134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8328abe1-d54f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624582304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582304, "uuid": "0e205228-8a86-4c8e-932b-f03b38d6931a", "comment": "Malware payload (Loki)", "value": "88c5a725ad70bed51edcc2371e5c453d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582304, "uuid": "0ef606ef-0249-4379-9d27-f7277a735c79", "comment": "Malware payload (Loki)", "value": "1a1e969edb406d8003cbfca1cdcebb8d14a882ae200c3c43891e3c98a0cb0c9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582304, "uuid": "9d8377df-7b3c-404c-bfba-adc52fc58915", "comment": "Malware payload (Loki)", "value": "0f024bc02859aad0a81a8f3f1a6b66687f198c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582304, "uuid": "8f28721a-4297-4552-b854-393f2a67fe81", "comment": "Malware payload (Loki)", "value": "143e72add0e10fa1a4c7ae553412bd7126ed7973b43968119d866cff629573c9d794e9fcde82cc73660cc089868e3b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582304, "uuid": "37553734-5c26-417d-bde3-c8b1d7b1140a", "value": "A145D01273DD8371C3B25273BA26B701AEBF782506A5F95B2FD4093DE920162521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582304, "uuid": "c80dcba7-83a7-4945-9e97-e9fd9e06b9ce", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582304, "uuid": "934655c2-c8d0-4d5f-89ca-cd2ea39f94e1", "value": "24576:Btb20pkaCqT5TBWgNQ7ahs4KiYXH9VEr31LpGNGhV6A:SVg5tQ7ahciQ9iLJEUf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624582304, "uuid": "ffd1626f-ccb0-4efa-80d3-7b3cb4e056af", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624582304, "uuid": "dc2fe573-5086-4785-82cd-1b491896baac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582304, "uuid": "27324ffb-ce0a-4c9d-b407-dea5a4e06718", "value": "88C5A725AD70BED51EDCC2371E5C453D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05eba470-d57e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602280, "uuid": "98ce273d-a6a1-41ac-b94b-9a4308cf2e74", "comment": "Malware payload (AgentTesla)", "value": "52e4ca9ff6408da95ce0b827cb691ba5", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602280, "uuid": "172a721a-e863-4a6e-83aa-f64d538d9d7a", "comment": "Malware payload (AgentTesla)", "value": "1aa503869957a2c877731410bf27eeb6b2bfbdd1ff8a84a3cb963576fbd2ae24", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602280, "uuid": "e833d118-c67a-4199-b107-5b8556a5ec81", "comment": "Malware payload (AgentTesla)", "value": "8eed9a98ad6da41fe73b63c314898f6f548d25e3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602280, "uuid": "87cd71e6-e1ea-4520-8d0e-1f26cb5539f9", "comment": "Malware payload (AgentTesla)", "value": "59e5dabaf7e22d59359c009a454c114a757ec94da4da27778cba818ca55fa7dee6072cb36d511de92b08ed9d76cca615", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602280, "uuid": "bf8de547-c6aa-406c-aef1-22997888a752", "value": "958423B4A4C014744FC6D9D42D6326A660336ABED1F1E8F29C08F9DDA52F6B47AC1CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602280, "uuid": "16f0be03-b545-495d-b50c-94797d5c2d8f", "value": "6144:XIzYyR80ZksnHqH+46XmtDL25p36YI8CEeJ6j903lXha8bDkCc8tvYTL6jMzL/IK:IYyC0ZZH7WtDLKZrfymSVA8bgCBnHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602280, "uuid": "1d1ecfe8-0d9d-4ae6-8378-d5572ee79446", "value": 377553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602280, "uuid": "e1fc5106-0134-436a-80d3-c60be201af6a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602280, "uuid": "e7fa672a-c08c-43d0-a7e0-1bf94d7886c1", "value": "Remittance Advice.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c92afb-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624617931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617931, "uuid": "b194ca80-12a3-42cc-80a8-1fb7d69d2b25", "comment": "Malware payload", "value": "42c6d7afe0175671fc16c232b86bf7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617931, "uuid": "4359ce5e-860d-4f82-bafd-e2571b50f2c5", "comment": "Malware payload", "value": "1ac909cef8e454178e18a5c5fa84760d4fb0233651a6365db15581387733aabc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617931, "uuid": "b77198f9-308f-49b2-8075-81a4b53611ad", "comment": "Malware payload", "value": "db891744a6da9c49eaeae2000b389124b255c898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617931, "uuid": "fec26aeb-ac88-44e3-9f11-25dd31d562cf", "comment": "Malware payload", "value": "658d40502862a746b1c1d1b903c0a79fac0889bd252a91ae0655cf5447ded788a8aac3165f144d4c2abd846aba6a5352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617931, "uuid": "3d153f2e-0765-461a-8e59-0233e569ef15", "value": "9E04B32733A3C575C1C42230E461CB3B2668CD270774764AB4CAAE5BBD6B25C9DBC6D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617931, "uuid": "d9abf59c-3aa3-44f7-8069-8aff0350f777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617931, "uuid": "da10e4c7-be6d-4483-8238-abad411bd30c", "value": "3072:7rPrAexAsOvJV81v7GpWflihN9RIU+Pa4040404u:7dAsEyypWflihN9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624617931, "uuid": "de530926-f977-4533-a7f7-a17522431549", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624617931, "uuid": "b7fe9786-9ffc-49bd-852d-d9df3011f935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617931, "uuid": "02af32b2-65f9-4e7b-a617-186e4fc18711", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.gen.29147.2998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3d2c9d-d5b8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624627574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627574, "uuid": "b160f66d-fc11-4f0f-a45f-12e448ed4139", "comment": "Malware payload (RaccoonStealer)", "value": "c5091750d496da82c212be9ae2794467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627574, "uuid": "08b1151f-9cbd-4041-b1d6-5ff251189496", "comment": "Malware payload (RaccoonStealer)", "value": "1b877f1d6d49ff69c35c0991d806830e7486dfc96a0abab4b0d58c1534bd5e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627574, "uuid": "9db9a8f2-bd25-4b52-b941-f1703867ff4c", "comment": "Malware payload (RaccoonStealer)", "value": "71dfbc69edb39cca1de6986366aede2fe1ff04c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627574, "uuid": "cf8152d1-ab8e-4b43-9453-0f3b9ec2ddff", "comment": "Malware payload (RaccoonStealer)", "value": "4ef95a631294eee28eb5b9d94f2e843fffd46219e7fa985d71caa963119e0052ef47bf905449fcb86055ec09941c15b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627574, "uuid": "00e9bf53-7e63-40ea-979d-5edb6e6aff5b", "value": "F9D4E110AB90C035F9F672F8496AD368A92D7AB05B2450CF62D51BEA5734BF0BE31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627574, "uuid": "1735b439-98b3-45eb-8e53-a6452c15db06", "value": "e621a9dda4bab203878bb79570221dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627574, "uuid": "d2a60832-eded-4c11-ac74-06770af0ab06", "value": "12288:zgls0T7ZSdIrF+MyVs16RoEEL9qUEF8zg4O/yl:AnT7ZSyMHolLBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624627574, "uuid": "97a49767-7a8d-45a3-b7cc-47f225059145", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624627574, "uuid": "532afaa0-530b-46db-8924-44b52c82d151", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627574, "uuid": "6a13151c-cabe-46d4-8c47-c285b76820ee", "value": "c5091750d496da82c212be9ae2794467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4b2420-d578-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624599981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599981, "uuid": "d25f4b86-63c8-4544-b4b1-c06ac90cc0ba", "comment": "Malware payload (RedLineStealer)", "value": "a7cdf106d337d0bc62ed15fad389b074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599981, "uuid": "a0595c6a-ee84-4da9-8b70-7abb03a8cde7", "comment": "Malware payload (RedLineStealer)", "value": "1d6796cf21c20ae9f86339d2b0625395275d7052a3c685a98b8c11a8805f69bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599981, "uuid": "ef82d6db-4a9a-43ca-bec8-0907081923b9", "comment": "Malware payload (RedLineStealer)", "value": "344047a39f6530038bdf1cb413c2a376fdf7e286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599981, "uuid": "d1cdb71d-f5a0-4bc2-a140-dd6a01ff4a6f", "comment": "Malware payload (RedLineStealer)", "value": "dc5c16236f0ae80bc1c904df69ceecc9d41071cd5f0fdea7a85a45b9fcd79eec58bdc2af781c3d770d8b6a079970a861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599981, "uuid": "bc809dfb-5dc7-4d7e-a25d-77dab6c82c36", "value": "E61406302A182873FBEDCAB52059901642796D1EE85DF2B508E072A51FF7F7B4713A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599981, "uuid": "d7065ab1-2229-484f-9b49-f036dd302f34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599981, "uuid": "7acd0696-6e5c-43db-8690-df7f4a113f18", "value": "3072:/hSPYKmbGw/6xkDeVkyIneIaJDT754dg8Piq+BNyX5s+dpIfRZW3CDG:/6aGw/6xkDeVR0o754m8PihBNJsyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624599981, "uuid": "a8c4125e-a3c6-44fc-b7da-3ee2d86687e4", "value": 196760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624599981, "uuid": "ccdcdcd8-8cdb-4e0d-9145-c8e0148efab0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599981, "uuid": "b28b9a02-a4aa-46de-b8d6-ce0ba1392b4e", "value": "a7cdf106d337d0bc62ed15fad389b074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86ac022-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603117, "uuid": "2678d301-afcf-4f69-a78e-96c87ab840f7", "comment": "Malware payload (AgentTesla)", "value": "1882590badd3e1388a41f6b436da3f18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603117, "uuid": "f7e9df11-a47f-4bad-a4b0-d913cc7b7e46", "comment": "Malware payload (AgentTesla)", "value": "1d99c1e68fb294bcd44fbc8276daf6a76c41d3293d882ff0b30af69f005e4dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603117, "uuid": "3cdaede4-57e9-40f7-9bec-690526b1211a", "comment": "Malware payload (AgentTesla)", "value": "bf55187d35803d68e22b2244c64de3187188fece", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603117, "uuid": "063a3847-0f95-416e-9f33-2d5f045b9230", "comment": "Malware payload (AgentTesla)", "value": "82622850dac9e5277db388dc553c8a542bac1582fc954a994aa69c51fb79063486034e98be3fac455c8fbea736934373", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603117, "uuid": "f1b27b00-0969-47b5-a878-06c7d06df7e0", "value": "51F4239AC7764E60854A30266903C339EE5F370EBEADF8D75614031A269D36B6CCCC9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603117, "uuid": "5c16002e-c5b7-420d-a2a2-970aff0f6121", "value": "12288:VzGarahPbDoyB7iyXjH8sqT00tug5KLfdrCQx5yayEz/8TEGNWhnWXgD/tsmAlla:V6pQueWQsqT00tugQZCQvyay+NGifD/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603117, "uuid": "21faecb6-2660-4a29-b88a-418a5c369419", "value": 733700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603117, "uuid": "d2abe977-bf40-4d8b-b0da-007adb6f12c6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603117, "uuid": "95d15884-dbce-4131-bce4-e7208f81ba49", "value": "Order_List.iso.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0173c47f-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603132, "uuid": "7ec7633b-b083-438d-b4e7-605fdaee18ea", "comment": "Malware payload (AgentTesla)", "value": "ec93a22a8859b36e80c6f644c1af22c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603132, "uuid": "585d5296-08b8-4842-8fc4-02e13af23403", "comment": "Malware payload (AgentTesla)", "value": "1e1383a8df549a2ded4307e61737f57dec5ab88d8fb235a94a817919cc0f32d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603132, "uuid": "4d6a880f-1481-4f4a-babb-9a1eb728a54e", "comment": "Malware payload (AgentTesla)", "value": "7582a04da04eb0b70e5a3d5b34bf5378b541112b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603132, "uuid": "0a7be4dd-733d-4d78-bb7b-f27b49a1af84", "comment": "Malware payload (AgentTesla)", "value": "761c4603190f66152bf1ba813ddfe041de8957570b69d469b4fa9534d734daef322fb2eb415cd39e18023fac49cb7d75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603132, "uuid": "8406446c-1c2d-46e9-a7a0-6b9cd4959fe6", "value": "2815D03429EA5428F5769F794AE070B56BFFBE523302E84D28D13F453632A41DDA293C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603132, "uuid": "00d119d8-47ef-4f38-8d13-1ad7e2c41117", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603132, "uuid": "95121699-f579-4aaf-9192-8176145ff08b", "value": "12288:9k2JZaF75GF2LzGWSE5D1kIpN6TqKjCwnG+UT9OU6dOMOfnoMDMoSiirbzC9tm/2:CbmhEp1STqujYEUsunMiirb8tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603132, "uuid": "3cbb95dc-9a8e-4f90-b365-0de971499f45", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603132, "uuid": "a57f5ed9-6e56-4873-9ea6-7f18b83cc476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603132, "uuid": "14c69ab5-0cdc-4261-881c-65a693304e1f", "value": "Order_List.iso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc571f6b-d5fd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624657159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657159, "uuid": "a0b16614-75b6-44e3-a890-1725c6c45f3a", "comment": "Malware payload", "value": "3613ba4ebc1bf55d67aa82bd755cb91b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657159, "uuid": "476c35b3-8c19-46a8-b360-1c8dffbb2ef7", "comment": "Malware payload", "value": "1e50514834d64ca4690d18ec24396863d3469adee7174184fce1a5dcdbe8bf77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657159, "uuid": "c304be29-9f79-4bf9-9dd0-f793665f240a", "comment": "Malware payload", "value": "4f9d93bf73051b00d38aaf7501bcd69b4259b09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657159, "uuid": "6db1cf41-6315-4c94-ae4c-386f0c425de9", "comment": "Malware payload", "value": "3db050ec99c4d2afc9c47d368738b17947ae20f05eabf2b91028a1906b36f1a34e7387df40e9f41559e4fc609b77f3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657159, "uuid": "f429dfb0-c629-4ad9-beb0-c122843fbb26", "value": "4405F12439E9802CF033AF791AD475A7966EFFB32B03D9193095639A1633E50CAD117B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657159, "uuid": "1a2891be-1381-4fd8-9905-75cf491a4a32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657159, "uuid": "86b9f77d-d6ec-4a57-be35-0349835985aa", "value": "12288:EKsgBWIjJ6/5YptTE1GTyDZfkoLbojF0r0ei8NvwzYD036xy/YaaUu:EK1BpqGSZ/bUneiooklK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624657159, "uuid": "a8c4bc98-31cf-45c5-b16d-a0b961176385", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624657159, "uuid": "9097b827-99d2-4524-8a4b-81372c46bc74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657159, "uuid": "83cc3e01-e2b7-4eac-b7e5-9e9142d714e1", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4c003b-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624600603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600603, "uuid": "7c4216e2-02a8-47cb-95b5-800470fcc00e", "comment": "Malware payload (AgentTesla)", "value": "91c22eda5d826b4ac2d5ffac281f334c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600603, "uuid": "350111a8-3b4c-4af6-a425-778a4f81e18a", "comment": "Malware payload (AgentTesla)", "value": "1e86d6422b2d8c7eb8196d01b6057cba5dcc3c937b9359680f6fc7bd9440018a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600603, "uuid": "1babe1ef-43af-46d8-aafd-ea4402e18d19", "comment": "Malware payload (AgentTesla)", "value": "118eb4f6ebdbcd424d5f62c217db46a12888dd6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600603, "uuid": "4d39b1b3-3698-430a-8fb4-b16f8ef22388", "comment": "Malware payload (AgentTesla)", "value": "560010a7d1c83e64d35b7a594fb4232903a3598de2080edfcfb4a2e2b46c1e92bce4b7d76643bd1f46ed59d1fc21fd25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600603, "uuid": "ffb2caca-b100-48bb-96c5-a789e7a39bbb", "value": "3C05E0243AEA501CF173AF781AF471E59A7FBB733706D86D1491038E4B23942DE9193A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600603, "uuid": "0154a849-e461-4f4d-aeab-a7cb57a07b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600603, "uuid": "51e3fb75-d618-4fd1-aabc-336a72adceb9", "value": "12288:IJZaF9GF2EMZqDDrhureCezt3WlemLz0Z1VEBLGm5WPq/cBBxmUyTINTCOr:Lj/ZEDr3tzt3weaz0bKlGiWy/cTBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600603, "uuid": "1d68aa00-ef6e-4796-9d6d-e72863d94765", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600603, "uuid": "55e3a95d-33f7-48ab-8735-f66b87f70013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600603, "uuid": "8900bdd5-5369-41c8-981f-2332a9d7abc5", "value": "Transfer Appilication Form copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad54b95-d5c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624633454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633454, "uuid": "621f57ae-4707-4ea8-8640-e341f8956397", "comment": "Malware payload", "value": "dd99215e4ee23ea9530db03ed1cda452", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633454, "uuid": "7ef0e37e-c994-4ed1-891a-96311cf4b5c7", "comment": "Malware payload", "value": "1f3f59645030f46e9a7440706b48f78e27067815851bf62b2ae1d9cfa903ab79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633454, "uuid": "936bb225-0660-4200-9358-f7199d2c0877", "comment": "Malware payload", "value": "ade01ddd54ec0507f7a7a1909b5e224acbcd5299", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633454, "uuid": "11541802-7fed-4342-b1da-5c97bfcb09c8", "comment": "Malware payload", "value": "485dc2da5943c61db52e345225b83675fccb9848bbab4798ca7154be2176db3ba75fe6ed91025d8dfe68083210eefc3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633454, "uuid": "27e77842-f3e4-41fe-a6aa-c19d4c556515", "value": "77965C03F9A74EE2E3A41B73C99B51248765D6C12323FB4F678D137A5A037AE58C2247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633454, "uuid": "e22c629d-8f7f-4fcd-b580-a4f0d2f8c592", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633454, "uuid": "84c15f61-4714-4b76-9525-46aed0384288", "value": "98304:l56rtpChhYTnKBV6yKZaTSOyTPEcno97krB9IG:bOtpMaYV6bnO7yT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624633454, "uuid": "86123496-6ad2-4210-b358-e9d6dcd397db", "value": 8909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624633454, "uuid": "58c36200-d705-4185-802a-8dd4510f10ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633454, "uuid": "1a40a98f-0702-495f-918a-5df5f664e71c", "value": "dd99215e4ee23ea9530db03ed1cda452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a07dbbe-d5ad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624622554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622554, "uuid": "1ab07bfa-673f-4f09-92c0-0c6cad8d63ed", "comment": "Malware payload", "value": "7fe4787d9e0cdb33be675021ab104a9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622554, "uuid": "9611f25a-e3d4-438b-b2da-1af7eff04eb2", "comment": "Malware payload", "value": "1fcb1da06adf36ea1288ad21d8c9280c44dca154b01dd979dbc407a9a59270ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622554, "uuid": "abf6b9ec-54a3-4ab8-a946-21dba62f92bd", "comment": "Malware payload", "value": "a44d4a080e245b5ddd6be6f423264d5e9cde36e8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622554, "uuid": "15c96408-8c74-4b16-b5b6-672e5d0e556e", "comment": "Malware payload", "value": "d14b2570448a7b16ba81d8a6bf2f5299ef9be670f8409ca5015c2d3747d8f2f884b6938616110d6442e21f8677b7ede0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622554, "uuid": "4230a6d0-a9b1-421c-b13c-34dfbd52a97b", "value": "15630238671308DDC4367CBAF58FD66329C71F69304A005511B9E6BA2FF719CE8E9226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622554, "uuid": "6157f5ee-8ee7-42d1-9b3f-96697263e311", "value": "1536:XtBTX941eYF8NblpuvnwanQ3zWYq40LZ51g69:biMYFJvw6Yh0b1gw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624622554, "uuid": "025edbba-7345-4194-bb29-700d3dcdccff", "value": 68056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624622554, "uuid": "f88a7bcc-f744-4183-8af8-46ca642b0d4b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622554, "uuid": "260327b8-b461-406f-90ae-40b781bcd3eb", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e196d8-d5ad-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624622765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622765, "uuid": "b94330d0-7550-4642-aaf3-c2dd21885929", "comment": "Malware payload (Quakbot)", "value": "590ca0e597487dd5ad6c2f1fb64184dd", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622765, "uuid": "7d77948d-fd8c-4c04-828d-fb095ae840c2", "comment": "Malware payload (Quakbot)", "value": "20a72dc5350b296f2857911444fa065f5b0bb437be8d1bc61819cf29828a2955", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622765, "uuid": "9191adbf-0dd9-44a9-b314-8d7c37152d39", "comment": "Malware payload (Quakbot)", "value": "e141e27af930a2cdeafab2eb20727000de893629", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622765, "uuid": "2e8e76f4-a18a-498d-a4af-3dbcac457678", "comment": "Malware payload (Quakbot)", "value": "56cbf83d7831eb853872b30ef8062321422884eb24f3ac1687776a53c596f3842c9ae2789db464b6d2371b6684a7c832", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622765, "uuid": "780c111f-ed76-4112-a16e-865a0776aeee", "value": "32E38D352A24F2A3D57282381DE84E7CF53A2B06B16FBB65B8CF95BD5762E43044B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622765, "uuid": "20f4aa54-4267-491c-8b4a-6f31bb8749da", "value": "3072:SmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOYJ:p4P4346PgZw9gQaVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624622765, "uuid": "8e262b07-33ca-453c-9bb8-3f04cb00df51", "value": 153750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624622765, "uuid": "6c1c1b98-ac75-449a-92c7-f26962810dda", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622765, "uuid": "f96a44cf-c4a8-4150-8dc3-b933b8d4008d", "value": "Permission-414467145-06252021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d57f37b-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624601487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601487, "uuid": "0dc7e194-6992-42c6-82ae-18c2d7ab6e03", "comment": "Malware payload (Smoke Loader)", "value": "959dc048061d67487f876a4ac3772031", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601487, "uuid": "6aeb9a81-9aa5-4497-a0c7-a1ad6c88abbf", "comment": "Malware payload (Smoke Loader)", "value": "21c9e0035afa6d909b2149502034a349288bf50b93ab1bb1de30bc9116c4bd8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601487, "uuid": "399431c6-5b10-4142-9f78-31384a863509", "comment": "Malware payload (Smoke Loader)", "value": "482dcea131341e3873fd3269a47729326715f97d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601487, "uuid": "af0449a9-a905-421b-bdb7-60ec54df1975", "comment": "Malware payload (Smoke Loader)", "value": "ab4cbdd5a39efd9d32f1205b119251f4c7ccafb445b21006742f0aea04469e17bcea07b0c48a1d80f8b3c6f163015f66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601487, "uuid": "29a64c2b-2ea4-4961-aca3-c231ca1cdd8f", "value": "C0748D00AAA0C035F6F312F88976A368993E7EB15F7440CB52D5EAEE56346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601487, "uuid": "3ccbf9b7-2649-4872-9213-eaa23d807365", "value": "a8fd13cfcead7aa4bc2d91debc97c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601487, "uuid": "9dbe6c9e-5a2f-4c66-98ce-0358160bc471", "value": "6144:AuIfnF2AG+ULJHUUThinG0LbekiPXRTxIcbfuKq9ZXsJKk:kfnF2AG+ULJHUUMPLbXMRVIcbHa8JK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601487, "uuid": "69064c0a-39f6-4b21-b731-d8e6a3e47c92", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601487, "uuid": "c58c4212-555e-4cb3-85bc-d3c0dd51c013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601487, "uuid": "53fe90f1-d6b3-48b0-a2a7-fdf2492dc54e", "value": "959dc048061d67487f876a4ac3772031", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca552d9-d582-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624604090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604090, "uuid": "d1b42b49-27d3-406d-b123-d7456dbf78b8", "comment": "Malware payload (RemcosRAT)", "value": "88db701ebe8c84654bfcb5b3a7c3cf10", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604090, "uuid": "aa8daa14-abc6-4e28-aa24-1c45f3ff30e3", "comment": "Malware payload (RemcosRAT)", "value": "22634cbaf1a60ca499a9b692aae881cffdaf205a4755ee34915e5512ea87cab4", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604090, "uuid": "f6a4bf2c-131d-41c4-b46a-45a1995808a4", "comment": "Malware payload (RemcosRAT)", "value": "af1acfa349518ffc1c490211c5e3179d597e2cab", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604090, "uuid": "13e54eb4-2a3c-4ce7-b806-4cf97cf0066f", "comment": "Malware payload (RemcosRAT)", "value": "24086e09641a3a0f92df24ea834f863d956a9aed7cecb9264f6154ce5fb7494dfe1dd6c7d1894e9975afa98bf7a3c21f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604090, "uuid": "6e7cadbc-030e-4784-b01a-366da9d171b4", "value": "6041CF30882EAA9A7C7673F347910CFA3DEE4C7F18AD71582441C83939751D8569C09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604090, "uuid": "ac28436e-663a-4af1-82b6-a35933b09839", "value": "48:fB+VtSwD2B+V6twyXF0pttAgLh3kU5gkG9obqBb+:fAtSwD2A6twSF0e63R5gWqBb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604090, "uuid": "c17c0eb2-40a7-4d31-938b-0d837106740a", "value": 2140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604090, "uuid": "a8228bc1-8d5f-49a6-bb7a-00bacc6c15c3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604090, "uuid": "2690d18a-7619-43e5-acc2-d0478f812411", "value": "transaction_completed11002214991.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8d618c-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603179, "uuid": "b87fa153-a05a-4bcf-b1eb-3f6e68bfe47f", "comment": "Malware payload (AgentTesla)", "value": "7c5c38a3fb114ecda0b3bf8edd4ae56e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603179, "uuid": "2072d728-db4a-4838-a68b-71bc788e29db", "comment": "Malware payload (AgentTesla)", "value": "22a70b77621800a22ee7c9fb86c08649a101c46e87ea659a5b48460ba31d4f50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603179, "uuid": "d9562975-6918-419e-84a3-aac6217dfaa5", "comment": "Malware payload (AgentTesla)", "value": "8b70cf0d7cb0af5b44562193a622995ecb2af72d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603179, "uuid": "340d8389-5acd-499c-906b-f6aac3cc63cd", "comment": "Malware payload (AgentTesla)", "value": "bff85d208b4e1327a3757a970384cee3a0f1ea75baafde8bc8985d3cd3d6fdaa83b7f486e6470bc156b0d7e6323fec5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603179, "uuid": "3fe9ed72-67ae-4d59-b6e4-8eda5a5fc7b4", "value": "D205D02C3A9D5175F1F6AF780AD03591ABEEB61F6702D41C28B1CE493633A40CDAD939", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603179, "uuid": "c463c1b8-919e-4acf-a89c-3b73a7327728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603179, "uuid": "1f1893f3-f09a-41dd-a2a0-f6305828a492", "value": "12288:x2l5JZaF75GF25zGWSE5D1kIpNPp23yfRAPeoCWYXZHf0G7nNn3eYY2mr7:JbwhEp1pxfR40RYTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603179, "uuid": "d31d5615-fe80-49dd-bac6-316b09ce64c3", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603179, "uuid": "e48e8e18-454a-42e7-ab6f-05382fe5a7ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603179, "uuid": "883f9770-35b2-4984-b496-cea20b21abcc", "value": "SOA 2908414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaadf3f-d596-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624612838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612838, "uuid": "8cd260fd-2481-47f7-aca5-36a1e478bd24", "comment": "Malware payload (CobaltStrike)", "value": "a64693dc4ce57f1c8ed8c7f1a0beca1d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612838, "uuid": "d5f271b5-3bc7-467f-a924-25981b38da94", "comment": "Malware payload (CobaltStrike)", "value": "22b125d83e7497491777b1d35306054023475e4efb9ca67f15c16177f626c0e3", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612838, "uuid": "3b9a6281-225e-4f49-af99-4edb011cc2a4", "comment": "Malware payload (CobaltStrike)", "value": "34352833c714066605a27cfbe2e7e544889e7fe9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612838, "uuid": "e0a2e6bd-4019-44d8-b473-f8d2c74e22b3", "comment": "Malware payload (CobaltStrike)", "value": "0113002f69fc6213167fd4afc86f27e23d336172d947fcc29baffd439fa24b24e0a9f103a5c0b222db607e8af82b0b9b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612838, "uuid": "7eb9f82d-66ab-42ac-bf36-48dae94967d3", "value": "6E24D0345DBB9CF5D91E0A30CB9816ACDE23063B7A3F89118A53E05564CFCAC98F7621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612838, "uuid": "e8a6348c-d760-45aa-b23a-566aa255494c", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612838, "uuid": "2450768c-4c15-41c3-9108-cabcf678ed38", "value": "6144:ugtjuVftOrL/7786Ow0AIWYD/G+EDxSyeCHK8GN:uwYlOrD7Q6NdXYD/G/j3GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624612838, "uuid": "c155f630-83cd-480b-8acf-c148c20ba98c", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624612838, "uuid": "e1ba1db2-eebb-4fdc-9440-2b08b7bed5cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612838, "uuid": "51484cb6-b987-47d9-b054-282e5f47c1b5", "value": "a64693dc4ce57f1c8ed8c7f1a0beca1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2740a2b-d588-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624606838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606838, "uuid": "11c72f32-1146-4602-8ced-99a83f84b68c", "comment": "Malware payload (Formbook)", "value": "01300e34a5520415c5ed5c483e687a4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606838, "uuid": "b73a20a5-6c88-47b2-b6b5-e4abf9164dc4", "comment": "Malware payload (Formbook)", "value": "23022e88812cff7f0b615fd48b58f0d971f0559d0275380f87eaa3bf195e7e22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606838, "uuid": "cbba4cba-e620-47c7-8bc8-3e8ca6d9ef50", "comment": "Malware payload (Formbook)", "value": "afc86089ca7e954d378133e36e8b23731007a809", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606838, "uuid": "f11b87d0-8051-4a21-9696-be1a64971d25", "comment": "Malware payload (Formbook)", "value": "6fbf1f8a6757c92fbb41e7e35b08eed65deca6b7c7e8d91199bdb45c7a2f333b8a623ce9f9fad2b5e2e3b2c4bbc615d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606838, "uuid": "7052e76d-2418-489d-bed5-7e655014e3f0", "value": "DEB49C637105D97FE333D87E5809E5A93C936D2208A5A10D67D933BE04B231162FAB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606838, "uuid": "301e9dec-87f5-4ed9-873e-77851f57c6f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606838, "uuid": "cc820623-23ff-4b0b-8a51-be2e67ebca9b", "value": "12288:wnu/CLkVQ3MM3g1UtAnHexm3O0DLsRYjLdEP:wrk6WUtsMkLZmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606838, "uuid": "cc75e4bf-0c71-46ed-a957-fd1da6c69ed7", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606838, "uuid": "69499dec-74e2-47f5-acfc-d8c685403a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606838, "uuid": "5ffffdf4-a2f9-4797-8240-a53b2251a886", "value": "01300e34a5520415c5ed5c483e687a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5192de-d587-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624606210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606210, "uuid": "a1144dce-a166-4f3c-a493-cba3505b6f6b", "comment": "Malware payload", "value": "ad8e408a8a9736bcef58e7ca91ddbbea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606210, "uuid": "2681082a-4bb8-4255-a538-4077ba227e12", "comment": "Malware payload", "value": "249a31f0b50b4ffb479497f1b413606977b67496b3aee890c6f51bc973357a23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606210, "uuid": "74d765e6-d1ce-40ae-9525-c8ea2e6a73f6", "comment": "Malware payload", "value": "7f2aad5a6f3e384a22c0c321881bf570192409b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606210, "uuid": "ee4e5fbd-b6ef-4332-a185-d7e42e3d3d67", "comment": "Malware payload", "value": "0cc202e7133cfde07d93393eb14f55cd4143f264362b3cb60ffc33196e819d93e3d99ae4fbf3eeec8a5003fd1e386454", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606210, "uuid": "4910d8d5-9e4f-4862-af24-611436ae9c29", "value": "BD04A12633A7C532C5C42230E465CB3B2224CD2707B4B247B5C9AD67BDAB68D5DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606210, "uuid": "0fa66cb6-f480-475b-aa04-c57fc91534b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606210, "uuid": "b374199c-5953-4e9a-97ee-ed213a018083", "value": "1536:IUvI3yoTIY5G2ucCHtMxJdFnVnOC7dxD9ySWqX3WTkA0c1JgtL6j+W:9g3l0qnPC+JROCrD9y/4A0c1CEjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606210, "uuid": "b9f1f0fd-04d2-4901-9fde-5848218ce637", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606210, "uuid": "1969d3b6-9a56-4d8a-8974-05cd89a1c60e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606210, "uuid": "fc967e07-7dd2-4468-b3b5-27a4e7d11f52", "value": "ad8e408a8a9736bcef58e7ca91ddbbea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9644fd-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601565, "uuid": "6f3099a0-3463-4fd7-8165-7c016b0e73d7", "comment": "Malware payload (AgentTesla)", "value": "9d0863ed3c242502dd2a0e494607568f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601565, "uuid": "b73cb71c-c616-467b-91c5-66032b6717c1", "comment": "Malware payload (AgentTesla)", "value": "24d8ad4bb407a455b0ce0fd0d74033f93a399805e8846eaaebe46c2c7d6644bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601565, "uuid": "c4c4c58e-7ba1-409b-8171-e37817fe323b", "comment": "Malware payload (AgentTesla)", "value": "ee6d8cbf928d04c2fef2492130ccc91bac889353", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601565, "uuid": "9d9efac9-e668-4ebb-9bb7-8c5cd2b4f09a", "comment": "Malware payload (AgentTesla)", "value": "0c198133cfffc3a8f3eef7ebd81d91068fac4431905b61692b043de8cc8d326921e13c5fd2e00d55d3a6fcf47808d615", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601565, "uuid": "0f2f7039-def5-4090-8a7c-257ba2cae298", "value": "03F4E03439EAA019F177AF355AF471D299BFBB632B07C86C1055134E4B23A42CF9193A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601565, "uuid": "a6c57fd2-0f8a-46bd-adeb-3f72a8968514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601565, "uuid": "74cfc889-6c91-454f-bb4b-b7358a93cbbb", "value": "12288:4ioUWgd/74EGXYTTVfgGFlhjfcoMR0bn/XXHEhnQjnM+ykCD8XZozhvn9oiraJ6v:bT9GXYT544lERynfXn4+y/oY1od2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601565, "uuid": "c0e7b2c1-b5e0-400d-8931-2b75065fc881", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601565, "uuid": "085ffd65-8974-42be-82b6-c8b576461642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601565, "uuid": "2efc4f3f-754f-49a5-b657-e42d15620b72", "value": "LZY062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f98b18e-d5f9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624655259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655259, "uuid": "73a1fc68-4e3a-449e-8c1f-1dbd3c0538a4", "comment": "Malware payload (AgentTesla)", "value": "9a15ae327012373c53a196b585d21b0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655259, "uuid": "00afd199-620a-4b45-822b-a462f309a85e", "comment": "Malware payload (AgentTesla)", "value": "27fdf4e6c757ef22eb4f0d1abf40a509dcd71bb19349f7f16fe21153c6b4e363", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655259, "uuid": "20568ded-5bf6-4d0b-a376-2a6ecb3eb1c0", "comment": "Malware payload (AgentTesla)", "value": "b964ec5612c032cb70dc1da68b6390ee417a9180", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655259, "uuid": "cf8bba89-2c9e-4611-924d-bb3867035459", "comment": "Malware payload (AgentTesla)", "value": "8e3f632783eaad42956e8ac388430227d257b3b1383814693839b4f586199bf7fca8a40034c84438dc1031b15b531841", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655259, "uuid": "a05aee55-38cd-4966-ba01-0af81c4f2629", "value": "0AE46A58267D2B05D4B613FFCA7494C253BADE52AE25D0B57EC633C60AE8B120620F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655259, "uuid": "38922a58-273e-4d86-afb8-f5a76641ff05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655259, "uuid": "b71a847b-c839-451e-a01d-ac0cfbf400c2", "value": "12288:AQR9NROKfE9id/2J0i+nM+mQcD5H95rwGUv1v:AQ7NROKfsM7M/95d5rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624655259, "uuid": "ce211399-6c62-4115-99a4-2b2c25807b5f", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624655259, "uuid": "a93fd299-a4cd-46cb-8747-6b2e4aa169a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655259, "uuid": "d043ab0f-813f-4495-9949-fb499729dd3e", "value": "Mv KSL Seville agency appointment1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a935ac-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642270, "uuid": "a3b7cf44-9a65-4b58-8af5-6b96f62930b9", "comment": "Malware payload (Mirai)", "value": "1b52bc101fe711a0ab62096264c0a3d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642270, "uuid": "905bda9d-9054-4c54-83f6-34a9c2a1d5ac", "comment": "Malware payload (Mirai)", "value": "287118f0d7d0e997fd5f16e37ce50d8a6568139ef3bb60fa60fdf45bea150e22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642270, "uuid": "74444a73-b400-4567-8187-6138f0739232", "comment": "Malware payload (Mirai)", "value": "f87b702066f82c5702f1616601ba3238d6c5ab30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642270, "uuid": "4fcf39ec-0d2b-4174-9bdb-0ff3c0608f2a", "comment": "Malware payload (Mirai)", "value": "1965e44ca4e2c7c92676235a398079a90bcddc894170e968066ddb20af6e3acf42038c296e17a70af01e032bcb14aa00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642270, "uuid": "71279404-260f-4e21-b1b6-77d11f78ef1d", "value": "3D634C01725C0E47E1A31EF5253F27E193FEE99020E5FA89650FDB864231E37468AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642270, "uuid": "b47c316a-a76b-4168-94d5-695107f7048e", "value": "768:sKcL8O4n1eRtPJf61jNfRhkGMkRaytnJ9v2O47DqSD3fB9m54PSnkC25HqG94hFq:O4Sj61LwY49myKU5KGOZZGqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642270, "uuid": "3ab633e0-b31c-4425-9d66-926302108ac0", "value": 70888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642270, "uuid": "cd04f24d-f71e-4d99-8249-384f43a575a3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642270, "uuid": "0b112f59-0e22-48a8-856f-bc3573c141cd", "value": "1b52bc101fe711a0ab62096264c0a3d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9b53e4-d5b7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624626850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626850, "uuid": "8caa1078-e5ce-470d-b6fb-105eaf0800f6", "comment": "Malware payload (AgentTesla)", "value": "66e2975a50d07dd90a0e15610a21fef0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626850, "uuid": "0c9b2ac9-fc2d-4afe-843f-7792ad218a4f", "comment": "Malware payload (AgentTesla)", "value": "2899ad427bf396b8d4b01020a1d649c69ff540e44a1e344dde0ca32d7b9cfdf6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626850, "uuid": "75650e89-676b-4981-a8c3-4b9100a44929", "comment": "Malware payload (AgentTesla)", "value": "661f1ece4235b2e30d4be22559ce797d6e6c7b41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626850, "uuid": "bd293256-d253-408f-abe4-5c396d17ac79", "comment": "Malware payload (AgentTesla)", "value": "696c0caea534eff436c40b34cda9d3756fb211f854261d782c2130563adb847f42f150c45b4692a8b66096e3b7a61908", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626850, "uuid": "f93de8d7-81cc-48a5-a979-1056f0baba3d", "value": "B105AD2AEA481B1AF078C9BCC1315F500EE17D51D522D2D76AD7BC9FF3A2A41DE0A11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626850, "uuid": "b83b9537-ca60-48c5-a777-3f6b4355a827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626850, "uuid": "50ad26a5-bfde-43ad-91b3-5a44a5be30d6", "value": "24576:G4qHEpGRIY8p8UCdWq8vs6C5bNfPVe+QNezFa:F5GRzEuWPs6KVe+8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624626850, "uuid": "5227e530-9209-4d73-8306-9ebfc2b5d6f0", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624626850, "uuid": "fcbab061-505b-47fa-97a1-697bfe00e62c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626850, "uuid": "29b65559-96b0-4167-be74-f45208a2d8e6", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8503e7-d5d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1624637614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637614, "uuid": "cca84f6e-99d7-4254-91a1-0c066a3c39e6", "comment": "Malware payload (AveMariaRAT)", "value": "132409e6519ff98e86740cdb6a353711", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637614, "uuid": "9d41a9fb-7d9a-4d5a-8aad-7087f2c3aae8", "comment": "Malware payload (AveMariaRAT)", "value": "2960795548bdc081bce7c2b6931113fc2dbceec5778a0de4e988ace7522594aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637614, "uuid": "36be624f-c9ed-4d94-8a8d-44714df4107f", "comment": "Malware payload (AveMariaRAT)", "value": "3a8fcf093539123f47b22f03148262370c8b4fad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637614, "uuid": "9f262b90-9f64-45e0-b467-839b2b773e8d", "comment": "Malware payload (AveMariaRAT)", "value": "b321e153d98e14dd6596d894248e3dd3b2b1804f55cc89aaa42a868c4de2ebbf01a01a3deb4823b0cc53659ad0fcd58c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637614, "uuid": "daf213e4-66d8-4350-ac7d-55e0bde3a2da", "value": "47356A262FE76F06E2727EF589D129C15E6B7F723622B43DAC71324D02325038B539A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637614, "uuid": "6b7b167e-7d80-4c2a-83a6-f8fad6d2f733", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637614, "uuid": "e9159b10-e710-4261-9d9e-af5330e0d724", "value": "24576:5I7jQ+bAaMd3REebAaMd32WuZxTJpH0sXFT9X:EJAaMVRE2AaMV2WuZ1JpH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637614, "uuid": "f714b5bb-4b98-4b2a-bef0-15507c5939da", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637614, "uuid": "240d9040-98f2-442d-b7a4-aa0278e350eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637614, "uuid": "0538f10d-6fe1-4b2c-ab48-f4b1ad3f9eb9", "value": "132409e6519ff98e86740cdb6a353711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270ef340-d56a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624593746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624593746, "uuid": "6f9c98e0-eb85-4cfe-933b-261b0fbdbbdb", "comment": "Malware payload", "value": "d924c2e0ada0553e23c63f1ece9fad81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624593746, "uuid": "5d4aa218-ed07-43d5-97f0-e8d8dc839189", "comment": "Malware payload", "value": "2adfc5e065f5d115238d38c18bc8fb019a83ba7e246c225daee6e17b30336e66", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624593746, "uuid": "418b5237-9432-4f2b-b0c3-cb221d7e20ed", "comment": "Malware payload", "value": "70b18e8e24b7fdea709e40965a733c3289aac252", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624593746, "uuid": "2c5f65b9-9ea4-4cc7-ab1f-3234c43d0230", "comment": "Malware payload", "value": "ae0bd2f5acb29a134ba5e31740b2eddf54c994c7868248d640cf9d627359c63d6271a018efb831d11dfa082ae365548b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624593746, "uuid": "b25e2398-2451-47aa-989d-e7af3df4b93e", "value": "C283099ABC819A5655D413BBBA7E85CE330323B8D2DF7103CD055F18B6CA94F0E7A582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624593746, "uuid": "348eae3a-be16-48ad-b054-cd044f4f2b76", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DhrPDysX+4if3LEVwjUt87HwJp:T2s/ITo7WCkybotgsJ913DhrbW4UYSxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624593746, "uuid": "328eb9a1-0175-431d-9f92-eb2bd559e2ae", "value": 85432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624593746, "uuid": "4e3e5136-c237-4c0c-998c-b34bdf6f774e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624593746, "uuid": "d2900518-1b27-4fd6-a3c3-80bd8c02865f", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c80f241-d57e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602479, "uuid": "27c25069-2f17-4bca-bbd4-d22f7ec0bf4a", "comment": "Malware payload (AgentTesla)", "value": "d6522971cd85aee7c7679c99a2753cd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602479, "uuid": "98470443-89bb-4fb2-a7be-0aa7acde5cf8", "comment": "Malware payload (AgentTesla)", "value": "2b7d1390ea2c6595bf7a716e5c8b91fc79f0fdc5ce5101a7e6339d2b3cf73ae2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602479, "uuid": "9dd4d1dc-2e1f-41cc-82d6-5c04720ceb7e", "comment": "Malware payload (AgentTesla)", "value": "fd93f14d4c5b6703aa2fdb7d26a63c9f8b1471b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602479, "uuid": "4627233c-196e-46f2-8d67-93fb52a410ac", "comment": "Malware payload (AgentTesla)", "value": "ad4e159575171d3cf54d17ecd4a3c7d6e434bb6fc5fae88ea2dab7bdc14bc65eda810e902ecd002d089d7f25b43fd406", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602479, "uuid": "37564b14-af44-4953-81ac-c5fa3a616b99", "value": "F205237092A5B106FED1E431C285003B1351385227E517AD7BFEEED6FEB96011BAC4AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602479, "uuid": "d63f4ab0-dd6f-4aa8-ad74-484b15a4c964", "value": "24576:qLan42cv1gYsW5ulFlXS3hCutsjcrdHI3c2:C2pYUlFtOhuj2512", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602479, "uuid": "d7b6084b-06fc-47f2-9a08-c69c587cae71", "value": 835835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602479, "uuid": "7bf487d4-8018-4fde-ab68-6d8330000f3e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602479, "uuid": "8a67521c-eb49-4a7f-81b8-e68d6a62f874", "value": "Order_List.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a45f64-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631880, "uuid": "5f98933c-f3ca-4b47-98f8-d1f34c5b95e8", "comment": "Malware payload (Mirai)", "value": "32685a4b01d30e0e1c3f564da41af6e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631880, "uuid": "e603e21f-0acd-4909-a63c-abc44792a03d", "comment": "Malware payload (Mirai)", "value": "2b9b79d4dcc0929e965d4afafb847c183b5633547a9d049122f9818bdeb6cfdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631880, "uuid": "112fad6b-8ecb-4db3-a637-8e914fe7e5ab", "comment": "Malware payload (Mirai)", "value": "e3ecb9c5408e0ca31098976dba80366596488895", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631880, "uuid": "7f1ed5a3-ccc2-4805-886d-fe8be391092a", "comment": "Malware payload (Mirai)", "value": "92281e61124f8c561333f3c98007ee788ec94aff50cc78e231a99b079bdc9394f361e18f0c70cd9d3363b6fb660257b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631880, "uuid": "fe565f77-36bd-4bc0-a5d5-8699cd9fb43c", "value": "59538D7684B55D64C09945F0B568CEB65713F20086973FB1898ACBA96027EFCF20E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631880, "uuid": "4c15ebbe-a977-4141-bfc6-b2d89366a320", "value": "1536:jaTAAK+RtLyMoO/a15v/7q5hKKLTj5EgCZHUbG:j1AxoOyD7WoKNEg/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631880, "uuid": "a44de196-edf7-417b-86f6-8941aee99461", "value": 62860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631880, "uuid": "c618d67a-4c58-406f-8a8a-5a8ea59fde10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631880, "uuid": "0a8bd885-f365-4ecf-ab63-98f5e6d565fa", "value": "32685a4b01d30e0e1c3f564da41af6e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a5bfe6-d58f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624609816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609816, "uuid": "bdd997b5-1642-4ca2-a5ac-e2792472cc1f", "comment": "Malware payload (RedLineStealer)", "value": "585368207fab5116640f854d6e6f742a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609816, "uuid": "054865b0-4288-4f5a-bf04-83f74b85f89a", "comment": "Malware payload (RedLineStealer)", "value": "2beba1a84ca6a357ff2e8fb49b014523c855b73195e04829db7ee94afe87ecd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609816, "uuid": "90973ca5-c6f6-4ad7-8ea4-51a0b24cdf56", "comment": "Malware payload (RedLineStealer)", "value": "b1e7b1a232e971c70a168c918cf6fe506663f707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609816, "uuid": "fabb0ed5-c08e-4925-9d2c-346ca534a9e7", "comment": "Malware payload (RedLineStealer)", "value": "3961d8d4921e743de56beeee89eee57ea0623168413cc5d0df64750f9e92fff2cfae679ebbf89bc8c5a85bb99923a113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609816, "uuid": "2acbf721-e64a-4b23-a312-53cf01d63833", "value": "95F3906623A3D476C1C42230D462CB3B2668CD2707707357B0CAAE67BD6B19D8DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609816, "uuid": "f52b18a8-efe8-41af-9d17-73cf58a1db99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609816, "uuid": "366b5277-77cf-411a-bac2-0f0c3db59335", "value": "3072:aK5znbrYKj+sGyxUOnPGxG7MJU3gch+YL:aKFbr0uehU3gcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624609816, "uuid": "fa934127-f2f8-464a-8c8a-4715caf6317a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624609816, "uuid": "c611c11b-36aa-43a1-91e8-6a8863ac4189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609816, "uuid": "2db8645e-451b-47ff-b2f6-2221b37003e7", "value": "585368207fab5116640f854d6e6f742a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b921d888-d552-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624583683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583683, "uuid": "02370e3a-1978-4819-a39c-531ebb6ca334", "comment": "Malware payload (Hancitor)", "value": "e76957cdce214df3005f6b6c1d540852", "object_relation": "md5", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583683, "uuid": "35ea9e4f-f8be-4578-9ce2-49c57778a901", "comment": "Malware payload (Hancitor)", "value": "2c416e02731724564655c4e07e01a265685e5e3f23e103a15c7c59a38241bc08", "object_relation": "sha256", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583683, "uuid": "a9f45019-b85b-431a-9a3b-65592996f8fd", "comment": "Malware payload (Hancitor)", "value": "2d9ecaa0e2cf8392b0cd12ecac4c0fb58752bfe9", "object_relation": "sha1", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583683, "uuid": "bca686b8-472e-4369-9150-19d9840da037", "comment": "Malware payload (Hancitor)", "value": "3adde71a14958715bf345419bcf18177f19e256ed34edfecb66430232ae7415b78feb4b58fb96dee92bea819d93940f2", "object_relation": "sha3-384", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583683, "uuid": "5025240f-8bef-48d1-a4f7-d9411a707962", "value": "BB947B0079D1D432EAB219310F65D696537CBC540F309AEF73D83A2E9F781D2AA31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583683, "uuid": "70fcb73f-a7b7-4136-ac21-0268621fb8af", "value": "543ad4119209f0813a5ba22168135c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583683, "uuid": "6a8008b8-6802-47f1-a32f-f5a84c12136c", "value": "6144:f4A8eyBxGORnKwOCd2gya6tglz2XD98v6OZrfdAOJ7BsFcKw:fl9o/OCd2yVlQSvlFOuKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624583683, "uuid": "c190ab35-b1c7-46e6-8cd0-3c2dcd939482", "value": 424847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624583683, "uuid": "2044bc2a-6c3d-44b7-986d-37d95631a7b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583683, "uuid": "518fad42-c77c-445c-89e1-d323ddfc2624", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58cfdcd-d5bb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624628801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628801, "uuid": "0f9faa4c-4485-40b0-ad4b-88a668863adb", "comment": "Malware payload", "value": "be53833b7b9c8a16d5d90e25af26e0c5", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628801, "uuid": "d607f421-4776-4b38-8b31-da3764768823", "comment": "Malware payload", "value": "2ce818e435137213162003e2aaa89a4bdbb67ba9416283c3646d84d5393d685b", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628801, "uuid": "dc9cfd30-1239-4d95-99cc-0ff2f8228d8d", "comment": "Malware payload", "value": "78e99a0ce9f45eb1edbace4d38ed43253df01e98", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628801, "uuid": "3563ac99-ab2b-4833-b38d-0087de3ae6af", "comment": "Malware payload", "value": "c1898d6c5a6c8e8530be6170dba63c7b401bed1cafce75e1e690a7c20781e90f2e53cbf0d556e63f41e48b1b4ffbe7b1", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628801, "uuid": "2b6325d3-0c7c-4081-b8c7-cbf517782df2", "value": "0885EF0D70B65A62C38FD6F0B5ABB35C426DBD8D20C804594822D5D97CA0CEAE778DE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628801, "uuid": "3032fa9d-fdc9-42f3-950f-27245eb1ea25", "value": "1536:vKWY/Wc6zzzzzzzzz/szzhzuI+6qMeqPtzubjKWMFjuI+6qMeqPtzzzqzvzzzubh:oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624628801, "uuid": "dcccacfc-deb5-494e-a5f5-4f39cc668b83", "value": 1711129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624628801, "uuid": "afb90795-afd7-4830-89dd-676a7666fdd7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628801, "uuid": "f49057d0-dc20-4840-b70c-29ccd8a9eb91", "value": "SecuriteInfo.com.Trojan.DownLoader40.995.17731.23113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2db4393-d579-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624600450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600450, "uuid": "4399ba75-5667-4acb-bdb6-72d31ec4a6e4", "comment": "Malware payload (AgentTesla)", "value": "1a0af3a694007f1c405a895ee28dc2bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600450, "uuid": "73757159-3786-4d64-b0d3-b42ef0e9fabc", "comment": "Malware payload (AgentTesla)", "value": "2d2b027bdc89966db06390a0f5ecf130bd1f52e7cb5772cf795661fb9eb43e55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600450, "uuid": "b00cadfc-99a6-47d8-8703-ffb385e2883e", "comment": "Malware payload (AgentTesla)", "value": "1665971ac099d791152de4e89ca21f4d242bd211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600450, "uuid": "a0999f6d-5041-408f-ab6f-220eb586ac17", "comment": "Malware payload (AgentTesla)", "value": "68eab5b82378f1bcd1f5bf4f845f6e4254efe811b4c48958878cdb457a3d4b73894e01387e32fe70dcecdf5f80d27de0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600450, "uuid": "34db381a-434d-4ad8-8c49-911fee616ad1", "value": "D3256A5537AA4B05F03A57B07126C9B0E375BE16296AD21A4CC03BEB3973BC1CF8561B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600450, "uuid": "fac3191e-a210-41a8-8cdc-dccd78b7d2bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600450, "uuid": "9311807a-e737-422d-935d-1248c65f54d7", "value": "12288:ZXzj2rhTgpkbe9OmozNZUKz4EbfTsiMZovmtY+hGD0coYXBtaWkXaonUqgE:BObSOmozgKjWo4gD0R6kWufUqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600450, "uuid": "788d86ac-d28e-466a-8592-26cc07b37044", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600450, "uuid": "6e53c826-8f25-46c3-ae8e-1923d11b9283", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600450, "uuid": "603c05dc-ccdc-48b0-b844-ad8c76a41f7c", "value": "Bank Slip.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0d3ebc-d5b5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624625993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625993, "uuid": "ca3098bc-9361-4695-a249-b601cd56a01d", "comment": "Malware payload (SnakeKeylogger)", "value": "a1281cfec4779305f0cf4e8d4b83ce31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625993, "uuid": "16ad80a0-c4b2-4524-9082-560fb4a2463a", "comment": "Malware payload (SnakeKeylogger)", "value": "2d934fd3a0bacb43dea03bfa70b25e9f04ae96c733ffd32ef4b53fe2524315c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625993, "uuid": "7069030a-3877-4ad7-bad6-9305308d75f2", "comment": "Malware payload (SnakeKeylogger)", "value": "4b832e9f1c487bff81cf5bf847f5daed27ef1971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625993, "uuid": "9fc2ac05-a989-4517-8128-768666dfbb91", "comment": "Malware payload (SnakeKeylogger)", "value": "5212b54914438b7666c4324d9e53fa5876d14d89497ff34cf0ba39b3fcdb6f61a4794967d16c2ac0877f3986969f3fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625993, "uuid": "baf58842-21b0-406d-9d37-510ff9813290", "value": "F8C4B159F321209DCC26A579C9F03A52D63334775636790E5CDB118A8A39E87BBC0FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625993, "uuid": "6fd64415-ac2d-4599-9dc8-19f37612bc0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625993, "uuid": "e3d385b3-c85a-4541-9f53-65b1e3297287", "value": "12288:HVsxlCUrDwQuyyyrAqy6lDzvu1E70u3y6Z6mZ9tmKFO:usK+6lntpFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624625993, "uuid": "243f0ab9-e061-4af4-8e87-09e13e0efdd9", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624625993, "uuid": "2d7d02e6-2562-4de1-a800-46f4cb4a005b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625993, "uuid": "eda52ef7-b8b0-4603-baf3-a44d08250f07", "value": "Petunia. - Silverton-xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73863cfc-d5dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642837, "uuid": "c12c5b4e-7cfd-4ad3-bdc8-5c3c96955b59", "comment": "Malware payload (Mirai)", "value": "ab6e968eec6c065d093df4e2e65c3f58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642837, "uuid": "b9b377a5-0a44-4c04-841a-0afe684fc2a4", "comment": "Malware payload (Mirai)", "value": "2ed80aae6ae99f215d9ab3b300792ef4e5b62279dde93d401cbed85edad9b8d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642837, "uuid": "26dd6c56-0a56-421d-8860-1f001860f26e", "comment": "Malware payload (Mirai)", "value": "70eab00bcb2216bce259af5264ac373d0a76010c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642837, "uuid": "225f2537-86d5-4f38-bd07-4f74875cb8b2", "comment": "Malware payload (Mirai)", "value": "531d14d1767afad8db32b34daf3038710eeb579ff6148d4d17670db88174cf6bba2858adba4036300f37882202304df9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642837, "uuid": "99ff871c-6c3f-4bb8-9c32-849638b53f59", "value": "C5C2E0981B4919D9D2F9C17803B81B781DA40BA6F809EC85B9FCF7629D8E4753027EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642837, "uuid": "8c490cd4-a16d-4b32-a836-f98a3778be8c", "value": "768:I2G214DFyosXqgvV9o1ndB08SiJgGlzDpbuR1Jx:I2GdDgosaaO1ndUmVJuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642837, "uuid": "6186dc3c-0230-4cb4-876c-c7ab66d171ea", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642837, "uuid": "a96f5e84-e3c7-4f0d-8b47-799bddc28a04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642837, "uuid": "d6206c30-e6ac-4649-8c7d-f896f03e9e8f", "value": "ab6e968eec6c065d093df4e2e65c3f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30ed401-d56c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624594947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594947, "uuid": "b375f5a8-979d-4db7-b2f5-0783138b4776", "comment": "Malware payload", "value": "9eaf863bffdb3b9bb3bee0472bb8f63b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594947, "uuid": "a92af1c0-5d29-4134-b905-b19f9b8fc26c", "comment": "Malware payload", "value": "2f23c986e6699d6eacfd8c95789c2f8cfe7c33facd1359074636d03605de08ac", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594947, "uuid": "e2c7e495-00c7-4507-97fe-0099da9e1241", "comment": "Malware payload", "value": "70fd62613060a5f1f32d7dc8736671104a021b6d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594947, "uuid": "09b45844-462c-47da-bd73-29e22b1ba3e4", "comment": "Malware payload", "value": "676c8c62c54e1b5791b6e890b9119f9c1f0d3e68d6460cf991e9148cbcd48793ce493665ea96a4166fd65b02a3c48491", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594947, "uuid": "fcdb0a4a-5ad4-480a-a617-31998bc0bdfc", "value": "43C31247B9A384BCDF8BC175C0DC952F39B9763B146DE1110221E9CC90BECEA4B99794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594947, "uuid": "3219d049-7abd-4746-94b9-73a5e8a9fba2", "value": "3072:dGaggP9H7XacdaqFMoigqrxlA/mG2LygLdO3djdCNstvZfkoThh:dRg+9H7XaQbigSl82HgGav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624594947, "uuid": "7b0ab0ad-1b87-4a82-b9dc-7dc6fbb04437", "value": 123224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624594947, "uuid": "88130de7-8462-459a-998d-e59d989c2c1f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594947, "uuid": "04e21aae-1d5a-4fa6-ae57-b9929b6913e3", "value": "Payment82736377232.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba787dbe-d5c4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632648, "uuid": "1f8594c2-3687-4684-9eff-79a9a4ef6f65", "comment": "Malware payload (Mirai)", "value": "c04b6e727ba11e2c3d35482137a87201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632648, "uuid": "6ec745c8-18ef-42b4-aed2-0768676c0986", "comment": "Malware payload (Mirai)", "value": "2fcc4323d4aa7a1f61ba5d5b03b4463aab8b0bf2c3beb961f2a733691d13cc03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632648, "uuid": "bc4ff87e-1f9f-46e0-880d-61ae1204da7d", "comment": "Malware payload (Mirai)", "value": "ab70b55b36cb88c7e8e4d4e6b5e88576a960f0d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632648, "uuid": "54312081-be7a-4863-8588-415e837d7fe2", "comment": "Malware payload (Mirai)", "value": "79746325abddf3c460f22e98634907ca416d7afe1e4463caba3e737468e6a2025619b509610e677d47ee5ebbaa532304", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632648, "uuid": "9b551885-33ab-44f6-846f-0b3fbf2aff56", "value": "16639DB2C9642E18D2598AB1F128CF3583639504A2973FFE916AC76DA443EDCF5183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632648, "uuid": "c25bcfe6-0668-4a2f-8049-9ee1c4e4c1be", "value": "1536:k6ICOnrFOwlhO6xMmwo99i29r3mCriMXwKQ10cm8RK:3Aw2O6xMuL9r3mqXQMYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632648, "uuid": "0a7a5b90-9037-42cd-b41e-16ad434e220e", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632648, "uuid": "127bc036-5fb9-40ee-8ab9-39425b6f2125", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632648, "uuid": "4b89abfa-d833-4a7e-929f-50a5f454fcfd", "value": "c04b6e727ba11e2c3d35482137a87201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86680ee-d550-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1624582823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582823, "uuid": "443b35b5-d55a-44f4-9b3d-fcb3a54a0f5e", "comment": "Malware payload (FickerStealer)", "value": "3ae1c212119919e5fce71247286f8e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582823, "uuid": "ee44df9c-2f23-4eba-a8a5-0f2e46d0ca96", "comment": "Malware payload (FickerStealer)", "value": "30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582823, "uuid": "a9ca06f0-0d80-4f40-80bf-c3ca087f22c3", "comment": "Malware payload (FickerStealer)", "value": "97c1890ab73c539056f95eafede319df774e9d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624582823, "uuid": "be176d07-534d-4108-8ccb-912f052bc448", "comment": "Malware payload (FickerStealer)", "value": "1d61712843d96309c1060b794c2df9ccd7a848365a22ea01f63ca1345877e184c117504ee011491465daaa59f3d76790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582823, "uuid": "1d01b8a0-f5ab-4178-98b8-2105ecbe3962", "value": "39E5339221EC41ABC05576F209324F257E6278245BF5E34B037716973F2ACC3BD8A7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582823, "uuid": "cfc33ff4-9486-4a64-89fc-0353dc90b23a", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582823, "uuid": "5637b3c9-72ed-4347-aa48-8d96314cf469", "value": "98304:JzW3xr+nE8OUSnhyL/34PVR3dSqJcppIrTF9UqGbmZ1:J6x6YUSnqoLt/cLS59UJmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624582823, "uuid": "4dfa647e-4eae-4067-94a1-5250c97e1d7e", "value": 3311225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624582823, "uuid": "ca6b957c-7dd6-4c04-9786-7a0ab7315c29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624582823, "uuid": "e2a94c3f-3901-414b-a2d0-1384e3f1db5d", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9641173-d5d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641209, "uuid": "72d5af0d-0191-4dda-8d1c-3d466b28c999", "comment": "Malware payload (Mirai)", "value": "c407c3147c7d242ca64e6e8b4ee12b74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641209, "uuid": "01104672-76ef-413c-bb29-489a8e7b7552", "comment": "Malware payload (Mirai)", "value": "31cc78b793d67c1b3e1e1d566a240a1bc7682faa7353a9d2ade3072f9bdbdf02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641209, "uuid": "14489b0c-6a5e-4da3-890c-48829879cc03", "comment": "Malware payload (Mirai)", "value": "f7c6ad29497287fc913d84f75bbadbdad05551e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641209, "uuid": "6031559f-b327-4d6b-9b56-09f7c9175566", "comment": "Malware payload (Mirai)", "value": "a0cbbd656c84660b18e4999bc4fc6421c6819686fd39ab12dbc9d9cf78b1c87cd4d979d05c272f42b17f785dbc6eeb14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641209, "uuid": "5aaf26df-31c7-4067-85bd-5d26d1946ad8", "value": "AA23F746BC81992AC6E0237AF56E50CE332173E9D1CF7667CC121B0076CA56F1D6BB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641209, "uuid": "f96dae5f-e530-4c1d-b764-385cdd0791b3", "value": "768:PI1liF5PQcojYvrPW6OIuMQ4x8nTKSKw2DZTaN5FZSI/hr/tfZCJ9DZzXBNWc3:iE3QWr6jMQ4ATK62DZO5F8I/d/tfYJ9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641209, "uuid": "b897cfc9-9d77-4c43-89d5-ae68b5de91a4", "value": 46308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641209, "uuid": "cfcb1938-a7c0-495e-8c96-2f1405501836", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641209, "uuid": "d89b57b7-e210-41a4-b504-23e385da7443", "value": "c407c3147c7d242ca64e6e8b4ee12b74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d644225-d581-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1624603662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603662, "uuid": "94418430-04c1-4f24-96a0-e30899d50944", "comment": "Malware payload (SystemBC)", "value": "cde7fabb4f892a362c73ac6be75dd66d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603662, "uuid": "be9df0a9-dd63-4973-8034-60d1ace06a18", "comment": "Malware payload (SystemBC)", "value": "33269c0773dc723ffa5be5a6319e81c7f724d03dbfd9b46a5d40452c4b08bc88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603662, "uuid": "d29b458d-85f1-462b-bc24-d4ca202444b7", "comment": "Malware payload (SystemBC)", "value": "5e83793c5b2a45e843d65b867e3da848c95718be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603662, "uuid": "21247317-6af5-4d30-b2e1-d20315a34f99", "comment": "Malware payload (SystemBC)", "value": "ab1d61c76567d8113c8119fba30d8eff9d5ef967ab03c45e9144200d5761b7746a6506bccdff610872143a9a2190e825", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603662, "uuid": "faae2cc2-f539-4eb8-bba8-b36e929f0624", "value": "9EE49E23F2D14837C1732A7D9D4B92949C29BE513E3868462FE42E4C9F397913E352A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603662, "uuid": "79fd3fa5-3ee8-437a-a5c5-b33c76181d04", "value": "c5a49ffbbcf2bae938918a63dc41e6ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603662, "uuid": "c4b3b3db-21f6-4a94-8808-0be20626b005", "value": "12288:cRhgZ5pZ9f7FfLXx6oLwsKcV+XomRObdjLGv:cgHZ9XEXs5+XgLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603662, "uuid": "bdd63229-bd4f-4507-b614-bba8a1b91b45", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603662, "uuid": "87297330-feb1-4f6e-b173-4fcd8c527084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603662, "uuid": "a8bf8d61-aa17-4458-a0b0-0479fb64962b", "value": "cde7fabb4f892a362c73ac6be75dd66d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cf1a74-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602168, "uuid": "a9f93f0f-0f54-4fb1-9b83-da83c2179939", "comment": "Malware payload (AgentTesla)", "value": "6e52c86423b939a825f1013a414e486b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602168, "uuid": "b92da18d-4ca6-469a-8a3c-8ea783acd096", "comment": "Malware payload (AgentTesla)", "value": "33adfcc3b09f4fc7d2596ec89d67bfc0fe883208e4e0250c8a7f3d5aacdde9c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602168, "uuid": "39e2d6c8-51e7-433e-9b74-da646a187935", "comment": "Malware payload (AgentTesla)", "value": "736e92d2315787e3089d0b56d660677c44288839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602168, "uuid": "e6b5b9eb-b3f6-4f85-a382-ace08462ce3d", "comment": "Malware payload (AgentTesla)", "value": "c229983e042b213717bb162f3a216a691ed9b88a29cffe6923326149f8da1b62d1836dd8d36af2a52c5d33bebbbb1a8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602168, "uuid": "e560f49d-715d-4d1b-8ae2-11d98aec80c8", "value": "0084233C262E36F97304C5E365494A8027406DEDFF1DED6EC8C32AC695E6262D8B390C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602168, "uuid": "534f0abe-9310-4bb9-8727-00c6d13250a7", "value": "6144:vr4GLk9xAOdLz9d+K1DVT8Bv5NXUIcC6CYaegzBSSmH8Y82A+n2CVps+urWbp1KJ:D4H9pl9cKJVov5NXUV9CY11Sb/+2ksOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602168, "uuid": "ed4a43bc-10b0-4365-976f-26f01d58753b", "value": 388799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602168, "uuid": "a0cda8ac-cfc9-4b06-949f-0ed1c8d4dd12", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602168, "uuid": "f70e74b7-2064-49c6-a679-976fcd7a7e44", "value": "PO-240621.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933751eb-d5c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632153, "uuid": "c1674c66-c431-4ff2-98da-788c7cd2113f", "comment": "Malware payload (Mirai)", "value": "849c89387ad0e1c5266ef9a5426308bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632153, "uuid": "e5fc1afd-dd22-4317-96f1-578d7dfd5762", "comment": "Malware payload (Mirai)", "value": "351d73eb7a4f5be3c4b68c1e76dc34e45ebcbba15833936c0058d8bba85f19ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632153, "uuid": "62e2ae49-3363-4f57-9b09-2e3be03a6b64", "comment": "Malware payload (Mirai)", "value": "0c5ca7e83c13db4da523bae65926c242aaf58d1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632153, "uuid": "f26846db-5701-48c4-8533-18d7d13aff7e", "comment": "Malware payload (Mirai)", "value": "2fc43f82f8441279f8b02d00e1b406802e4b81a05c74d78aa75416c441da86b8e8b676f63a6fc2c25d85005d831fa246", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632153, "uuid": "5ce5be01-2082-4fe8-97e8-fdbed4403b0b", "value": "9C833A96BC918A27C6C423FBF62E528C372153E8D2DF31439E211F6536CA52B1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632153, "uuid": "a974ea0a-6eb8-460b-9d1f-c8e76edb85e9", "value": "1536:ZXv9AJalkFKwzLte6/OlmOF3ylj5WcqhTcVhv/OVhKbEOajNfOOS6nxtSa10ql:ZXv9+7rzLI6/OlgST6tmVIO9Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632153, "uuid": "91d8f73a-6be8-45a5-86fc-d320d1143905", "value": 88672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632153, "uuid": "8e0579ef-44fb-4d75-92cc-4a2462184c74", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632153, "uuid": "46951545-b2a9-403a-9ca9-6c6b45e1a319", "value": "849c89387ad0e1c5266ef9a5426308bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e8e8f7-d596-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624612961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612961, "uuid": "2f73518c-604c-4656-826e-a71d90cdfbc4", "comment": "Malware payload (GuLoader)", "value": "b9b4b1084d93310dcb98e94a6ea40995", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612961, "uuid": "4b7210b0-8f96-48b4-9f4e-ca49d167e0ce", "comment": "Malware payload (GuLoader)", "value": "3529826316922773d660f8598e1b5b64de82d5536de77ef8cec5dcadcaf7d3a5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612961, "uuid": "9ba0d432-c7d1-4124-a0d5-4f4a9cc84925", "comment": "Malware payload (GuLoader)", "value": "03be6796071424eeef581849b55c28c913ab13b7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612961, "uuid": "aaf33949-4080-4656-8ca4-9317f743913c", "comment": "Malware payload (GuLoader)", "value": "09050bd242dcc9d99c5d4236779242ebee45e2098bd2d0d409cb87594d8c40fa422bcda4005602ab22fccf76d1b7668e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612961, "uuid": "edcba043-a96e-4609-ac0a-a81bf62af6d0", "value": "A84512BD411A092DCA1EEE3B90C2B6AEF46C9C75FE90819A245DBDD03533B794273193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612961, "uuid": "00462a39-4209-4aa9-8ae7-7eb1e22d60d4", "value": "24576:XgQ+qIeq9FPWfZm0O1bJmshnPcMQxDpjTwFKfn7t5Zzxnn+iBW:XgQDqbWwjpJmqnPcjNp/Pndxn+CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624612961, "uuid": "c237f211-3ac3-4155-981f-d37003880ffb", "value": 1205640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624612961, "uuid": "dfde5bdd-40fd-4a9e-a227-e2a187e8fdc0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612961, "uuid": "b872adc5-2036-4091-8d1a-efb312fde748", "value": "Ceres Foods Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d606428-d572-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624597219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624597219, "uuid": "3f778975-4ee7-4658-ad82-c8196a2e9ffe", "comment": "Malware payload", "value": "819dabf4bac5253403b87bc5619b594b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624597219, "uuid": "777b7938-824c-4101-a785-b181e4671b23", "comment": "Malware payload", "value": "356821b1039bc9295a02ea26d2af40401f5ee07bcc50e60ab759d279e7e7d1f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624597219, "uuid": "cd568bee-248a-484b-92e0-44bd32266539", "comment": "Malware payload", "value": "9b2e66555d1b540548ae83725061bd933c6cbb78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624597219, "uuid": "d9bec131-fbe7-4494-80de-7c558353d149", "comment": "Malware payload", "value": "09f2a9e017d42f662550cfaadaedb13913be81065b56653d72cc69887d21cb469ebf49b794630a029c8fd7d1f513897f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624597219, "uuid": "3874f221-e81d-4510-8436-8dde4047cafa", "value": "3E962377A95051B1C0F20A376CE2105E1CEBBE1D9527108BB7EDBA0164732EAEF39617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624597219, "uuid": "fdefd6a4-d686-4672-ac61-5a7e07a13aa4", "value": "25c0914e1e7dc7c3bb957d88e787a155", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624597219, "uuid": "ae29dbaf-d2a9-4b43-b533-90d4268dfa65", "value": "196608:luFx6QoDLsWJfMUal31QWlT5ba5UKFRXlkj1y9:4Ons4ONJfOeKFRXlkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624597219, "uuid": "14cb0e03-83e9-42d3-9ad8-78fbe1a51495", "value": 8925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624597219, "uuid": "d2ab9d34-941c-4908-96ea-6e141743b839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624597219, "uuid": "1a5bf3e5-34bb-40ba-ac8e-9a7778f6591c", "value": "819dabf4bac5253403b87bc5619b594b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed88c928-d5dd-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624643471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643471, "uuid": "9db270be-d7c4-47e9-a2fa-4162d94d5ad0", "comment": "Malware payload (RaccoonStealer)", "value": "3d19a137a9934e2003ada68cb05363f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643471, "uuid": "fd7fea88-4e6d-4ce6-a6cd-1d3a9b34b0b7", "comment": "Malware payload (RaccoonStealer)", "value": "357d37439ca69f878804f0c94fe2694fc6914a1ee61400ee00b839b5eb9245cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643471, "uuid": "3a007ea5-0116-4071-a0d7-47ced24c9c7b", "comment": "Malware payload (RaccoonStealer)", "value": "b341c3b47e44973e2f82caf4c1246774c4985e37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643471, "uuid": "2187a2e9-7247-4890-974d-e012b1f655ff", "comment": "Malware payload (RaccoonStealer)", "value": "bbb620097b30bdcdf300c92fe05b1362fd283e4424dcc12bca5e7bed2d61aa83d43f75e099613ce9a1b85f19c5da990e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643471, "uuid": "535e1036-ddd7-4639-801b-eb3ea033dec6", "value": "51B4D000AAA0C035F5F776F85A7A42B4B47A7DB16B2884CF62D526FA56746F0DC30327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643471, "uuid": "637d235b-b526-4bdc-b759-4a2cd003a550", "value": "34c0759936727f40e2263d833b40ae4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643471, "uuid": "7148dbd1-4dee-49af-b0b5-be675fcd15de", "value": "12288:32IFD3Jvu0lr9wQEPNDOfV7ENVgG+lnx48K8NmeANZyY:3hD5JlSQytEzlx48K8NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624643471, "uuid": "2744cd58-45f4-4970-b334-1ae11405a36b", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624643471, "uuid": "79623309-1f22-48f5-8285-394a296fba85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643471, "uuid": "d6e5e369-64fb-46ba-a543-8bb464b08e85", "value": "3D19A137A9934E2003ADA68CB05363F7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b591478-d55c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624587901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587901, "uuid": "a3c70143-d4f6-4761-813d-bc14e2205e2d", "comment": "Malware payload (Gafgyt)", "value": "c22f6247af83c5d9a7ac05e88cdbc94b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587901, "uuid": "fa2cb2ff-5786-4807-a496-cbd39f7d4575", "comment": "Malware payload (Gafgyt)", "value": "3781e67c13589a3ba7fb00c7b8de2395367358dd2b2f325609f3552c81719bb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587901, "uuid": "e6e735d2-a414-4453-be2d-2f1cef1bf2a0", "comment": "Malware payload (Gafgyt)", "value": "4580e0a4621ba016ddeb5418a2ea9fe0dcfc224b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587901, "uuid": "05fa1921-1908-4ced-8085-86d0666f3e0e", "comment": "Malware payload (Gafgyt)", "value": "33f53a4c599ed96804bdabd9ae737ecd329ad1b959f4d8e8d2bc72517004145319f60f591676b4e0d06c5c59eba52429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587901, "uuid": "b94dcb71-358f-4470-82a1-4c09ea75f58e", "value": "19C3D63777230F67C0CA147101EB2331A679DE8438B94ED7A9917DA83F36D94381AAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587901, "uuid": "2af39fee-bc48-4c86-bb56-c11878ebc023", "value": "1536:5nHb3oUweeaN95Ptbc8tpRmyYtlSN1y7Bm94AEYv0Pz+vQIk65:RYueaNP5cKYyNw7BmqAEYv0b+vQ365", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624587901, "uuid": "c0846232-9d6b-40b3-af0e-e8cb473535c9", "value": 126131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624587901, "uuid": "f325b9d0-0092-4020-bd87-99b23b3b58af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587901, "uuid": "efa1097b-a129-46d5-9c50-bea19977caf8", "value": "c22f6247af83c5d9a7ac05e88cdbc94b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca977b42-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624642553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642553, "uuid": "5b3c5b98-7482-4968-a4e5-3eaef4888fb8", "comment": "Malware payload", "value": "b513bffb7635b930271e36aa8798ca1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642553, "uuid": "d822a234-7d3a-40b0-98f6-7dbb3139366d", "comment": "Malware payload", "value": "38413af142f6caf1246aed9682b21bef98ab884df27d8a74235fe17324da14bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642553, "uuid": "67ad5efe-8b53-4d17-85f3-9143d99f3bfa", "comment": "Malware payload", "value": "cc5e742ca7fd3f697f9a3b9f5ffb226b0ed489ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642553, "uuid": "eff24cb0-de1c-4d69-9091-4baa178ef51f", "comment": "Malware payload", "value": "69fcad938b9e3ee0f0ffdf4471934c08b34958e65ebafcfe7cc0c6d9f376f8f958e36a031f6185ce65d4127a4ad5b85d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642553, "uuid": "ef56f4d7-5ad1-40c1-a631-0b37d5e0b231", "value": "9EC2C03D22C295BACD4AD17A52EC131542FF4BB6F5E39F073515D5568E82070B20B9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642553, "uuid": "d0fac3cd-33ee-4328-9b57-f26ce7f416f1", "value": "768:jug7JxpRi54wlzh7YQ6sl6sNMDyJgGlzDpxYsw:L+4qh/96sqSVrYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642553, "uuid": "15096e07-b9ec-4c5f-a833-7339a21321a7", "value": 25972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642553, "uuid": "2e136539-2c1f-4acc-a84c-a7a79c5c8857", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642553, "uuid": "96054352-1728-42ed-94e1-666aa1516470", "value": "b513bffb7635b930271e36aa8798ca1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bfdcc7-d5cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624637364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637364, "uuid": "ee1b2ffe-9f44-4911-9dcc-73246a670ea9", "comment": "Malware payload", "value": "8c6a35e37444863b7c0c82af127aa30d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637364, "uuid": "7ea77acd-ad09-460a-960d-abdba9be2603", "comment": "Malware payload", "value": "392ff0a8dc9670e54508c4834e303c5147070b857e3f8dc0e910f2630649d736", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637364, "uuid": "ad119644-0ffd-496a-a7c8-2807dd86a556", "comment": "Malware payload", "value": "4f6c2951d0a090d9992c39a45cbe0b38c1b5240f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637364, "uuid": "d09f7093-048a-4d74-b64a-e041eeafe412", "comment": "Malware payload", "value": "018729bca9f21f6acc340d244ea240372a6f6444d8c93d32a7ffe142e147ebda6ea287739784a73a4520d06c853d660a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637364, "uuid": "f0f56b05-8ff9-4a81-84b5-bec691983deb", "value": "65A48DAC36A035EED46BD6B9DAA42CA4EA617477130BD506901300DE9E1DBC7DF209F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637364, "uuid": "e92bbf86-8928-4221-9ca7-6447dab6fffa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637364, "uuid": "d00ced5e-02a6-4d65-a9f1-635cbc40a6d3", "value": "12288:ESQdmRv1B+Dhc5bXUcYpzJFZ6fMsYy/LyOZ4il9:E8GDO1PYpJF8UaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637364, "uuid": "5102e766-3e87-4677-b4f2-9354f651b3f4", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637364, "uuid": "8af801ea-98a3-44d9-8a9d-48cf1a2abeb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637364, "uuid": "c6cfd21a-bf2c-4369-92de-35276626ba44", "value": "8c6a35e37444863b7c0c82af127aa30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bcb88c-d582-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624604125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604125, "uuid": "450c4939-139e-4d4d-ab44-5a065d284fff", "comment": "Malware payload (AgentTesla)", "value": "bb201693a1cd306bcda032a820eda6b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604125, "uuid": "64ce81a2-e1c0-40da-93cd-5fda41f2dbee", "comment": "Malware payload (AgentTesla)", "value": "398dba402e34b237527aac06d8bd7de11b53fc99093347425bbd990d804cb72c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604125, "uuid": "e2946873-37a0-4b52-b6a8-a824c7265c8f", "comment": "Malware payload (AgentTesla)", "value": "19dcd1b6b1542380f02e6c283cd0f33d788d276b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604125, "uuid": "cc8ee7a5-2d6c-478e-83c0-2cbe0651e42d", "comment": "Malware payload (AgentTesla)", "value": "3a98a60b9edeb7d5e8cf6926384c09812c215dbacd0b90ecef5e7ba0877d0b9c7ce1391e63e0ac2d3b53f7820d8e7b44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604125, "uuid": "ee0131bf-0334-4595-af1b-d951e0440fa8", "value": "77E45C6D766C314DC493917BCE74ACD65535ED62AF26407276C3378A0EDCA838A20FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604125, "uuid": "e2ac971b-2ff6-47b2-b56e-f4ad20b4d01c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604125, "uuid": "4ec0cc6a-ff06-4e19-b6d6-34bd62289098", "value": "12288:StfSfjlkzKtqG8yxdAoF1Hdn/OvPayNQaEL7hdQJxB559Keu/hPO:ShCjmmtqfyxdAKd/m3N7EKtIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604125, "uuid": "637139cd-84cb-4aea-af08-e759fc50521d", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604125, "uuid": "95326cf6-73c7-4e96-8723-b9908cb97b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604125, "uuid": "cc308ae3-4d91-40ec-8ca5-b7b2b52d1fcb", "value": "tx6yV1nudyxvIZv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630dc925-d576-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1624599000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599000, "uuid": "60f97088-2691-4f81-ab2f-4f2b5c0eea7d", "comment": "Malware payload (CoinMiner)", "value": "68ce8552bd7a128a70efcbd51afa61d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599000, "uuid": "41d3d578-5bbb-454b-be9e-f5a31d3b7e6e", "comment": "Malware payload (CoinMiner)", "value": "3a81a90f5208e505850a9c093377b8d4ecceb9b6478abe6b8b1ef601730f1906", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599000, "uuid": "6dfd71a6-36d7-41be-9b04-87ba763e6fb2", "comment": "Malware payload (CoinMiner)", "value": "9dfbff52cdd1326d872352a7f026271a8f8e6ef4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599000, "uuid": "f8f817c4-d655-4b94-b4f2-8bcddce9d862", "comment": "Malware payload (CoinMiner)", "value": "39739ce62f30fe7e10cdd3305f0fd7293382c7da9c70437ff17c8aa641c3929aec6f93591c48543601c4acf556949af9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599000, "uuid": "f94c78b6-141b-479d-95a0-b4c649cc46c2", "value": "546533E18396AC3AC49003B8C4769D41D876ECB9CAE0B7D89565F22DD933346C8B5D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599000, "uuid": "f6a87bb7-07db-4a26-94cc-5a4e337126ab", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599000, "uuid": "4f02563c-8779-4d05-8ea4-2e1c69a9abb4", "value": "24576:RBXu9HGaVHcPHUHF5WZtdruSjn6jJpcEaipOsSfiIE1:Rw9VHcP0HDWb1uSjnkfcEaiphqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624599000, "uuid": "b764798c-e1c1-4bf7-9351-93590d970ef8", "value": 1435146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624599000, "uuid": "c57ce246-ae7a-48fe-9934-5babf000ad59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599000, "uuid": "afbfef7a-23dc-4a75-9de6-5d577f7f7896", "value": "68ce8552bd7a128a70efcbd51afa61d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712c9d48-d5ac-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624622217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622217, "uuid": "083c637d-da8e-45aa-9e90-a07948bd5e68", "comment": "Malware payload (Glupteba)", "value": "d6e512ff4e936549b6cfc16709fc0809", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622217, "uuid": "00df9e7d-3e7b-44bc-82fe-29053eb9456d", "comment": "Malware payload (Glupteba)", "value": "3b658e18aaa3a2e85db5479368328239962111a4eccfe5677c238b26a2de9521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622217, "uuid": "4e6cb35c-ca42-4639-8fcc-8856fe628e95", "comment": "Malware payload (Glupteba)", "value": "654467f19026253bbd0ba47e0b9e13dc24a29425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622217, "uuid": "11d4e7eb-57bf-422f-b834-eb4261c4e7f4", "comment": "Malware payload (Glupteba)", "value": "f195aebb7c880dfc09850ec41f0fe7b032bda335ba2206e0f85613a5355f8ff19879c6c4db08956c1f747f85021b44cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622217, "uuid": "10040c2c-6aa5-4b07-aa93-151312bb2412", "value": "5526331075E2D029F5B781F4E922C3B866396DB19BA481C722C6F7ED96342D1EC72317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622217, "uuid": "b3038016-cd19-4669-a490-d2bff2c443ef", "value": "af0feb22f984df602e15f9b891098ff2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622217, "uuid": "c2b8ce3e-6993-4ccb-9a40-2764cc0e0a01", "value": "98304:VhhLmMNcnlFRjkHe4jufIzj3B4cFQXBb9qn:1LPNcnlvwe1eSVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624622217, "uuid": "1018f7de-09e5-40f7-949f-323a8a24051a", "value": 4745216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624622217, "uuid": "53ec4e2e-9f9a-45b9-a09a-75cc431e3e01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622217, "uuid": "8bd22c06-14a4-43e5-a0b6-b251e5ff2605", "value": "d6e512ff4e936549b6cfc16709fc0809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f3572f-d5e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624645715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645715, "uuid": "4246bc83-d57e-4393-af2e-21a134f4d71a", "comment": "Malware payload", "value": "21055d47c30835dcaadca0e9e03efea9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645715, "uuid": "48711a37-665b-44d8-91a0-b2f26bde17c6", "comment": "Malware payload", "value": "3b86abed10fdf64a943950d9effa646258dcf49ae9dfa29e3b1d63d64df361c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645715, "uuid": "b43e4e26-898a-407c-809a-662858eaa332", "comment": "Malware payload", "value": "1436520ba76228c60cd1baf959f267b07e80470f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645715, "uuid": "a837797b-b16c-430b-9eac-543f5323c11d", "comment": "Malware payload", "value": "8ae7fd424305e10149249792f772b3d2b93ae3479939ee2a7329fd044f023001aeb49fe237595081178bee9c1dfd5865", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645715, "uuid": "09ff9a58-0fc2-4c2e-b3d2-82d8e9720583", "value": "6E450200A5A1D036F6B702F858B5D39CAA3A3EF15B6450CB22D5FADE5A392E1DC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645715, "uuid": "6553bfd8-ab52-495a-8b28-d3a714ebddaa", "value": "fa9874ea3b40c6a14dcd08fa8e3175b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645715, "uuid": "2d02473c-f4fb-45cd-9fff-581d125ea299", "value": "24576:u3FTrg+i8clGjsRIz+R8O8pd8CVidRdnHtOE4ccvrzw:cg+i8ljvzd/8CVAtOE4lvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624645715, "uuid": "d656b03d-7fc1-4754-9d57-c5b37e7ec809", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624645715, "uuid": "06fe4f32-a210-4063-9e1e-09d5b78b853f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645715, "uuid": "4ee4da0e-159b-44c8-a5c5-6e97d7e950b9", "value": "21055d47c30835dcaadca0e9e03efea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db1466f-d587-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624606159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606159, "uuid": "be96a501-5090-4eaa-ad7a-ad9d6204f63c", "comment": "Malware payload (RedLineStealer)", "value": "8e3ed904b5b3239566ca0e41cd48910d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606159, "uuid": "0b4c68b9-9464-4373-b45f-9a7346fb5f29", "comment": "Malware payload (RedLineStealer)", "value": "3b8a0e651f85c67f1a987e0d413e2ca21acb382bafe17f69306b30d97bf9bce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606159, "uuid": "133dfe33-28ea-4d08-9740-ce5fade119fe", "comment": "Malware payload (RedLineStealer)", "value": "836e9d13bdc79b9e2138538217e6012601e794b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606159, "uuid": "91794b80-d9e0-410c-a0af-11407185c561", "comment": "Malware payload (RedLineStealer)", "value": "c471cdd51e4134eb1ad7daa0ba8eea0d56ec90d9c664d4a68c9d79271f2fd867357accd01d8063bbad7aac443a872c86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606159, "uuid": "5b26232e-bddf-4e85-85f7-be1ab04c858e", "value": "F804B36733A7C475C1C42230D461CB3B2624CD2317B0B656B1CAAEA7BD6B29D4DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606159, "uuid": "baaefbad-71a1-41b7-8ef4-e2aa1cec0d95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606159, "uuid": "0e30d230-aa76-40bb-b0cb-aba275c7b9d9", "value": "3072:kXA/jGGSmS7o2RqsP8S4G8YgK9iW4040404V:CA7GRd9Ur8gK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606159, "uuid": "ed0dc938-3829-43da-b7e2-c965b8d830f1", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606159, "uuid": "7ca388d8-41d8-4a19-b7aa-2fafa03dc563", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606159, "uuid": "c2e4e047-62dd-46f2-bf03-da6e64294d2b", "value": "8e3ed904b5b3239566ca0e41cd48910d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b8eec21-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (ModiLoader)", "timestamp": 1624602021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602021, "uuid": "5c4e473a-3dd3-47fa-bc98-a47377078c31", "comment": "Malware payload (ModiLoader)", "value": "f83e8b8c1a64305b4e0f62f575c293e0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602021, "uuid": "1fdfe6bf-72a2-44e1-987e-8b5816ccd972", "comment": "Malware payload (ModiLoader)", "value": "3bc97524433efa4870005e3e51ed2dc9e9574448b4dd9c9a6edf6c4674d1c495", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602021, "uuid": "de4f1d7e-a06e-42b0-a6ad-4b54a2eedb78", "comment": "Malware payload (ModiLoader)", "value": "e02dea2aa54947b3bff5c74796a9767c593998ac", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602021, "uuid": "4717ecbd-43a3-4800-bbb5-5e808d22e611", "comment": "Malware payload (ModiLoader)", "value": "12f87bc07c90c80d883126f20544c559db5d59515339e1aef315b9bbdc5bd616a6ac42d7237a57cc454a185465723803", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602021, "uuid": "91e6cb6b-d5c9-43a5-95f0-94f24216ed01", "value": "8C657CE1B75004F1E517763ADC1AB6E5B43C7EE0291498C27AE87E0E3F35782745A06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602021, "uuid": "fa47a409-191e-4abc-addb-d7c41f1dd9a7", "value": "12288:hdd+IDlXMiKYI/rv5zsThfj3lDx4TSVnb7x3cKf/jhgnfPnbetkkkSd:hdd+GtKYI/9wTBVSTSpb7x3c4/jld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602021, "uuid": "3fe28a13-48f7-462d-b1e1-a6cc24455256", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602021, "uuid": "5cabc2ec-cd88-4e66-982d-b29a1ebfab1c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602021, "uuid": "1c180384-397d-404a-bb1a-9c35ed80063e", "value": "Downloads.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b2940e-d5ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624635089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635089, "uuid": "f4c2fc40-153f-47ab-bfa2-f5cb2aeeb25b", "comment": "Malware payload (Loki)", "value": "3ac4b0c4def2fb2bdbe349bb9bd3d449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635089, "uuid": "15ee577f-9e2f-4343-935a-9dba89ba5e73", "comment": "Malware payload (Loki)", "value": "3c4457b1562915fdb6e7ebf49e780d279d0ec132ce52a7ade0936fac334d3846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635089, "uuid": "e55d8b0a-acde-4b75-9ae7-6afb58015901", "comment": "Malware payload (Loki)", "value": "b8237b5be1c06027467ae61aab16884c6ee04e3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635089, "uuid": "bbe73c82-f277-4456-9685-7fc32e143ea6", "comment": "Malware payload (Loki)", "value": "5816c87c8e5fe373bb39d526aa12e7f38cbfc4e3b0f513bb5ac0ddbaad39f430cfb8d2e2ed42cbcbd0f3c96d203dd05b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635089, "uuid": "12fa4c5e-824d-42e7-83c1-20e5792b1e3d", "value": "E045AE993F40338DE853CF3AE8284D08EFD475664307DB5BE1BB2998A75E546EE101E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635089, "uuid": "282d4b58-410a-45b2-8254-c923d2a3d8f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635089, "uuid": "975a59c3-4c88-45c6-bc79-a6850fdda2bd", "value": "24576:wRHn4pBc7O+L2em067r8UVDqESFxK2ji:wN4g7Jxm3kURXSC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624635089, "uuid": "4a55da8f-aa5d-4635-8c3c-4007f570336d", "value": 1202176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624635089, "uuid": "283c0f67-23e1-4de8-8942-96cdfe2ed16f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635089, "uuid": "6d7f5b75-099d-4c24-8028-a812009c7875", "value": "b8237b5be1c06027467ae61aab16884c6ee04e3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d424b3-d584-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624604931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604931, "uuid": "b3de2757-2118-4c98-9553-8a77e98f8493", "comment": "Malware payload (RedLineStealer)", "value": "79df4957b935699494482b8636ad2417", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604931, "uuid": "2f21a891-cadd-42f4-8c6c-3aa95cb2dc73", "comment": "Malware payload (RedLineStealer)", "value": "3ce3b3c69c51579cfcdfdcd19aab403d8a6b53c5c659ca8aaca5123ef5992eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604931, "uuid": "ff91be33-f5c5-42cf-a15a-255c8e9c8d64", "comment": "Malware payload (RedLineStealer)", "value": "62b42789624420c90fccbc77e66cfa15aac7dcc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604931, "uuid": "6e5e5d23-2661-4fbb-84e6-2cc08644c26b", "comment": "Malware payload (RedLineStealer)", "value": "cfe2b0f302b6f9bed6d0bd93435ea0d2b9f0ecb237f7e67a46e7ef8a12ff020e100ed195f3c642828fa2af8f309031ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604931, "uuid": "e6d97870-7d45-4873-8f60-3943bffa1204", "value": "F8949D10F6A1C034F1F712F89A76D3A8A53A7DB16B2450CB12E1EAEE16346E1ED31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604931, "uuid": "38d335d8-5faa-491f-9b69-16b7f29b22eb", "value": "762eb19010c0700eaa21fe941afb9920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604931, "uuid": "50bac501-e591-4881-b8a6-22331f7222db", "value": "12288:n+6MmdQPopH1LtIPeMMMaTsz7aUk6G+P:TMmdQPe8PqMNiZ+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604931, "uuid": "b015b27b-d8c2-43eb-a70b-a880caa8a44f", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604931, "uuid": "5bb2c770-be69-470f-9ba6-6aa2bfeeed06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604931, "uuid": "35643d70-650c-4a48-bb80-f1ac53e890f8", "value": "79df4957b935699494482b8636ad2417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494542aa-d590-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624610124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610124, "uuid": "f45d013b-66fc-4c30-bfd9-dc3517710fb2", "comment": "Malware payload (Formbook)", "value": "2220944d9985a6843374f41b835a9825", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610124, "uuid": "9024ba11-7532-434c-9dec-ad79d382555d", "comment": "Malware payload (Formbook)", "value": "3d5d3eb3853ff82697da75cf6da041f61f72e06d686010a02d52ebaa63ddca65", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610124, "uuid": "3c493f62-cbf6-4845-85ce-ae81981e501d", "comment": "Malware payload (Formbook)", "value": "1929c4c64ea4cc18608eaf6140d1b28fa98d7ed3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610124, "uuid": "9c782a24-1f2d-4d39-9494-07f83165acd7", "comment": "Malware payload (Formbook)", "value": "23467f21996a445b567a037a340841c38cb8689a9b9fd4f92d986f1ba1249b43fe8417211d7cbd51c0e695ab7c15078a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624610124, "uuid": "88e184d3-26eb-453b-aac2-031389026cf4", "value": "F4441227B2E184B7E10497321CBAAF75F6BEDD219E62270717003F3E2EB15DB4906265", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624610124, "uuid": "4f325bc3-3d5b-4c4d-b966-9a505860ead3", "value": "6144:5EtTqjFaFtV9KoA68Atd/Tdle0U0gCKTkn9om07/6s2eD5HG:5E9fN26ZtLlDGCos9ofis2gH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624610124, "uuid": "0f0434c0-c1a2-46cf-92b9-e6274d02ce56", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624610124, "uuid": "fd1c671a-e523-4b7d-a48d-224e92c7b447", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624610124, "uuid": "5518695a-ce99-4223-9a6a-e68e905ccd6e", "value": "2220944d9985a6843374f41b835a9825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a76517c-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651680, "uuid": "bcb17f56-a6d4-47e4-a3bd-4fdabb86f038", "comment": "Malware payload (Mirai)", "value": "dcc18422e2ce8d8f13b718509dcc0cfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651680, "uuid": "c6106725-f5d4-4cbb-953a-28da8142ca9f", "comment": "Malware payload (Mirai)", "value": "3d601b1ef15b32b481f2a68aa6ddcde19330f5c5b9ec824917b7e0dd9607196a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651680, "uuid": "4b9e5ef6-51c9-4319-9b56-6072b44292b7", "comment": "Malware payload (Mirai)", "value": "d0feeb7cfdb963f3365f310e18eebd3f352dfdcd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651680, "uuid": "ee48d0d2-b7c0-4acb-8985-b1d3df7ff306", "comment": "Malware payload (Mirai)", "value": "50f931c6a6cabfaf7650150e550305f9f7f7790c124c5f50dab19fb56e5834d6034a5504a53e45effb4183b3e1a8e386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651680, "uuid": "18a92b24-499f-4caa-af13-406fc3e18101", "value": "3BA2DF1825CDEE72D1B0903EE23CC307AADB47BA62FE713A1E180799E44491AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651680, "uuid": "dd029752-d080-4548-84e9-48794ec43cc9", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbqsIhymdGUop5hXA:YDgoh/DxCvhdR4IjWVFbSfIs3UozJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651680, "uuid": "c496b906-7a40-4ad9-9a6c-bab42a013532", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651680, "uuid": "1797447e-7f03-4fd6-a42b-053cc53bb67d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651680, "uuid": "55b96c36-3af3-4a00-9f43-19191012a8ec", "value": "dcc18422e2ce8d8f13b718509dcc0cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944c9330-d5b2-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1624624853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624853, "uuid": "3dfc4546-a748-4163-a742-87bab7c0c357", "comment": "Malware payload (NetWire)", "value": "22f664c3e1c19b865c64920ed8c9ff46", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624853, "uuid": "3904d0d3-907f-4ac9-8b23-10d094b1c5bc", "comment": "Malware payload (NetWire)", "value": "3f2520949a57c9b6342f6e6a3f13f56c124bddcd576d3a652aa237b6913e3b4f", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624853, "uuid": "fec67a43-7cbd-4fce-a6a9-6ab8109c0214", "comment": "Malware payload (NetWire)", "value": "187a8eab92dad78c194303b2039feefc58c625d0", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624853, "uuid": "cd4bf821-a8e0-43f1-9496-48427e0ce31a", "comment": "Malware payload (NetWire)", "value": "94c6d8225f1b2b0818ae069a365cb6a2b82e30458d78c7cd461cf5d886af6f0460e95ad4cf2b1f2cc7bd604cba891dd7", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624853, "uuid": "ff7bad42-2dc4-45c2-9fbf-f423875ca8cb", "value": "E6315A34541DBA8A7939B3F247504CFA2DEE4C7F29A931501682C93539761C8579C46F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624853, "uuid": "8328845b-2e16-4970-828a-e304e66aaa08", "value": "24:APuQJk8szpTTCJMiA5trEr2keh3kU5gkG2AhqPAtThAgdvs6D9:l15ka5twyZh3kU5gkGZttAgd00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624853, "uuid": "20fa50fc-3b6b-4632-86cf-b9637e64becf", "value": 1625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624853, "uuid": "01e65389-48d2-40ba-a0d9-ecba80578336", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624853, "uuid": "e6d8f121-4a7f-4f99-bc2c-81fb1c106fca", "value": "Report.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076a28d4-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651675, "uuid": "6d9aa55b-29aa-4083-8aa5-6a58425f22c1", "comment": "Malware payload (Mirai)", "value": "af384d89b52c8150514be031a62244f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651675, "uuid": "0a18855a-e71c-4b4d-b31a-0a729cc710ba", "comment": "Malware payload (Mirai)", "value": "4099d3f634ca231985abb007108e79179d2088ca1e174a6d4166728b009dc1ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651675, "uuid": "a42b9cba-6dcc-4158-ad1d-3a8f1a4db275", "comment": "Malware payload (Mirai)", "value": "84778c1392dc810c1ee24a50c514e5390c5357af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651675, "uuid": "cee2bf3c-9b39-40a9-8a53-56a78e9b5364", "comment": "Malware payload (Mirai)", "value": "7423e2bd3748bbeff58138add0516a0b0683fcf2ccec5a28fe470309dcb895015fff56cdda7dd312e198324b7cd66650", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651675, "uuid": "e5107cb6-3f3d-4d79-ae4a-fee631b995b0", "value": "70C2D0DFB49B39C5CC1C5CB825CD5AA116B9A2C7234B9F0837102DCDA67615EB4AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651675, "uuid": "197492a8-4e71-4c91-8f18-56ab5b016c8a", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBrZjWC:oCrJgHiOJrfwmQrctN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651675, "uuid": "30404f2d-0f50-4ff4-94ac-9cac69f3ef54", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651675, "uuid": "0b59f65d-89c6-42c9-afdc-f2e6c1ac03d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651675, "uuid": "18a8ae4c-4935-48c8-9879-425b2f20bcd3", "value": "af384d89b52c8150514be031a62244f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7fbd06-d582-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624604066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604066, "uuid": "c1627a3b-c8c2-4540-b731-c04e83493e2c", "comment": "Malware payload", "value": "748f59361488f147898ee85b30c2a4bf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604066, "uuid": "cf1f56a1-59b6-4d2e-8898-c8e1cd5ed653", "comment": "Malware payload", "value": "41bf00a9af8aa16bf80eedd2057c458707e77c6c40034b4ddd154c8b0bb5784e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604066, "uuid": "841a71da-36e3-47c6-8152-45505bc07fcb", "comment": "Malware payload", "value": "3853e1c80a2f45e31e49e61cd7138be66eb431b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604066, "uuid": "d5a3479d-a296-4359-94a4-b787258e047f", "comment": "Malware payload", "value": "cd5c711c501778d52284fecb69ed5502d8f36eaf76e8fb650bf586aa6d44a51e8e32f3738e45e9856bcaf6a84c913282", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604066, "uuid": "03640985-0c3c-48d6-a98c-841c6abf6772", "value": "A5E43DE920F0362C1711E7AC12317A1EEAA4B71279615FD7AE6C378FBD394007E15DA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604066, "uuid": "bfe07ad1-ca06-48ca-9757-ca56a35cb8a0", "value": "6144:5thJBKVoS2BsGf6ibMLr6DtpWloUY5mgS4boFdBbBO5Uh+jtEgReurGxxOfEWasy:If/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604066, "uuid": "25c1522e-e5be-4107-93bc-f3efeddc1fdf", "value": 713851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604066, "uuid": "f698752e-8c79-4c7f-b17c-00accefa3377", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604066, "uuid": "4ab67b4e-996a-43dd-93b4-748e185e1f09", "value": "OFICIO N\u00b0OCCES19_B98134563.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecdd932-d594-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624611905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624611905, "uuid": "3dccdfb9-68ab-419f-aac6-f13a21a4374a", "comment": "Malware payload", "value": "6056a92738e572ac2810458758074e71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624611905, "uuid": "39fec3d8-c064-4e8f-8508-68da431c3f2f", "comment": "Malware payload", "value": "41cacc02786c6bcfa32bb5c95481b919242f497391758a170f242e8ebbbb507b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624611905, "uuid": "14ce9fb9-4eef-46e1-99c6-6e9c058dea5c", "comment": "Malware payload", "value": "98bed9aa1cc3962fd6f8114c2d5ea7860b6c2658", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624611905, "uuid": "df2c942a-23f8-49a4-8775-537f704b6039", "comment": "Malware payload", "value": "9906a4acbaabe412febe0c908fdd25f077a350288eb384fad05ffa14f9cd34a94726fb5d0d1830d322278c202603dd41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624611905, "uuid": "41bcc08b-9194-4892-bd26-df2d751e6ba4", "value": "A306336127AA6C56EF26077495FFD8F6B9347EC50C20A2436786B396B9334431EC9BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624611905, "uuid": "791f9739-7ae2-48e3-bd1a-2f71451eb145", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624611905, "uuid": "609eb76c-fccc-439f-bfd3-f858c97d7f71", "value": "98304:T/jvjUSaq4yh/jxV/sU9foEMWfwapxIJ64MNxvvrAJOeno3RZ:TLY9mjxVUU9Mowap6hMxvjZ9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624611905, "uuid": "15c9dfcc-b08c-4672-941b-e4d1f7612eec", "value": 3947464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624611905, "uuid": "14f360d7-54be-4c70-9594-44bf32e02552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624611905, "uuid": "f560af08-2f3a-4fd3-a2b9-0efaba0db724", "value": "6056a92738e572ac2810458758074e71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a1cbd0-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624602115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602115, "uuid": "20e8146b-933f-47cb-af72-d9617a17ed46", "comment": "Malware payload", "value": "708cd794fcef03ba0d3c4356204b86e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602115, "uuid": "754f0532-4d01-497c-9dcb-28a1c4564453", "comment": "Malware payload", "value": "42c666fefbfa4d32b8231e0820d29bd9a30204710e4fc08c9f847483d3a68c34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602115, "uuid": "5a2e033c-f946-4eb8-b7e1-3151fd80744f", "comment": "Malware payload", "value": "da8210a3c05796111e3dfea6fa6778679437d472", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602115, "uuid": "5d4670f8-9c72-464b-9468-9ff6f367e8ff", "comment": "Malware payload", "value": "fa534cf0851ff13c5787a294c0374281655e4969bf275fcd03b48c9cbee15e83cb97ca1728004f15f9897c74b1cff4e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602115, "uuid": "04df5a19-26ca-4f08-8872-e2f17a1b53c0", "value": "8EE433D0C50B6806C5BCC33E406AB32961525F32F2D8B7BB953AF5C9C4621B676B76C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602115, "uuid": "e8e8af49-176e-4f48-841c-b7f965022842", "value": "12288:PiUKpND5WBreHEWiEQ0DpKsQaA0Ehzm/6bVGo+/hpXZP88r0zjtu+uB4d2Y:bKHD06biT3j9msVGthp5fr0/A+uB8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602115, "uuid": "a09f1516-b215-489b-aa98-223be5783e0e", "value": 714157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602115, "uuid": "97f3860f-101f-4224-bac6-eff9348db90b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602115, "uuid": "256a8f6d-396a-4f2c-bd98-807953b5123f", "value": "Al Safi 2 Building.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fa748c-d59e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624616371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616371, "uuid": "7de533e3-581d-4e30-a30c-545277be1ebf", "comment": "Malware payload (AgentTesla)", "value": "4f08087e56b8b3d5da9cb72a3883d880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616371, "uuid": "7ebb0689-fa6c-4daf-9ad7-30c6aa3a87fb", "comment": "Malware payload (AgentTesla)", "value": "431bfd160719c61566690f962efbbd9614d0083c258afab14184b185805373a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616371, "uuid": "7961dc9f-6920-4737-863e-6ac1c7722eca", "comment": "Malware payload (AgentTesla)", "value": "c0117c587dc77f64fd354c62a1f1d0f17857b626", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616371, "uuid": "e0c00431-4412-4e75-b588-b5de23c486d4", "comment": "Malware payload (AgentTesla)", "value": "a16e9e8fef7264ef11dae156cefd85338c03b85792760dff80bdb11ddaf7c1833e90b6fd33fa4a4a0eabf8d733cbd6f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616371, "uuid": "365e1753-02c0-4b6d-8ce8-1756609efdfa", "value": "AE441297BED1C4BBD4531770897A7FB5F2FEE30CC152640303661F2BB8632A98A52196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616371, "uuid": "e9e7847c-82c7-413c-91b3-07754bd04c17", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616371, "uuid": "9978a6fe-86d6-426d-8680-e33cfb0a0b1e", "value": "6144:sTqjFoWiUXO+09PqbgXidBI+nlPSDxvE4IBg9fS:sxVPwyLca9fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624616371, "uuid": "026a06a7-f0d3-46f0-8429-4d7e6673b645", "value": 270614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624616371, "uuid": "c44da254-1fa6-4583-8dcd-57c8c9ffa659", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616371, "uuid": "69f9b4f9-35c6-48f1-bc96-f6b809495463", "value": "Dekont20210625_83772666552532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb32692-d588-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624606826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606826, "uuid": "17482348-a8c2-4932-a7d6-7d45ea3376c7", "comment": "Malware payload (Formbook)", "value": "1bc1e23e2e7712b81031b97a96356732", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606826, "uuid": "97f6ebb6-5b1f-4f33-904d-5e7750385e38", "comment": "Malware payload (Formbook)", "value": "432b598b280c8d89802ab7b26e239e9a779048e48704087f3a347962554ec144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606826, "uuid": "60411909-e01a-4523-9742-064f01db0809", "comment": "Malware payload (Formbook)", "value": "0e50bd3079fff410751886dc88ef2e7aec5ca53e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606826, "uuid": "7b41f6a3-7047-46f0-9fae-c88bd258c25d", "comment": "Malware payload (Formbook)", "value": "52f2df2627e6394de10d7c957d6dbf07a0084990b15af83728c3acb0522f08b83f05ce03a6bfb09ff2a2afc2c3571edf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606826, "uuid": "e89801af-7e8d-47c8-8b62-9edd52c2924f", "value": "53C49C273004D97FE333CC7D8809D1657D936E2618A5A51D66D933BE15B232222FAB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606826, "uuid": "8ce09b6a-edfe-4215-8357-0ad8cb4c23e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606826, "uuid": "0496b845-0583-4d05-93dc-acd38ecae374", "value": "12288:i5mL4Dy2vAv2ItTPYGYo0Rf/WeoCATFEW8kNQ/wTal9jLukP:i5n5vAuIZPYGYo0Rf/oCbGal11P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606826, "uuid": "fa3c13a9-aba4-4bc2-9415-9122084f9074", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606826, "uuid": "081d4403-c9bf-4d4e-a41e-693995185e03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606826, "uuid": "083a5ed6-66a0-425a-8f09-19ccefaa3a48", "value": "1bc1e23e2e7712b81031b97a96356732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d91577-d56c-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624594791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594791, "uuid": "43a478f8-e872-4af5-a8af-a4c96bb4b764", "comment": "Malware payload (Hancitor)", "value": "2f25702198b430cfcfebc55fcde9fd99", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594791, "uuid": "ea93411c-092a-4b6f-a38e-806bd2f756cf", "comment": "Malware payload (Hancitor)", "value": "445c89cd435e8ceefd417b4d8819e91d46049b8530350154b7e68ca351fcdb43", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594791, "uuid": "2778c09f-f437-453d-a2e8-157ae4849572", "comment": "Malware payload (Hancitor)", "value": "c3cfe98a8b2deb783c48ced39b7d358e7425a13c", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594791, "uuid": "23381ea4-7dfa-4300-97e7-9323ab2f6a56", "comment": "Malware payload (Hancitor)", "value": "31deccab363e8339fb1bf0802410eb2e56cb6d5ded98e361119031b35d621f742e475ac8b78f1fb2a648395d18aa6035", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594791, "uuid": "f88e61f7-e65e-4459-97cd-f4cc8984cc81", "value": "A225E000B9D1D532DAB315350F65DA96133CBC650F208ADF73D83A1E5F785E2AA30BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594791, "uuid": "008d2f54-b3c7-49e3-8fb2-87482cea7ac1", "value": "12288:xBGIYW4wA74FRrUSJUnKERsY10hYBzSF6G8MHZf5th8NS+LBnl9y/OCd2yVlQSve:xEIZ4wA74D4SQKxZcy8gthDWlCOJERs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624594791, "uuid": "e8062c75-7221-44cc-a1a7-fc3ca5475d61", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624594791, "uuid": "afcf18ed-524a-43b0-890e-5ad2d029e108", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594791, "uuid": "b0f62113-52e9-4d35-bbc9-18a8d25778b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c29ce6b-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624600707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600707, "uuid": "6b306ff6-a4bc-470d-a505-2f7c38a71fc2", "comment": "Malware payload", "value": "e6e2929667893206f076cc1a2c812701", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600707, "uuid": "032615a4-94dc-4379-a869-d37d103749ff", "comment": "Malware payload", "value": "482d9ab00ed580fb333496335f7a46d5154b7b517cc2efcbe725ab13a67f1200", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600707, "uuid": "484f7bd3-719f-4819-9430-f8b15c21d847", "comment": "Malware payload", "value": "c0a232ad19958a81a4ff09166ffd1f09a64987bf", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600707, "uuid": "db378c96-f6dc-438d-8907-1435d99a5dc3", "comment": "Malware payload", "value": "1204339c3c9cdd73189abaf56c05fcffda6e25ce9d653c447207a3b6c84f169b36ad50c4421bd7293efe881da7828c78", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600707, "uuid": "319e43bf-9cf1-48a8-b478-9d4faf1327e0", "value": "0CF433093540F081ECEF191921467B8AAF276EC7E2D5B0ACD672C234F366E325665DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600707, "uuid": "9249e8d3-e13c-48fa-8102-69bb009233aa", "value": "12288:77zKaPt+rRJRF5GcHErMB03kApioOrlcY83MTwZIe6naxlBrYhI/:77maARF5HEn0frvbMCvKrrY+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600707, "uuid": "d4b5668b-4937-4814-b4ef-ad33c6c0e52e", "value": 735736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600707, "uuid": "51e2d543-ba6c-47a8-9923-6832219b8645", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600707, "uuid": "3bff784e-6ceb-4ebb-974c-7752cbd0808c", "value": "Swift Copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fd6287-d55f-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624589145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589145, "uuid": "89b746a7-c785-4fa3-a0f0-723a0998d06a", "comment": "Malware payload (Hancitor)", "value": "78614fa0fafb9ddab273e18611746a7b", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589145, "uuid": "2f4cab06-0ff8-4b80-aaa9-1438f15915a6", "comment": "Malware payload (Hancitor)", "value": "48de6fd1bc6f5b47e4c61d3af2434e153a6b0d55636798311e4a9eafe2db3588", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589145, "uuid": "df18fb34-4229-429b-9a0d-ebec51b41c73", "comment": "Malware payload (Hancitor)", "value": "4e2e6513e695927a882867ae0f8507ef4d150144", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589145, "uuid": "9c6fec09-b5b1-4c1d-b66b-2e4e433e8f3f", "comment": "Malware payload (Hancitor)", "value": "49e91642629f96e91356147edf6dade9ed81ca0a58c43f1a154d8e442f9c6c432b2cf2cc365639dc5cb00add9166043b", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589145, "uuid": "bde22a09-7f44-442c-965c-edb416e974fd", "value": "3525E000B9D1D532DAB315350F65EA95133CBC650F208ADF73D83A1E5F785E2AA30BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589145, "uuid": "0d31c5cb-045c-4b73-80a9-e53f392d007a", "value": "12288:cBGIYW4wA74FRrUSJUnKERsY10hYBzSF6G8MHZf5th8NS+LByl9R/OCd2yVlQSvR:cEIZ4wA74D4SQKxZcy8gthDWWHOJERv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624589145, "uuid": "a9aab05d-288e-43cb-b161-ca29eb495732", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624589145, "uuid": "73fbb3dd-9632-4176-a237-8fce616703b0", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589145, "uuid": "45962bbf-3210-453e-bcfc-de08da83cf97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671facc4-d5f0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651406, "uuid": "2b9885bd-943f-4b9f-ba17-25691fd48504", "comment": "Malware payload (Mirai)", "value": "2663f8389a22530267f86dc8bc389558", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651406, "uuid": "23d92336-e200-4d78-9b03-8f70b834fa33", "comment": "Malware payload (Mirai)", "value": "4a856005b7ecb310e420645ad41786c0ce27b792523f441f1390c0d55f753bdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651406, "uuid": "144f6dde-404e-4ad0-a63a-7b8a8b58afd6", "comment": "Malware payload (Mirai)", "value": "11719e4818a4fa084ca37c72b395ad50c4ab1d2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651406, "uuid": "5177864c-9a96-4c91-bd33-1cb065ffa4ae", "comment": "Malware payload (Mirai)", "value": "e046b522105109bee0931e739895e936bdba7e354037dd40e55ac1bd51d376993515277f7b7fd7a173b583e523ba1fcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651406, "uuid": "12b76d54-8ae9-4b06-be5f-c2966f88c4f9", "value": "56B2E1C5D6FB27C3C2A28332D0BC5A5DE2731AC1074A851E2109765E929760E8BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651406, "uuid": "bf8d1233-3d2f-4b7d-b744-9726e608cdce", "value": "384:MvDKKQOcRpmYLdn6RBOFRFt5rUF81uiSSlCo3AnupVFNqnrrd1NEZgO8UXWozPLz:i/QOC0Yhn6ROHWF09cwNPFCnNBxcW1c/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651406, "uuid": "467be02c-bb9c-4405-a48c-3fdca5c3c9f6", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651406, "uuid": "0f0927be-1539-4faf-878c-137b694219f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651406, "uuid": "33cc8849-6cbd-4fe4-9d7d-402dd6cc739a", "value": "2663f8389a22530267f86dc8bc389558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d32a12-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624601950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601950, "uuid": "8cbed109-2219-4715-8705-7e25a7da3f33", "comment": "Malware payload (Quakbot)", "value": "f022a2159442cd4e16d7fe3dee1d634b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601950, "uuid": "f04ca6d4-fc58-4778-b753-eb506598f037", "comment": "Malware payload (Quakbot)", "value": "4bd593279e649fae847a2b702655c571d7ca9e1949a422fa8d289250aeaa3305", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601950, "uuid": "9e6f705e-f53f-475c-9719-fc6ea2c2330b", "comment": "Malware payload (Quakbot)", "value": "cd4a698d83059462498e48b8dec47662bd2a0ec4", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601950, "uuid": "b7fa9a27-0fe1-4019-b30e-e5e66cc8a0f0", "comment": "Malware payload (Quakbot)", "value": "6dd46a9c461ad9c053ec3ee0b766313932a7ca7e17e7b0e135e7830c5876aac4c2747f9b19b2d00fc2373257391630d0", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601950, "uuid": "8ea9f6e9-5c13-426e-8af6-1b2608130cd9", "value": "4B6422BBE6C159F0C3268E3F96809190C3A5F1E081B7631D47DD3525E31325FB86A6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601950, "uuid": "3632d36d-2ae8-4127-96d4-65ca57b1c644", "value": "6144:97u1GRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZw:97sGRMmEv2Bc/nvm8IKABfsYOmauFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601950, "uuid": "0b89264e-2fdf-497d-9171-9e7718d0da5d", "value": 329298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601950, "uuid": "186d470a-fe54-4856-a536-bd6a592c0f7e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601950, "uuid": "c3c46803-abd3-4b4e-881e-33baa7fdb0f2", "value": "Decline-172917164-06242021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6349c4-d5cb-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624635387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635387, "uuid": "a8276479-ff64-4a24-8592-ae8260208aa5", "comment": "Malware payload (RemcosRAT)", "value": "608a964fa8429da12d23c71c5c88bbbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635387, "uuid": "585cca03-1301-4d11-8cec-30cf4ada2d87", "comment": "Malware payload (RemcosRAT)", "value": "4c11b7fb217b3675e60d659ce0a2c3eee1bdbd3e3ddba1ad6d762878f62534d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635387, "uuid": "492e4781-81e3-4446-8fd2-5ea08a97ee23", "comment": "Malware payload (RemcosRAT)", "value": "f2bf474a22ed18684b2b8362b8fb56fd9c40ca5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635387, "uuid": "266a095d-13e1-45b3-a198-6ede16f9b37d", "comment": "Malware payload (RemcosRAT)", "value": "57744fcbf278ccedf1892a88f363078af39d54b141cfb9ac4fbe4b3a45f9e7bb6c364b492a3d47744d32007bc211f350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635387, "uuid": "ab7bf31d-0c27-40e4-992d-84defef5773c", "value": "67845ABC32A075AEC86BD6BA9EA82CA4EA657577531B9117801301DD9E0DBC7CF104F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635387, "uuid": "7aeb5ace-b4dd-4d3b-a193-466535ff573c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635387, "uuid": "d6a888f3-07db-4ccd-8796-7060a86683c3", "value": "6144:JgNb0I5XFFC3OrmCBXdZhz3jQQBQKxxBZBwq41pw6q0QOALPlmUPaIncl9K9:6D3mCBHtjQrmD41dHQOALPlmUaIncls9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624635387, "uuid": "637b085f-7875-46bc-85fe-0210c9591bbe", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624635387, "uuid": "faec2c41-ba26-434c-89ba-30ed71aa9986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635387, "uuid": "2257f7ab-387c-4244-a3c9-b32aba114a91", "value": "608a964fa8429da12d23c71c5c88bbbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a7ef12-d548-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624579308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579308, "uuid": "8d42fd51-a8d9-44fc-b9f7-0f2d36268e4b", "comment": "Malware payload (DCRat)", "value": "62777003d2b6aabf0c591fb9c7f3ef90", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579308, "uuid": "3fec23db-cfd3-4cfd-93eb-e64b7854a08a", "comment": "Malware payload (DCRat)", "value": "4c224cf64e2b469165954bfe7ed1e8ad88f364e6f7e519f8e250e75044e0fa64", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579308, "uuid": "c8c98266-2710-4486-b914-1ecc778ff851", "comment": "Malware payload (DCRat)", "value": "e211665289918bde2f14ea1c030e19bbd5238afa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579308, "uuid": "e8805302-4dc2-4ddb-955a-c551689b822e", "comment": "Malware payload (DCRat)", "value": "0682592e94a15d128fd1d9f8e6296f650cc431b86a3df0503300eb7eaee9663d458d55c08e294642acad0b3803a422ec", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579308, "uuid": "e5e01e69-fe82-4317-9f9c-084f0029726f", "value": "DB356B223644CA21C0795A37D5EF55180BBCEE017A33DA1B7E9E336EA4613937D1D2CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579308, "uuid": "7a5145ca-5b47-4816-9449-ca7a5e92ca40", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579308, "uuid": "cfa62ae8-b8b6-45f1-8368-339e3415b8a3", "value": "24576:u2G/nvxW3WieCBmsnwJLUIKDpjvHOxKGN+S:ubA3jdNVvHz/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624579308, "uuid": "9225bf1d-d968-4991-b6e2-8934f2ea47e3", "value": 1128204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624579308, "uuid": "baf9f0ef-639d-4ae4-b42a-ec44d242d9d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579308, "uuid": "42bc69c7-fe4f-400a-97a4-8f09f28d1bfe", "value": "62777003D2B6AABF0C591FB9C7F3EF90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b4af43-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624650915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650915, "uuid": "d155808f-f285-4a37-8bd5-241dc0602379", "comment": "Malware payload (Mirai)", "value": "e2abf8b5f1a2b2d8f0bbba65075f4d01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650915, "uuid": "1ea4f850-59cd-4540-9781-fc63e2ec3fd3", "comment": "Malware payload (Mirai)", "value": "4ca56580fd7b9879649fdc536905451845090632e7b87d6493c90208b22679b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650915, "uuid": "0694e407-cfa0-47e8-a185-7a3ac5022ad3", "comment": "Malware payload (Mirai)", "value": "d42440d19378df57f77add2cc822b42f39c55608", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650915, "uuid": "5e828f4a-8f20-4ed5-be67-328ddbce2364", "comment": "Malware payload (Mirai)", "value": "85115f13dd0da8b78321a03d8c0d5aacaef6b857b36b444da3e4f29d909c92d28a8c16dc03f87acd947e3da77093dacb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650915, "uuid": "5578aeb8-e8d6-4c14-ab21-96b0a7f6e9b0", "value": "10C2E188178929E9D2F9C13807B81B6C1DB40F9AF809DC8578F8F7629D8E4743427ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650915, "uuid": "aa5e0fe4-c841-424b-bf9c-1a975e3b0e4b", "value": "768:I2G214DFyosXqgvV9o1ndB08jJgGlzDpbuR1J0:I2GdDgosaaO1ndDVJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624650915, "uuid": "99c39be2-7dd4-4f71-83a8-c43a39805ccc", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624650915, "uuid": "51e2aa8f-06b8-4823-bc61-d1de4cf65ae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650915, "uuid": "d969f3e2-e91b-41ab-953f-1e1889ee55a5", "value": "e2abf8b5f1a2b2d8f0bbba65075f4d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8e87fd-d5b6-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624626695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626695, "uuid": "dde0539b-f51b-4ee9-89d4-d8a7d3438a59", "comment": "Malware payload (RemcosRAT)", "value": "cd98b6bb80429b615bcc3cfa662d6525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626695, "uuid": "e94a3492-e9e4-4918-a909-c8047267b3a9", "comment": "Malware payload (RemcosRAT)", "value": "4d9dc08291e668c87813159323ce24403289454f7618297f72c16fc937026394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626695, "uuid": "9f87d338-223a-4043-b852-1432c6736dff", "comment": "Malware payload (RemcosRAT)", "value": "6822f6ce4a1f5263603966941f377d29a7120f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626695, "uuid": "023db3d9-d04e-4718-89e9-8eb54d0e47fd", "comment": "Malware payload (RemcosRAT)", "value": "20b96c78c6db928b559ed66797a40d92915499e38ee2200a6ec4989f7fb4c430bb862de4a4a5c59d6fcbb48e3a9a0ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626695, "uuid": "9ee27ffd-9c2e-4293-96ca-4ca603bc3fc6", "value": "E3159D0123D4EB18E53E5B365AB9801893F5B50ADB32CB1DEED504DB1E23B928B1B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626695, "uuid": "55f81aed-307b-49ea-b60d-30967424e298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626695, "uuid": "57fad087-b5fc-467f-80a1-dc68afbb5203", "value": "12288:txnf2GNGZR1XIZbrxtVOIkYBRCps8W0mfXVlS:/DwZbYRFtV+YBRCK8gfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624626695, "uuid": "bb906429-653a-4db2-9540-f80b560feedd", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624626695, "uuid": "1cef1230-bf49-4294-ac09-d040cd1a24e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626695, "uuid": "1e38f364-3080-4866-85a9-d3ee4df1d6b1", "value": "REQUEST FOR QUOTATION 2993874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8031c8-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkComet)", "timestamp": 1624601733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601733, "uuid": "73cfe8fe-3e5c-4247-92f5-29561a4ebae2", "comment": "Malware payload (DarkComet)", "value": "7e4e387381eb7eff16c3a6af019173ee", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601733, "uuid": "6bcbd365-093a-4f2e-bcb8-2879c2391aae", "comment": "Malware payload (DarkComet)", "value": "4e5add107e83a073bd97b795409f41a1e0d1b26b8ebecae38f2e1f805a8cdde6", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601733, "uuid": "d8b2cf54-5013-455e-ae02-de1cc5874b0c", "comment": "Malware payload (DarkComet)", "value": "7d89c0afae3556c07d885bd6de630879e87aac08", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601733, "uuid": "919f4936-093f-4641-8b3a-1b05bff8f513", "comment": "Malware payload (DarkComet)", "value": "792042592bd7afc336d390ffc0d8e6e4b384d9d48db90e93e3119e70cc66edf424dff03836c66587f697de63b534cde4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601733, "uuid": "926b0d69-5ebf-4c8c-b35d-dd3976b7a6d1", "value": "4F6502303AFA9819F277BF35DED86095CABEF6633603D96D6895138A4503B02DD814BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601733, "uuid": "20dd42b8-473e-487b-b707-306988a14b67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601733, "uuid": "b74a295b-28fe-4712-8260-54fd0175ae24", "value": "24576:hnzhEp1PernaSqDGZWw/gnX5sPJRHnHWvu+XC3o6bn7exOzb4Sacmp:9zbrnBqpX5sPJKu24Lb7pzb4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601733, "uuid": "3fb8406c-eef1-4245-8093-ae80301d5f47", "value": 1517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601733, "uuid": "963b887e-4cdc-444d-8ae5-27b364f98fc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601733, "uuid": "dcafaeb9-34d0-44b5-b99e-54645a95be60", "value": "requirement-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d8e4a0-d602-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1624659353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624659353, "uuid": "95434e3b-9cc4-4ed1-b598-a9684f488903", "comment": "Malware payload (Pony)", "value": "48079f97b10815f3a20dcf8dee6f02b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624659353, "uuid": "5de814db-0330-47cd-94ee-749debab3bf8", "comment": "Malware payload (Pony)", "value": "4e6e8af35dc6de0e3c2014c722004001dc3cd99dbdbbbe4d460b77d3644d8a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624659353, "uuid": "5550b450-8175-48f2-95a6-83fcfe8d725d", "comment": "Malware payload (Pony)", "value": "ac4c229e4f6ce15e38818bab89e81ec0074b1c57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624659353, "uuid": "058e9d6f-7d81-4b34-8c7f-f498f22218db", "comment": "Malware payload (Pony)", "value": "2659b435415cb6f698cbad96e895d41a4daa8a7dec8c338faa2e7ad604770fb6d92b4cb6c3f4f8dbbd77533dd0a6a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624659353, "uuid": "0e0b38ae-8caa-4aa3-82dc-04933ea45b7f", "value": "5ED4AD1176B0C431E2A2A1B04D62D776A1F8BD705F3186EB37E43F3D2E756C15A3829A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624659353, "uuid": "fd101e53-4f25-41df-9d5a-ffa67e8ebea8", "value": "4ae344b1bceca5441ec1eb70c6344009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624659353, "uuid": "28747320-92fc-4f63-b68c-537266be4246", "value": "12288:jMnNvef/pSC54I1naMMVu2T85N46Xv6EApoy0F:jMnNvOdd1n/iu2w5N4Gv6VuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624659353, "uuid": "5b93ec50-9dc9-4186-a02b-e376f37acca8", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624659353, "uuid": "3bd3733b-7ba5-4711-8f23-8d9623791905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624659353, "uuid": "4bcde167-c339-417e-af50-6f0fdcb25150", "value": "48079F97B10815F3A20DCF8DEE6F02B7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90c8c56-d596-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624612942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612942, "uuid": "15be9db9-2ffb-4ebe-b960-be5f75b7febe", "comment": "Malware payload (Loki)", "value": "7333160e223353c997358d1e7fc689d5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612942, "uuid": "94896a84-d79e-4507-947f-43376c48c56e", "comment": "Malware payload (Loki)", "value": "4f7b8c29006ef83433912fc5e138c4c970d8a70fae33dd7a73647606ffbd0579", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612942, "uuid": "b4fa58b8-d55c-4f99-9390-80cecbe44ce5", "comment": "Malware payload (Loki)", "value": "0a1f31197b3b50b06d9fc5271133d5d489e0fce5", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612942, "uuid": "4a32728c-d30d-4580-8233-c6ce2b6e895c", "comment": "Malware payload (Loki)", "value": "5c1886a1df446cd2ae575601e642de23c3aae632eb3aee5c10856c66e5ddf56df479491c25e5ac4ed4301f4568fa79a1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612942, "uuid": "59b0736b-6f09-4294-9ecb-500e465499e5", "value": "FD351202AE95C90BE45DF83D17037E892174BDE2325D8387A30E7AB9687E5104C6DBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612942, "uuid": "f55e7fbf-c49e-4a79-b89d-1223734edda9", "value": "24576:w23gzHeclAmJTMwK9iXw4s5a1IaqaNdUPESzcZeorKyV1yr:X3gzZl9JTNcQw4s5M+aL3dZTBV1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624612942, "uuid": "9c92dbfd-4d66-4314-b872-a029cbe03410", "value": 1150584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624612942, "uuid": "aebd14d0-ee10-48c8-8f90-91a6d98f3d52", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612942, "uuid": "06047068-80ea-481b-8492-8338d7d8a951", "value": "PROFORMANew PO N. FM 24062021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7210a08c-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624617924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617924, "uuid": "e838e1d8-3fe6-4129-af61-3a30a857a087", "comment": "Malware payload", "value": "88c7bdd9bfd7da38eb90f18f203c71f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617924, "uuid": "881c3599-c5a3-4b51-987c-7d99e3e86804", "comment": "Malware payload", "value": "50a65c497c8306ba179deb6e97669ed6e7b18b994f9008bc1f878c4617407898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617924, "uuid": "2f2aae00-f212-4f17-b246-ffc8da85a561", "comment": "Malware payload", "value": "7ec308e040741935127812958125ee781d930876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617924, "uuid": "4d3b8057-51a3-44b7-a1bf-516293d9653d", "comment": "Malware payload", "value": "038c067003422d793c3b09f73c975001f5ffbd2e39bb67dad5f422162714ca64224ef8d7c9d0b199bbdd4d20b5d3b029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617924, "uuid": "7a3ece3b-b8df-41c0-bf18-14b6a488596b", "value": "2B04B12733A3C472C5C42230E461CB3B2668CD1717B1B65AB4C9BE67BD6B24D59BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617924, "uuid": "2c1975e1-84ec-4e4d-b2ed-9b7291cf93c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617924, "uuid": "2a78ccad-f7ac-4809-b3b1-2ea7cb8c6968", "value": "1536:4EQ/naf4ilc3ZEyfBBxr0/+0J83e9t5vOYc/xfilVYup85EXHnxGFjRZVivohaW1:JQ/Rilc3GyZBNR36H2NQq5E3shsWwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624617924, "uuid": "3e62fc68-0921-49fe-a3b0-d84a2b93ceeb", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624617924, "uuid": "51b49678-1d21-45ac-9099-e1610116eb41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617924, "uuid": "276af704-546e-49c2-b8c0-d9533a707018", "value": "SecuriteInfo.com.Trojan.MSIL.Crypt.gen.14524.17382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fd0abc-d55c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624587896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587896, "uuid": "5a20bd8b-e1e8-4035-b126-53da4d33198a", "comment": "Malware payload (Gafgyt)", "value": "2658fab624e4951cea61581e9c1ebeac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587896, "uuid": "cfde9429-d9e7-4aa8-8cfc-67aef77ba6cd", "comment": "Malware payload (Gafgyt)", "value": "50ce10493ff4c1aa71febc64ae4536f581b29e9f45612e7063eabd76ad9d9533", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587896, "uuid": "5c028e36-782f-470f-97c2-977c59853d99", "comment": "Malware payload (Gafgyt)", "value": "761724076f92b74f8c3733657abcd56c4fe19d48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587896, "uuid": "59bce7a7-fb5c-40d4-abac-71e6937c104e", "comment": "Malware payload (Gafgyt)", "value": "94802279ea966202b9ced6e295c5b493b6246cc5bfe99382d97f5e0187e3f48d542d7f30fe4e08d146cbf688c5c2f454", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587896, "uuid": "dbbff7c1-f281-4d91-82bf-591d2fc60301", "value": "6913F124B482EF77EAFD7032873544D6A9138F72E4F23299D9100279B60CCCAA29CD43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587896, "uuid": "f320d67b-453b-466c-8418-3301801e7870", "value": "768:4E2ty7Bwxhz1XOxIevIspmaNtYYklo+xPxs13s3Uozdit8O+I+fs/:4E2QGxhc/Bc0yPlHxoqzwlP+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624587896, "uuid": "7548fa39-7a0c-4547-8353-e80fd9cde0e7", "value": 42388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624587896, "uuid": "221b6332-4f13-4d86-95a6-04ef98dbea77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587896, "uuid": "5ca3f970-36bc-45ed-9d3c-1fc2eea385f4", "value": "2658fab624e4951cea61581e9c1ebeac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b5a845-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624600716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "fad2b682-60b7-491b-b22b-f8634b28c5b6", "comment": "Malware payload", "value": "94171af3b276980b26cce6150567be72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "3338ace9-8031-4b54-a640-231ddd7324e5", "comment": "Malware payload", "value": "5148e1ab51baedc4ab906f37650d00152d50710eae57ca3d20f9d5919b1791ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "f4988593-3552-4c44-9dd3-fdcf3de8bde6", "comment": "Malware payload", "value": "4228bbf270302d69367996dfe69c37f6235298c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "75aaf2bd-fa3a-48d7-be1e-3df46393cf64", "comment": "Malware payload", "value": "757b93aeff3cca81c55cf80643f85a58ad36a76000b2b92fe1ce2970aeb4a42062ed2110340e241ff7bd928889d9ba43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "21398b61-e050-4b0a-8edb-0c81008ccbdd", "value": "AB05017613896A6BD1BC92F8802809418BF9E1E72763E6DA3FD110ED90DAFD4177470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "f507ea40-b5d2-44bc-8abd-abdbeb598b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "fdf1d108-0f3c-41c9-bf0a-3a56e3fbf626", "value": "12288:6fcNakPWOi8iVJBwcfxKMAAEDUqKzKehxsHcpd9xGV2k4oF/F6gdCPROyobJM2h6:TLE1fKAMU3zKqxogIE86gdCPROy8JlkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600716, "uuid": "16d4fbf2-3294-46b2-bc16-9a567f175308", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600716, "uuid": "434e6b19-0e65-49d1-acd9-6e605a3dc069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "e9acd0bb-1126-4618-9545-38e5e04d7d49", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a2a99c-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624642572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642572, "uuid": "b9cf4fe1-04dd-4a2e-ada9-3662b6319ec4", "comment": "Malware payload", "value": "fb8209a4418739a9b0717f8f78afbf2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642572, "uuid": "5bbe3ca8-f3b4-49e3-9452-f9abdf9e37e9", "comment": "Malware payload", "value": "53556c2a8da0be7e0b11b625e532e0818f6f633cffdb38b80f40d488f5f3ce0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642572, "uuid": "f526555b-bcb7-425c-970f-96eda485d205", "comment": "Malware payload", "value": "82db95620747cdddff18034d4607b8cf050e61ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642572, "uuid": "c7af5b46-076f-4cd4-872e-8d1a9fcf80a9", "comment": "Malware payload", "value": "4dfb778bb712fda675a1779aab26892919db2a580aceffe8dc14897048f1fec39eb7f811387447714a007cca079fe41e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642572, "uuid": "2cc9a4fc-56d8-487b-8f18-220bc9b72682", "value": "1E230191E04BCB39D7714D358CF300849381265FB4BD3657279BA1C0A8C3D679AF2A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642572, "uuid": "1d0056c8-b547-4a12-a85e-eff3ca047247", "value": "768:CDY4+87cRE878bCI09o4z4MfzMXvkanlN5Y23q3U7TOJgKSOtn9Ls9DKFhN:CEqf87sCI0e4zbfCkKFrarnoeFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642572, "uuid": "37bd5bba-854b-4ee1-94d6-77b0d6ae7d7f", "value": 47992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642572, "uuid": "8a5733ca-9dc2-4a20-ac7f-81098af98b21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642572, "uuid": "a66e90f4-f0bc-4112-a1c0-99be10069a2b", "value": "fb8209a4418739a9b0717f8f78afbf2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7b48fd-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624631606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631606, "uuid": "0d33abed-9883-4a89-a4f9-2c544d48b369", "comment": "Malware payload", "value": "f6b855e540dd705c6a2a85e33bd6a62d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631606, "uuid": "7e1cbf6d-74a2-493b-b5b6-efb401045013", "comment": "Malware payload", "value": "53994409091ef3f8a6c4b76bd0d23e71f04688a4684e4b61ff2ef8c0f48b9677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631606, "uuid": "dbbb7435-8236-49ac-bfc1-fbfd1e9cb405", "comment": "Malware payload", "value": "239abcecbea22f22c917a0491257109f4db497c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631606, "uuid": "a9ed2c12-c920-4639-bdb1-0ba4730b12c6", "comment": "Malware payload", "value": "04fd0fe2e23103cd7e730aab3f332cb880a2bd462d239110e82c143af3b0887aab742bdf2da8a339573a435c3360ef91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631606, "uuid": "fa4939cb-61f1-418c-a89e-a2d2dd985202", "value": "7903E1D7E50C85F5EFB015A5EE3B4043914A2CADE8889022B7A0407F1EE22F5BA9D5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631606, "uuid": "35791429-38a2-40ea-9f2a-80615f2be3bc", "value": "768:DkJ56p6b4LMXOPAppDyVsgrgepgy52Q8Lw956eKpNeq3U7Vy:+4p6b4Q+PGGVsgrFz6w956bpNKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631606, "uuid": "780dbd2a-ddc4-45c9-9af6-8ad7a20265ca", "value": 40876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631606, "uuid": "2646b103-0c34-4030-a69c-35888ac6eb18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631606, "uuid": "cd3dbecf-4bb6-42ac-9f15-338293716c5d", "value": "f6b855e540dd705c6a2a85e33bd6a62d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71178393-d5dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642833, "uuid": "e91e4ef4-d2d6-4363-92ba-92dcfa443a6f", "comment": "Malware payload (Mirai)", "value": "9666be1f9171386a18c7669f66536041", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642833, "uuid": "e81319d4-2a2b-4649-b58a-687bdc9e0754", "comment": "Malware payload (Mirai)", "value": "54bd326749c1ff693d0e862d6c4814b6e6bf8aebf079c9fad21ae6d6203dc581", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642833, "uuid": "109eb27d-fb9b-4da6-b3dd-a11c622c97d8", "comment": "Malware payload (Mirai)", "value": "92b222502f641ec0db65abf62fad8ce8b8d4f496", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642833, "uuid": "fb12b948-effb-4b30-9490-994114d61478", "comment": "Malware payload (Mirai)", "value": "ac05acf58f93fb423a34d1fce5acf96d4db18f7440bea26449446fab65f3cbcd909e94f596ae5bde454968c3d4b817fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642833, "uuid": "afa4524c-184e-4fdd-9862-a47970971d56", "value": "1D131A8DA8012E2CEDE65CFD54636F49DE516211A0E70B0FD7AEFD832C33269AF05598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642833, "uuid": "e81c1709-7d11-4315-a471-d1e4a1d8376f", "value": "768:1xpPtHthviqD21PeSCEMHton86xKhJuphEXqrMesBQyG3XmY1g8+emIXGlx:/pBPvxD29wgMlQyE1gtem3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642833, "uuid": "14cdf6a4-998c-4797-8ce9-4dd0ea0d378e", "value": 45456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642833, "uuid": "8bddcaca-3cad-44bd-9e8f-ba267bfcbe9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642833, "uuid": "ae121226-52a8-4ab2-83c6-a0186b236499", "value": "9666be1f9171386a18c7669f66536041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05799a06-d582-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624603997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603997, "uuid": "9a9bad26-6322-4d42-bc13-76faa54de57b", "comment": "Malware payload", "value": "a98227ecc9a7b47816587d52d7759e46", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603997, "uuid": "c6f5a904-528f-41f9-ac8d-74e95fc220f6", "comment": "Malware payload", "value": "558f07ceb8134e978b51fc18d4217556da7d6ae8c77d9f94c8f5579231f0054a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603997, "uuid": "deba94d4-b633-4e99-977d-dbd632f6035b", "comment": "Malware payload", "value": "3473ae74414fd62dba9c01f8bafe5c026467cad4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603997, "uuid": "160bc8f7-16b1-449d-b309-b2bc9003eeb0", "comment": "Malware payload", "value": "e3cdeb7dddaab06c327ceae2196bb346226b602041a4b17a9fabd5e9292dd94a2fb593f10fa9e76db5344110a920162b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603997, "uuid": "ed123560-05ca-4799-be60-e6580ae897c6", "value": "C39557F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603997, "uuid": "b7cddfc1-3312-4f33-bfc1-4c72fee51869", "value": "12288:QLGZ3HciJpPfQ5Q48Fr8jzOpbXW84abtMCF2XdO/hTtGL6oq:X38iJpPfQe4ZmpbGs32XdO3GL7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603997, "uuid": "12edba16-0464-4257-922d-c3a589bd38fc", "value": 1877532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603997, "uuid": "7f51cc82-96f3-4d4e-b42f-0e037f9c054b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603997, "uuid": "729c4f0f-14e0-4714-b74f-d1d142456904", "value": "order-0798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f03d80-d5d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641222, "uuid": "7fa10643-7fd0-46a1-9a3c-591d6cfccd50", "comment": "Malware payload (Mirai)", "value": "906c341a55012442e4c0a840c74ec677", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641222, "uuid": "2d574ef1-4ada-4169-bb6f-920559c52b94", "comment": "Malware payload (Mirai)", "value": "55a20fc8efa7b7b1096b0dc593fafe8bcf1ecf781938368566159b86c57c78fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641222, "uuid": "e38800c0-eeb8-47d5-87bf-866b9822ca4d", "comment": "Malware payload (Mirai)", "value": "43f187ee79795c549b21a0c7fce257648716960f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641222, "uuid": "6d4d8521-2205-4f77-bbc0-c33efc2fc0a5", "comment": "Malware payload (Mirai)", "value": "03e00e72c43e658eebc98cb31aafaf5f5ae08ceccc45b70b5f1af2db2b95c8d9c01cf397a78f05afb65566c8d4c7e916", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641222, "uuid": "1143ea98-818c-435c-9064-c05f6c83c100", "value": "F52302432093BA03E03058FA4562CCCDB51AAABDB1BFB7B625484E154C35D93ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641222, "uuid": "90bfcd5f-c1ef-4517-af40-92646c86ec4c", "value": "768:lK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF39q3UELWt/iw+kvBGg6+fYtrBHg:N12O1LCNguovDPH7TcrsLWhiw+kvBGgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641222, "uuid": "0f2717ce-2929-46d2-b37d-6aed661d8a4b", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641222, "uuid": "76c11118-c2ac-42c1-a361-462e385b7159", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641222, "uuid": "598e6c98-4465-4527-b7e5-8ee77611c5f3", "value": "906c341a55012442e4c0a840c74ec677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdd46b7-d582-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624604116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604116, "uuid": "898a4acc-b411-43e2-8dfa-a1800e8e478d", "comment": "Malware payload (AgentTesla)", "value": "0f61e1b3c8bc41b0bf00f7465478ff4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604116, "uuid": "c041513e-d082-414d-a937-e07a3308fb32", "comment": "Malware payload (AgentTesla)", "value": "55fa1cf43d84180027b7019aed913df80a697b1f328565d210ce5a024c3e2e09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604116, "uuid": "2816e61c-05d4-40f8-9d0b-bfe2bc70631f", "comment": "Malware payload (AgentTesla)", "value": "9122657538a00db31d8aed2fdc37ece60b5ed7ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604116, "uuid": "bb88a6e6-3856-4dab-8df4-074724951c96", "comment": "Malware payload (AgentTesla)", "value": "5b1988831df96c74d202d5359ae6134ff34dddb2b3d0541beb4eb433d639cf022fa585027f8f050c90a8d77371c9f02d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604116, "uuid": "c214f519-ad3a-4db0-b12b-27558759d383", "value": "CDA423261772FBA4D6480248E7B006BF608B43C6DAFF6076F35191C9D84C56DF3A93A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604116, "uuid": "cf3eb39d-4548-4f40-9478-b4aae032fa67", "value": "12288:nJ0pXhxil4N/PBJLuCUtZQV3kZ8mBfGuZ3MyHSjptv:J0pXhxiCPfLuFwkSYPNM0ODv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604116, "uuid": "20881623-715b-4a60-86aa-e0b954b947e8", "value": 470385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604116, "uuid": "cb1d8563-a68a-4ad7-b6e3-5ef2c8f3b06a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604116, "uuid": "eda9dc7e-9c54-4947-99b8-e97bae7a0cf2", "value": "SHIP\ufffdS PARTICULAR.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7dac21-d58f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624609812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609812, "uuid": "c31da398-89d6-4535-a802-f088f8aca312", "comment": "Malware payload", "value": "1c3fc02d97203bed116e14f89beece04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609812, "uuid": "aaebf7cd-558e-47a3-a9f5-54d4c0656582", "comment": "Malware payload", "value": "55fbde2524b2528af0d6ff6e0bb1b017b2fb70451a29e952d7c1874b5deb9d9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609812, "uuid": "c2883a0e-5f20-4e9a-9208-9105eb6d87d6", "comment": "Malware payload", "value": "205a3e95dac6faa874ebebf44de55030f4663a48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609812, "uuid": "d67792a3-faa8-4939-946b-061ce57253e0", "comment": "Malware payload", "value": "361285cbcc2a46babf37450ea8fc14b0899e127dad21e37d9e51bd5a721a7c85dffa380363227ab3f87135de9b2eb8f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609812, "uuid": "0ec61e6e-0fd9-473a-89bd-b2b4f0fcb40a", "value": "E904B22633A7C575C1C42231E461CB3B2328CD2707B4B646B5CAAD5BBD6B68C4DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609812, "uuid": "bec85112-d30c-4724-a295-2b0dc29bf850", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609812, "uuid": "b1b67be8-54f4-4e7a-9bd5-f399ca75dc9e", "value": "1536:dKHGzgue/8GCSeBN6c1smR55hxaXzGRlhqaHivN7pWxqADoz6Cf4/4/4V:kiaYF1Fh4zGRl6EJW6a4/4/4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624609812, "uuid": "02ed5ba0-ceda-4376-bfe8-b48c839f7868", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624609812, "uuid": "873aecc2-246d-4d40-977d-8f429c88af0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609812, "uuid": "1dc3550f-af2a-413e-885c-ef4f1cf5c903", "value": "1c3fc02d97203bed116e14f89beece04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd722796-d605-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660624, "uuid": "1ca669a9-5a64-4d41-98e7-15cae41e93b6", "comment": "Malware payload (Mirai)", "value": "1bde3503290d60d467c4fdcad6f13deb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660624, "uuid": "c6011af7-1d9c-41f0-8000-f58c748ef982", "comment": "Malware payload (Mirai)", "value": "572c89de92d2cfe1e33618a9141a0f7ee1fff447f0b3dec58427c78ff03b10c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660624, "uuid": "a38a689b-b036-4fe9-b148-3bac6b558d2d", "comment": "Malware payload (Mirai)", "value": "0ecbddbb52d18fbea6e76d215d050ee1b8ade476", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660624, "uuid": "fb7637e1-32ba-4464-9e8a-d35934e2bd82", "comment": "Malware payload (Mirai)", "value": "58641c709926f2ac589991194a9356768fdf2b818c115edf162938101cbb2bb8359d9b9760b455f499fd0363b7e6334f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660624, "uuid": "34f4aaba-8d44-44c2-aa25-4dd90eaf4ff1", "value": "C713F2179DF19A79C4AF72748AFFF70B2900F4BD35045BAA54D038121C29F366A14AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660624, "uuid": "1a7212ba-eaea-4fc6-9ef2-f5d7183ebb85", "value": "768:fW7oqFJHG4FZ+gRgeX/wxd0IqFFyK9HAB6XoderU6y3NTMPDnbcuyD7UHQRj4:fWO8Bge/wX0FFV9z4JX3Z+Dnouy8Hyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660624, "uuid": "205e8291-b0a8-4168-b7e0-ab00c8056729", "value": 42376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660624, "uuid": "d623d4a0-579b-488c-a3f3-48843b3ef0b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660624, "uuid": "60a12bfe-78ab-4ff7-a983-cecfc131e50a", "value": "1bde3503290d60d467c4fdcad6f13deb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b7965c-d5e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624646196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646196, "uuid": "98dfa441-e276-4ba4-b12b-b60697046c43", "comment": "Malware payload", "value": "83d5b25a4413fbf2460d42d4ba6adee2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646196, "uuid": "8ed51f93-eb40-4b81-8513-577a48d26e34", "comment": "Malware payload", "value": "5773fd214b8cb2cbc8a3ad95f4ab9cfadf011c4a823e1cfbb389b1bc1852f081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646196, "uuid": "bd43205e-5dba-43bb-9ebf-8a6b29eb0f06", "comment": "Malware payload", "value": "7983c391402adceefa13970da43cf2447827486f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646196, "uuid": "4bceb9d6-e983-4894-81a6-223c0a3f85bc", "comment": "Malware payload", "value": "74d2cfb83c7a29406600d6a870bd07f1241440a84cab927b1b996d92a347bdc96e9e8d1211eda14e5f8c3b38fbb00089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646196, "uuid": "2b8227f0-90d5-4eec-92a6-576fd39fbdd1", "value": "1BF4F18837F88F63D1BA47F956A5640083F97A3B663AE5491DC330CA06B5F004E95F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646196, "uuid": "8b30a279-3aff-4d02-96e3-df5eb3fed67c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646196, "uuid": "ff0562a8-a956-49e5-a05d-8e31bc2ea58f", "value": "12288:K6097AnrMYczBQlUfXH3ZU7hDtTEJ5W3iHuwICYPMnsdtojP3UOEbbZvXbTXBUv:K6k7kXgBwUv321DyJgE8CWvcfUrZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624646196, "uuid": "56a1ed03-76ff-4632-9187-4570796bd767", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624646196, "uuid": "559392ef-894a-45dc-9f21-38676aba5162", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646196, "uuid": "016d937b-106a-437b-88c8-3c4eadec5242", "value": "83d5b25a4413fbf2460d42d4ba6adee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71caf30b-d552-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624583563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583563, "uuid": "ea4b67c9-bd17-4143-9837-5588ef239c57", "comment": "Malware payload (Hancitor)", "value": "4264d32a86490e7a981bb4351504e0cf", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583563, "uuid": "f9304ec5-937e-4fe8-b558-d768c67e8355", "comment": "Malware payload (Hancitor)", "value": "577743f3ecc1e38fb9d0d81b7190a49c51f17534c60fc7648cf6a8c754fa80c9", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583563, "uuid": "8256d918-6731-49d0-8962-104e31258640", "comment": "Malware payload (Hancitor)", "value": "efba29a44afe3e1977e84857b68976cc4ba4bef4", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583563, "uuid": "885ae40e-a731-4205-8bbc-9e78bae3d2c0", "comment": "Malware payload (Hancitor)", "value": "9dfa2a0fc5c03ac61e67079f8311f97965137f0b95687f790c3ba03a874b64d8aa5a552a93e692fc31dd63fb14cd605f", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583563, "uuid": "9b29a91f-84ba-4067-aad2-63591b9d6fde", "value": "1225E000B9D1D532DAB315350F65DA96133CBC650F208ADF73D83A1E5F785E2AA30BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583563, "uuid": "d8df30b6-5bbd-43a6-bbdf-db1fddc0635a", "value": "12288:1BGIYW4wA74FRrUSJUnKERsY10hYBzSF6G8MHZf5th8NS+LBYl9o/OCd2yVlQSvj:1EIZ4wA74D4SQKxZcy8gthDWIsOJERx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624583563, "uuid": "28589ce9-68f7-4e60-8ae7-a5730234b03f", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624583563, "uuid": "bc35e0a0-1988-4891-9a06-18c663bec04d", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583563, "uuid": "c5b72ead-1d81-4410-9115-e0d69c5992d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e3ae85-d607-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624661418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661418, "uuid": "75943582-976b-4db2-bfd7-a54eb3289451", "comment": "Malware payload (Mirai)", "value": "eb28e752526fb587a1c0590af4d3310c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661418, "uuid": "a108196a-5540-4f65-84be-9441887e1d39", "comment": "Malware payload (Mirai)", "value": "57b20008f6c7bdf56efb208ce0e70e54cb7b15026ed0e55a61f71e64675c901c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661418, "uuid": "b1ea13a8-570f-4b9e-819a-8475089d1132", "comment": "Malware payload (Mirai)", "value": "b407600189dde4761798966f25fc76ec79dfa788", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661418, "uuid": "583f18c2-1d03-421d-b32b-be90c825251b", "comment": "Malware payload (Mirai)", "value": "35de7b8d64908b780e152c4657ae89aac077fea2bb5b65bc5e5629d11ea83193c43d6c91d4cba02fd707612b6b21152d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661418, "uuid": "0a7ea43c-c1ca-465b-a3c1-e298fa2bb0b8", "value": "94A3D60E7E259F7CF7AD823547B78E25965433C626E0D680D2ACDA101EB024E641FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661418, "uuid": "c61889cf-24ec-425b-b441-e086066a524e", "value": "3072:vxOwQO1cEMBEPidqW4sgEEUcwRI1u4kXLpWsj:pOwQCKFB44RDIg4oPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624661418, "uuid": "5ee5ef79-4e3e-4259-8a36-49c4f2e5e248", "value": 106804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624661418, "uuid": "333af9b9-5365-4269-bfdc-a9724892081c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661418, "uuid": "1cd68b71-ee28-4a28-81ff-402cafd84ff8", "value": "eb28e752526fb587a1c0590af4d3310c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132af02f-d5f3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624652554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652554, "uuid": "bbeb6e73-9488-4a5a-a0ea-f3841bdf3d74", "comment": "Malware payload (Mirai)", "value": "5479380da178a8e497a48af69f1f0a2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652554, "uuid": "e2ce7328-3399-4250-a6b6-a2a4fa4ba897", "comment": "Malware payload (Mirai)", "value": "57b2b8646993b557d1b7f9c9e29f05d3cdd8bf646a8109902f66d385639e0f53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652554, "uuid": "a1e99913-4120-42d1-a4c9-99f86af44447", "comment": "Malware payload (Mirai)", "value": "222da23e4c185c774068d42d36cec7a342ca725f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652554, "uuid": "14490faa-ad91-4191-b45a-3dc484c01e98", "comment": "Malware payload (Mirai)", "value": "d3950a04998b14ecb46fd3c468be011b4efb75210db32e5b03cc450abf61a0fa4b3ce18109fdd835e64db1f5b2bdc784", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652554, "uuid": "b800fe41-6b65-4aa1-9fe2-f99b68744b56", "value": "5E431925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652554, "uuid": "7967c2e6-7db6-40b4-b068-d2bf402a25e8", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDS:eL0AxvSHfymp0xgunvCkV6vTMDauV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624652554, "uuid": "0fbfeef2-7cad-4dfa-849b-bc4323b459fa", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624652554, "uuid": "7b98519b-761d-46be-bc10-d3cc86bc93a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652554, "uuid": "7457621e-4e71-4f6d-bfac-b22b46d909c5", "value": "5479380da178a8e497a48af69f1f0a2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4cc17a-d5b3-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624625160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625160, "uuid": "3efbf52a-b386-4100-b593-59b64f732506", "comment": "Malware payload (CryptBot)", "value": "b44f8498263ae15c7ce22fe99524af43", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625160, "uuid": "b6be22cc-b4b7-47d2-bc15-18f894d84e26", "comment": "Malware payload (CryptBot)", "value": "59b4861575e8fc6183373e223bc070e6ba89357692de09983fb807095aeaa61f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625160, "uuid": "036600bf-2448-4f18-bf48-bdc136063735", "comment": "Malware payload (CryptBot)", "value": "8987c6367b0cef9ba4697d0424a7e3e2a409ce3f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625160, "uuid": "425b0cec-8ed7-4938-8ae7-980ee53bc779", "comment": "Malware payload (CryptBot)", "value": "43d4ad63cbf5261525d51f37e9cec0ad7af732b90eb9663986fe3dfcf63d35d1eb2d453407081dc7b1d36a79c72358ad", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625160, "uuid": "9ed45f04-1f9a-4a4c-87b4-d90ca681a597", "value": "84F53351309EB2E4E5150EF72DB428868F37966334E1C71B6B60C8607056268FEAFBF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625160, "uuid": "283000f1-9ca9-4769-866a-46df096c0cae", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625160, "uuid": "73601dc1-da0f-4ff6-9b70-8ee38e1ee7aa", "value": "49152:EgtxzB4YM8bCQFPgF9WsvdCJmrtqu82INc24C7br0KcUL+YsBB3oleuf1bMSMu:JtJLFPJCsJmrtCLclAx/LRffFLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624625160, "uuid": "eb6d97e3-e76a-428b-a9ad-ad94f624f48e", "value": 3330260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624625160, "uuid": "52705596-2349-4147-a932-0c9135173716", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625160, "uuid": "ef51105d-ff40-4891-a923-584eaa465a42", "value": "B44F8498263AE15C7CE22FE99524AF43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33d376e-d5cf-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1624637360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637360, "uuid": "54b13bd3-f9de-485a-bef5-c9b9171e1a64", "comment": "Malware payload (njrat)", "value": "fe72d7132c74d81c98dbd31543a00529", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637360, "uuid": "69526924-60c2-4d8f-87d0-e5e8a6994279", "comment": "Malware payload (njrat)", "value": "59c0a91faf884e242be0d2384d94eba2536a8f155ae568355eed225f2543176e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637360, "uuid": "13db0309-cfa8-4e83-947c-560c4b68a13e", "comment": "Malware payload (njrat)", "value": "b416424a60995d814a7c7a1e4d92f90dfe338c81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637360, "uuid": "4887ba7f-17ee-46b3-a2dd-921913462d98", "comment": "Malware payload (njrat)", "value": "b9a852d8f9d703d839afc56e5aff1963c0329a987d153d0bd16854f2b462e25b48f0bf58f1ce3a88101a130c5901de25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637360, "uuid": "cbf42833-49e8-45c7-bbff-842f3fb2b8a4", "value": "206584983611B5DFE417CE72AA645C70EA107CBA570FD203A09726DEA90EA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637360, "uuid": "804e2227-fad7-40ac-891d-6e626a04fb00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637360, "uuid": "1fe8133a-3738-467b-86db-2f7522e06cc6", "value": "12288:yZt6QhCWK5JFyVRxWFFxz6oz28hZECIHXGc4YHeqho3yJp8/j6q31J9rWqDBbGFb:yJcJAf0FFA7n3b4Y+qwKn7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637360, "uuid": "1da0d062-4021-4fbe-b6e4-e525c8f24ef1", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637360, "uuid": "9e5053ef-1e52-452d-9ea9-6c85a7b5264c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637360, "uuid": "0335b016-c692-4da4-9379-278cc1a310a9", "value": "fe72d7132c74d81c98dbd31543a00529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4c5f78-d5b1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624624195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624195, "uuid": "d06fc98b-2caa-4fc7-b345-7c2ba2180989", "comment": "Malware payload (AgentTesla)", "value": "74ce893aa7b3891fb8fab89f73fae1f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624195, "uuid": "727358ce-1b4b-4b89-9ac6-a8a9358f623d", "comment": "Malware payload (AgentTesla)", "value": "59e56ea3603c4410e4f3c885cf98800ed5e5b02646ae653cd2867cf1ddffa809", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624195, "uuid": "8a2997ea-67bb-4ddf-89a9-aeb772188c9b", "comment": "Malware payload (AgentTesla)", "value": "8731fdd44382f98fe9bf23a59c3255afc7d12c87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624195, "uuid": "0204254b-7a7a-4f80-ac61-309c2341481b", "comment": "Malware payload (AgentTesla)", "value": "7a9a66aca53306a1132fe527f4a1923dc18895341d0945b3bb17b2bd36cc8102c1f504dd9d9e4d46a9ccf290cdbaab7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624195, "uuid": "c9ed5e60-147f-4927-9ee6-02189ce51051", "value": "44159D20699C4318F176EBBCC5B06E514EAABD12D611D5DB2AD33E8FF733900CD5622A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624195, "uuid": "c1db624a-69b4-405a-ba4d-beb9afb7ef5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624195, "uuid": "32af865d-589e-4958-9a4d-cb047d31d8c8", "value": "12288:9jACJZaF75GF2NXvyMM+HKO62GMlVy+LqCcjXIc0bH+8l8ijLveOjuLtQl:ZA9bNXaMLXLG03+Ccj/UlnjLvx6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624195, "uuid": "df13c3bf-5660-497e-9149-6885e52b8358", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624195, "uuid": "caaaa079-781e-4269-8ca4-0e9e65411620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624195, "uuid": "41eeab75-540d-48ad-a27c-938c9d6abda9", "value": "PO 345678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6afc5c-d548-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1624579447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579447, "uuid": "50323614-50c8-4119-97d8-62bb98016aa0", "comment": "Malware payload (QuasarRAT)", "value": "41bb874f7fcd9f510c2f732550ebc21e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579447, "uuid": "a69843d4-cf2b-4d20-80a9-794962a94659", "comment": "Malware payload (QuasarRAT)", "value": "5a06fc050c72cc1155f996e5ce2528f0a35d02339e3f507721bb41682730f95b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579447, "uuid": "f483d06a-4fb6-4d86-bd71-06d9fd8a5f9b", "comment": "Malware payload (QuasarRAT)", "value": "e60a0bcf30dd87ddf079f9dc5dc2773358f43fa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624579447, "uuid": "de2e8407-9662-4b7e-a05b-acdc75290100", "comment": "Malware payload (QuasarRAT)", "value": "35c887d00a72d9a4b50b3cb69213f9578f8f4c97f4afbf47ae2b391ce0a266ec50721ec5ed198875ea00e0510b0c9fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579447, "uuid": "a2534185-3596-4a08-b654-9c91e319882b", "value": "72D4F5815FEFC9DBD16F237FA465081256FEE3065257E7CA8B01A9B4BA853138D402E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579447, "uuid": "031b3060-93ca-4902-893f-39e86e7ea3d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579447, "uuid": "24a6393d-a5a1-49b8-9266-2ac554a4a727", "value": "12288:NTEgdfYnxUnmYMJ4xywrNp55abowcdgGkW:uUw0UkywrNpTUVcdgGkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624579447, "uuid": "00c3c4f5-f86d-4689-9d30-809e2cfcfee0", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624579447, "uuid": "b7e349dd-252a-4367-9293-fdf4c38be968", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624579447, "uuid": "a4233c74-83f9-447a-8130-79f5dd0a703d", "value": "41bb874f7fcd9f510c2f732550ebc21e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489ccb18-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641476, "uuid": "d09843e4-44f6-4ed9-b0eb-002f7a084736", "comment": "Malware payload (Mirai)", "value": "ce690c2ee4df81495d250e41587ae209", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641476, "uuid": "d8a46eec-a0e4-4a99-a17b-da5281e649c7", "comment": "Malware payload (Mirai)", "value": "5a4648242cd553861ddbd6065381595e8177bf7873d7df9b5037f51ac9b8683d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641476, "uuid": "e2d5d5c6-fd9d-48cd-ac99-ca83920bb4c2", "comment": "Malware payload (Mirai)", "value": "69801e81341685a2eeb4f9786776545b05c276c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641476, "uuid": "12de6056-2f3d-49a8-8a2f-f0fd2096aa70", "comment": "Malware payload (Mirai)", "value": "a4a3d4c4f7a6125c1075eec1831b944da11725abfed8d54c5c13f30c9b19a56ad23befa4706a7858bb5af439cf198e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641476, "uuid": "98784982-4e00-4687-bd32-d1d8bda59555", "value": "8F93B419BFA50FFBEC9FCC3749A91B0224CD651621A93B75B934D818F25B24B19E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641476, "uuid": "b023d292-fd7f-4327-8ebd-9c298f547fca", "value": "768:BnJDTFOU1Q05gyl6SR9KhE3jU1tnzDh5YUeYOezgeR9GAlNYwN36gT3OXilYra73:lPOU1Q0GY3EDhV1OygS9hNVhrka7gEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641476, "uuid": "48c470ba-544c-4279-ad35-749f44c5ae4a", "value": 96656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641476, "uuid": "ce56d770-df3b-4d30-aa3a-3c8567ef5185", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641476, "uuid": "9dafdaa7-fae4-46df-bdb9-3882cf4f0617", "value": "ce690c2ee4df81495d250e41587ae209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca94684b-d5c9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624634822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634822, "uuid": "d44006f2-f93e-4c00-8608-24a4851c01b6", "comment": "Malware payload (Formbook)", "value": "4258d395beec4e5888eff4b468fb7016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634822, "uuid": "376adf0f-b48c-4ab5-817c-e7eca00f77ce", "comment": "Malware payload (Formbook)", "value": "5a5cabaaf342c66e713bb09ae85634323f31ff6fd519e63aa9361e2770df2f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634822, "uuid": "068d4cd7-db4f-495e-aa5d-fc51e01694ab", "comment": "Malware payload (Formbook)", "value": "f93eb0672cf0bbdc0859101cb565c5db8fde0b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634822, "uuid": "387ab0cf-b957-48f4-9b94-fdbf7548087c", "comment": "Malware payload (Formbook)", "value": "15a2f484e171ee95b334fa64bfa716ea6c8f6c4d6e2d72ae56cb8c1612f26beb8e09a76c036d2aadec2b4fa583999b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634822, "uuid": "1d446582-58bf-4586-b961-aca96e94dd5f", "value": "E1159D246E9C4319F076EABCC5B06E414EA9BD21D611C4DB29D33E8FF733940CD9662A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634822, "uuid": "48dfcac8-2c79-4977-a87c-f7ee7a576f82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634822, "uuid": "5445959e-0d46-4848-b418-5ee7decf47be", "value": "24576:TAZbE6UxL2iVGjlqjrQ1zq9Y3ZqxhJPnj:k3Ux2i0jlEM1zchJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624634822, "uuid": "41d808cb-93e1-4f96-a9b3-09310d22f067", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624634822, "uuid": "84eeebfa-4b3a-49f6-8274-821aa4ec50c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634822, "uuid": "0808ee53-a082-48dc-8fb9-b262f5206e41", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0b3642-d5c5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632944, "uuid": "52ffc91f-103a-4c3b-8612-c7ebb0b0dbd5", "comment": "Malware payload (Mirai)", "value": "3801830a37a67ca3c5cb343c71425a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632944, "uuid": "e76930ff-841c-4832-ac74-773080d04b28", "comment": "Malware payload (Mirai)", "value": "5aefeee9c111a3d260ef94f37e4e817a1999f3f51cb5428c5e7ed7e3490740c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632944, "uuid": "cd7a0c49-4e9e-4654-b484-81fe51f03f98", "comment": "Malware payload (Mirai)", "value": "fce06755a896708f14ad8eeb34c555be4bc05726", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632944, "uuid": "1edd9934-9972-40ac-8ba9-e8b9e3f15108", "comment": "Malware payload (Mirai)", "value": "5d861d4c582ac2eda98f9d1cfd4077543ed01fc29b870b1ecf2c6e525b9f4b123ccd69a2aec0406389d61446512223ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632944, "uuid": "da00e922-bf68-4b1d-a1f0-8621efca1537", "value": "19633A86BC919B12CAD012B6FE5E419E371213D9D2EA7213EC159F2037CBD2A0E7B156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632944, "uuid": "6b8652e3-7690-4ee1-aeba-dcffb078d22a", "value": "1536:FZScAoUk7RltCzIKDrKe30BXCt8tuUgFDSQzA570RXdvRID:FZio97VIN2XiEuU25zcInK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632944, "uuid": "067db516-471a-418c-b3b6-9876183adb76", "value": 73064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632944, "uuid": "f7a3fe85-26d1-4bd0-b57c-9967a692d368", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632944, "uuid": "eecced72-e1d1-4151-82f0-8d619e584e38", "value": "3801830a37a67ca3c5cb343c71425a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7667351-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641743, "uuid": "9c8573d9-350d-440e-9e6d-9f60b4a274a4", "comment": "Malware payload (Mirai)", "value": "df71544c2ddabdf79da757f8938eb231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641743, "uuid": "b9c32f82-be1a-4925-a623-d783b3fd3243", "comment": "Malware payload (Mirai)", "value": "5b8b0862948bbdc3457aa029ad3047ff68c30784ac479120e512d444d98321bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641743, "uuid": "c496c11a-f577-41b3-9731-328c372ea86d", "comment": "Malware payload (Mirai)", "value": "3cbfbf225900d8f23d27ec7f5d30300c83054f63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641743, "uuid": "f6091b75-fb41-4a58-96a2-bcf0039a3691", "comment": "Malware payload (Mirai)", "value": "7d3b557621c870bf085f6add138ba044ab584464dd104f63b3a93fb81d0f429dd1b6eed60f985e6fc56adc73d8a3f536", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641743, "uuid": "f81eb1b0-f296-47d6-ac11-583434eedbd5", "value": "7C93D81D6E219FBCFBAD863447B34A219648339627E1C685D15CEA012F7034E349FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641743, "uuid": "3d117cb3-ce98-4390-a7dc-0435353e29f9", "value": "1536:6Jv3wP53+9DqddmhwK5jna4BFpoWA+L1Uxep+xeM:83e39mhL3BFpoj+L1Udxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641743, "uuid": "004e1632-e4f6-4a53-ad74-b48166d1a240", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641743, "uuid": "b3b5ae32-9f9c-48ed-a78f-aa149f1c8d99", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641743, "uuid": "7508640c-6754-4043-ad2c-e000370b234e", "value": "df71544c2ddabdf79da757f8938eb231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1857916-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602971, "uuid": "1790b781-d294-4d2e-acef-a05614415234", "comment": "Malware payload (AgentTesla)", "value": "c3c666ff1cdd21de935895453ce7fc1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602971, "uuid": "b0517220-1c6a-4240-bfb6-c15cdfd526d0", "comment": "Malware payload (AgentTesla)", "value": "5be8f0f892b9484f64bc2b7a0cc11069f3540be32bd46ee5e7a385bcfcee523f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602971, "uuid": "1eb57517-769b-45c6-9682-7dbf17deeed7", "comment": "Malware payload (AgentTesla)", "value": "fcb254ce0bf4934d1882e0496bb26b842ebab2b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602971, "uuid": "92a57e2d-50e4-4b9e-a903-7e2ca2d524e0", "comment": "Malware payload (AgentTesla)", "value": "27173b04115fe24f66abcde7b68553881c41cea7e0bc755305fe82ee683234fa5ae30a329131b380f267a7bc62fccbe6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602971, "uuid": "50e256bd-0754-41ec-8d37-285008a3c3ba", "value": "11F4123A135C9FE7D6AC12B8A831610137F8C9ED6664FB477EC4718D8AD2F404F92A19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602971, "uuid": "e3d46134-d898-41a8-bcff-053fbc1b8d0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602971, "uuid": "e2ff571a-cd86-4cd2-b3fe-8557e2f95144", "value": "12288:zd2kwzGWSE5D1kIpNEbvxziucvMJgK8Vq8niCuuw3xuE+oiVp8YnLJ/StzIgl:PdhEp1ivx+fMy5Q8nD43xuE+Jp/LJ/67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602971, "uuid": "cff5464b-2000-4d53-bb08-05213a1f1ba5", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602971, "uuid": "329f0437-fafa-4f24-bd36-5aa59c05e37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602971, "uuid": "f095d2a3-1e18-4898-9572-0de499e97818", "value": "Bank Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cf0ae2-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651164, "uuid": "ccfbcb7f-f8b9-4bec-8999-ba715f3bd8eb", "comment": "Malware payload (Mirai)", "value": "d54afd2eee5a54d6f177b852f36469c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651164, "uuid": "db2c61c9-f7ed-46c5-8db7-595bdbaa3dcf", "comment": "Malware payload (Mirai)", "value": "5c2c8e9f57a439cc5724b1d3eb86834298c63a2c77e9ec37573b8a4d5efb9768", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651164, "uuid": "0ea68760-20cc-47eb-99bf-3bf13210f2fb", "comment": "Malware payload (Mirai)", "value": "1553dadcbf92eb9e527ddda24191336e4ad807b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651164, "uuid": "e80b9b00-1e53-4932-b604-ae38124a96df", "comment": "Malware payload (Mirai)", "value": "ea53b316a8fad5ffdab48cc0531a33f230fa941e053d42bbcdee6a90b5e0205ae92725755f1b49824118d16a77c8a14b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651164, "uuid": "37d70bf7-83fb-4f0b-89ca-69d748fd0481", "value": "83234CC5A447D9FCEC190A752177EF319AF6E93F1098D983C398AD72E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651164, "uuid": "3002d0f1-cf00-464c-acb7-c91ce829c6c1", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8UEHgWfd/046SDZklAI:IiK25NttVEi4WszsVTc0WV/046OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651164, "uuid": "5db7dfd8-9ef4-4a20-8f99-5c7bdb04a5b0", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651164, "uuid": "870f15fb-1f17-4178-a67f-f9b4ef454121", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651164, "uuid": "fc9d335e-4f43-4530-a6ae-6e78303c7c86", "value": "d54afd2eee5a54d6f177b852f36469c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abe0539-d5ad-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624622475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622475, "uuid": "dfc73772-dec7-4f22-b4ee-d23461def375", "comment": "Malware payload (CryptBot)", "value": "ae8205abe6be03a6fbc9c0645bd4ad99", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622475, "uuid": "fc76b5d0-9813-4b6a-a271-66da3991658e", "comment": "Malware payload (CryptBot)", "value": "5c5a71fd5e122ae176b592ae080a18f61b38653ab9405e1724dfe053ddbf6d1c", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622475, "uuid": "986cfef8-3878-4254-aee4-3ef128e9683a", "comment": "Malware payload (CryptBot)", "value": "bc74750f5b29471438738fad3574aab2dcd33fa4", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624622475, "uuid": "61b7d463-0050-4f62-a054-3279858ee795", "comment": "Malware payload (CryptBot)", "value": "dda0a07c7edd6cd9e62ea870a59d9ee22da0168f55bd40d13b650aeb18dab42cc16ac298eadf9a01046fbe9dad2f84d7", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622475, "uuid": "5b0b8c9a-d4b3-419a-942c-0334acbd4890", "value": "D0F533635616A0F8DAC06EF044B43A9167DEEF5D233147AF4B4077AB182303F667762A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622475, "uuid": "3c32442a-e698-4bda-9e92-abf4976a9210", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622475, "uuid": "cfa28489-0a7d-4a03-b6c1-7a263e5d4aeb", "value": "98304:JZhz7k7DEvTX+sFCaBDGilZDRMuvyI+axJWfyuo4:JZq7DmSanMO/+ax6K4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624622475, "uuid": "5c5a1fd7-2f0e-441c-a762-4d540f53d1ab", "value": 3434226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624622475, "uuid": "222c0590-37c0-4371-a93f-9a07db3a2780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624622475, "uuid": "571ef391-4bde-41ae-8f4f-0a90577c6d12", "value": "AE8205ABE6BE03A6FBC9C0645BD4AD99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43804378-d5b8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624627294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627294, "uuid": "dc1f3d99-f184-4460-a2f2-d86c1d3443bc", "comment": "Malware payload (AgentTesla)", "value": "62c8f28baca7b69711b213e35d316173", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627294, "uuid": "0c4507dc-8a82-4500-be02-8e8283f572ac", "comment": "Malware payload (AgentTesla)", "value": "5ce37eda5b443fa4aba2f5152b0856ef9c3341641ac3c8e7750088301220c6d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627294, "uuid": "28179de6-a3ef-48d8-bc7c-a44cf967186e", "comment": "Malware payload (AgentTesla)", "value": "141845cd899a878fb3980c5754b2daff8f31524a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627294, "uuid": "a1a9d3be-1ae4-43ef-80fd-695340e60314", "comment": "Malware payload (AgentTesla)", "value": "63fd977bd9af13d43d133a55a887bfbad608ff6af2a76031fe44b29524baaeb1f9c29d8decf42396ea3ba07c23d5b7fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627294, "uuid": "56c5d91e-5b63-416d-956a-57ad28c0d4e3", "value": "1CD4E51B65FC5AB9EF09E3BB10854CC41AB09D11698DF40B77ADB8798F38522AD0F90D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627294, "uuid": "9f1e7d75-eb0d-4af9-94a5-f462279e16c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627294, "uuid": "e2f1e901-5a69-44dc-b832-e74ab81fc3fa", "value": "12288:KHAx0Q3cFWiu/itigkPqn4bYYhB5+jsxHQ83/Ef+AQD:9WGmk9CngY45px/EfBQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624627294, "uuid": "16df4b45-547a-4d01-9838-737e12c9b0bd", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624627294, "uuid": "df5cbd7d-d483-4068-9ac4-15fc0e268e30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627294, "uuid": "c665171e-36fe-4178-ad7b-c8104278aa1c", "value": "62c8f28baca7b69711b213e35d316173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ec5393-d5d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624640416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640416, "uuid": "87ba17a1-d3fa-492a-9c16-94f9db0dc6ea", "comment": "Malware payload", "value": "86a5323d164e971659fffdff19fef7e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640416, "uuid": "d13c6d31-0c4a-4cd0-9f9e-dda470a45998", "comment": "Malware payload", "value": "5cee0abbfccdacd9bc5d68b5a340c071e2bf9f9121ef1fc80908b45e65cb205b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640416, "uuid": "6ff2d261-032a-4d5b-bae9-8da8e64147e2", "comment": "Malware payload", "value": "63b0e4119c4fca3cb9e62bd9e5c3ca3000648fe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640416, "uuid": "524fa61c-2e11-49b9-b592-9144f84786ca", "comment": "Malware payload", "value": "85b40f1aa249ef39f8fd81b520a38841f49b7a4c88a8284cd9edc9a89d96eaf003bd11530b414c7abb60312092757ebb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640416, "uuid": "9498dae9-ada1-4968-bacd-7f337eff7924", "value": "4282D0E4F5DCAE84CCC061FB43CD9EE25E12C80742DC97449EAD458B6BB631B5A3A341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640416, "uuid": "554d3998-4cac-43aa-aa0d-379821c4ab9b", "value": "384:Mszy4PcM04AdKUmMlWNaSwVxMK4X5mvKkHIG3wf2L7NKR9:1FKjSw/X4pws5I7S9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624640416, "uuid": "a9780739-68e7-4022-9aaf-2d51260f1daf", "value": 18880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624640416, "uuid": "5cac75d7-c1d4-4ee8-b994-89d2ab8db1a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640416, "uuid": "15d2f724-1112-460b-b8c3-47bca3a4f510", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea617e26-d5ed-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624650338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650338, "uuid": "02de1335-e6d0-47ff-a9d1-0a4e86df8cd7", "comment": "Malware payload (CryptBot)", "value": "33d711ccfe4a4e9cbd37c99e25c13769", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650338, "uuid": "07caf246-12eb-4c3c-a102-97ee90157608", "comment": "Malware payload (CryptBot)", "value": "5d500524991ad1e6178b097b7ee5e270eef3710115b72a424b7fb2643490f992", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650338, "uuid": "cb6db587-a189-4170-a8f3-4819f3f7a533", "comment": "Malware payload (CryptBot)", "value": "781e0cdc5b1c72f217f54bedd2c2862c73604e89", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650338, "uuid": "7426ea19-89f3-4151-a0b8-14289593d49f", "comment": "Malware payload (CryptBot)", "value": "8669cb46b1ff34044e8bb26567905917c5ddeb56437e450a953411aa42e7daba9c155f2a2a03f6f002572975acae8e55", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650338, "uuid": "a1c7efee-60c0-408b-b31b-f7aa872295c7", "value": "6AF48E10B783D071E8B205F558B9AB6A547CBC1407389EEBB3D43F6D49391C22E36E5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650338, "uuid": "8dd81b0e-1598-4010-9045-57fc3fa2484f", "value": "9b239827ad94cf9e43aed2c8aec6e783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650338, "uuid": "787e24a5-2a0f-4550-a87a-67c43110689c", "value": "12288:DPkEGt/xf+OeO+OeNhBBhhBBOsdVrmykJpcHRQMRTFhu26loXKHEu4uLv7pC3yeS:DPkEBKnJGbZ6HXv7pC3yedQFyJ5JbTTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624650338, "uuid": "8b06b0e6-f6d2-4c87-bfb9-7347e82dfe2e", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624650338, "uuid": "2df2a4c5-cf18-44c1-b3b1-d405c1d2e5f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650338, "uuid": "51e9b22a-c535-4d3f-b782-aae07ddd26f4", "value": "33D711CCFE4A4E9CBD37C99E25C13769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221d0b5c-d587-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624606193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606193, "uuid": "0be7d1fb-9705-4f73-a46f-ef2e8aa35163", "comment": "Malware payload (RedLineStealer)", "value": "f12aa4983f77ed85b3a618f7656807c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606193, "uuid": "87787e02-f3d1-468f-866a-f7428b7596bc", "comment": "Malware payload (RedLineStealer)", "value": "5db1d9e50f0e0e0ba0b15920e65a1b9e3b61bcc03d5930870e0b226b600a72e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606193, "uuid": "ebc0d384-74ce-4050-804c-cea57158c442", "comment": "Malware payload (RedLineStealer)", "value": "ab29f2221d590d03756d89e63cf2802ee31ecbcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606193, "uuid": "37165bed-276d-4662-9aae-23cacf9fc9a9", "comment": "Malware payload (RedLineStealer)", "value": "02ae0ff0462f26f9cca69c5e25c5fa9ae81f8227672df2be0348e8c95883e91f7475d2c523fc79b4f3a5c00983b22bee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606193, "uuid": "6c9a4ba0-bc16-4639-b33a-d6d966d7a092", "value": "3304C36773A7C475C1C42230E061CB3B2668CD271770B65AB0CABEA7BD6B14C49BC6E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606193, "uuid": "971eed2f-9c5a-4697-a455-5d0b369ff42f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606193, "uuid": "a597aa70-394d-4209-9308-6e4359840b9c", "value": "3072:vuosgt5uZEnV79k7oPmfY44cQM2qGUhm:2orQEnV+oqxQTxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606193, "uuid": "d82dba10-8466-4ebc-aa0a-0c95e3c173a9", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606193, "uuid": "8c81d51d-76e4-4a8a-b3fa-b95dbc1e37e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606193, "uuid": "081df512-f0fc-4899-a691-2f26a2f3ac51", "value": "f12aa4983f77ed85b3a618f7656807c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd1e05e-d5d2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624638697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638697, "uuid": "9e701710-85b0-48e5-b151-af7c556d4bde", "comment": "Malware payload", "value": "3c259ed4526ea39a50d519b486b7086a", "object_relation": "md5", "Tag": [ { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638697, "uuid": "8f927abc-6d29-4423-8c7e-929aa6183d17", "comment": "Malware payload", "value": "5f90c88233a50bfa8789d70d83cf8adbf16b7e074d6207553bc9165abc966600", "object_relation": "sha256", "Tag": [ { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638697, "uuid": "d70e15bf-15e2-4bc4-b9e2-5859bb174754", "comment": "Malware payload", "value": "f1a160835f3274ed13be0fc21b9c7aafe5c9804b", "object_relation": "sha1", "Tag": [ { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638697, "uuid": "c23a11b3-ed1c-4421-a981-f31fc9dc6aff", "comment": "Malware payload", "value": "91a415e8ac1b7fa4337c2c33e1cfcbe0cdbfa59ec33384bf33941a7631fa6c7d03121155625ff004f8334e6a12cd2535", "object_relation": "sha3-384", "Tag": [ { "name": "oski", "colour": "#7E72DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624638697, "uuid": "e9252878-424a-433f-b12d-22b930eafc17", "value": "EBE29F7EB5D8301BA4BDE22E94B54832F57BACC2F4395B2D01C6D7894853A096ECC35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624638697, "uuid": "66dd13c8-85f1-4eae-8242-5360313b3245", "value": "96:B11I3+JG6IXnc7RaRMBk7NOz/+sNLUH2RYNnqgxYMln9kPyn+GT24EYESlgJXiOf:hIGQRY32qpBA6Y5Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624638697, "uuid": "ed68404d-213d-49dd-9d2d-0d052f57c402", "value": 34176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624638697, "uuid": "7245a918-fb6b-436b-9952-8b302d2a4111", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624638697, "uuid": "9eccb390-4fad-4699-a48f-e49475a8e55d", "value": "clone.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a5c824-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588512, "uuid": "4b7df890-a743-4823-89e1-911037fe605f", "comment": "Malware payload (Gafgyt)", "value": "2247f9a5fd70c6c44c4d3f0a3c19c8d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588512, "uuid": "41a6c08c-a29f-48fc-82f5-f114c2ac641f", "comment": "Malware payload (Gafgyt)", "value": "605d4f72409c131dbc3332747657b1d3c9ee6c8ee56673858612a78e0163b097", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588512, "uuid": "10ca1668-86bf-45b3-a68b-c9cbdfae9acd", "comment": "Malware payload (Gafgyt)", "value": "520760a651ef2e9880d3d80833c670b361ab720b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588512, "uuid": "0dafc7cb-156d-499b-ace4-76e1cbf5c945", "comment": "Malware payload (Gafgyt)", "value": "fadc71753447715db29b995bf6bb680568473c4c5ad4a4d8f1b52ffeef4b54cccc388d3508cff61a17991c1faa504767", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588512, "uuid": "4a876c90-88c0-4cfd-a410-cad15591dda1", "value": "8C030293079B5AE1C93448B8FBB6FF1CA0F906B9D8DA519D3025037594ED0D702EA0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588512, "uuid": "a0a049fc-c81c-4c32-8971-f0a30c105622", "value": "768:l3j7rm259biWT6VdoI7OEOIZ0Wwzs3UozGydX2R7ffiV:lT7rm2fTeVdoQOPIvwezz2R7ffs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588512, "uuid": "1af601c4-1614-47e8-85e3-91c07b7af54f", "value": 40168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588512, "uuid": "73062c79-2863-447a-b46a-377fe987bd77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588512, "uuid": "687f94d6-ba4e-4110-885d-b1fcc8aef431", "value": "2247f9a5fd70c6c44c4d3f0a3c19c8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac4cbd8-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624631897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631897, "uuid": "eae9fce5-b8ce-4c6d-b672-f5c3b36211d7", "comment": "Malware payload", "value": "1777ad0d68bbd19ef470ab8b4f649cea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631897, "uuid": "41a6f924-da13-465b-a73a-16ce58d8e7e7", "comment": "Malware payload", "value": "605f9d22a01a88b23d40046a69f4fc3fdb886f2d95f9872fbcc70fea645bc607", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631897, "uuid": "585f9c60-08bd-4ed7-9f49-9082f9a31ed0", "comment": "Malware payload", "value": "4acdb22a43185e21e7c17ce24eb50ee2f416a0ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631897, "uuid": "d325001f-aa66-4bc3-85d1-6c9133680b6a", "comment": "Malware payload", "value": "f4d5f5be1d560220e6be56233e84115be9494a1fe965c5a780853868d20c9bc523a451d5da67db7ad0cd0ff1c48cc253", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631897, "uuid": "b42e24e3-d82a-4d9c-ad52-8d8ebfa6e8e0", "value": "28D2D063C1860A98C7AA0832E82F3C0C6978BB09D5BD06B4AFEDF1058D71F2557DCB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631897, "uuid": "9594e92c-53c0-4f1d-aca1-433168081f4e", "value": "768:iYicrAqMzfOwAHnMZvPFInoL1FKQTCEnomnbcuyD7Uryqk:1zAVfgHMZvPWovnTemnouy8mqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631897, "uuid": "99a0b387-8a44-4f36-9956-c6c9934a8b53", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631897, "uuid": "0e1eb2a9-a322-4a18-b2e5-1b6ef31446a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631897, "uuid": "6b0406aa-691f-4394-8548-86eb87b101e6", "value": "1777ad0d68bbd19ef470ab8b4f649cea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d5318c-d585-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624605666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605666, "uuid": "74a9b486-258e-4439-9c4c-32a915cc81e6", "comment": "Malware payload (Loki)", "value": "5914e677c46e7faea098c3a39db2e04d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605666, "uuid": "ae40966c-2bc7-4d36-83fb-4d0f8aa23abb", "comment": "Malware payload (Loki)", "value": "6099204cb1d9d2b9c81e22267536c03f9239ca74d22c8359b32797839541692e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605666, "uuid": "9eda59dc-d6dc-4cef-ada6-5c7faa9c3b53", "comment": "Malware payload (Loki)", "value": "f72401e84333b2c24168f6e0525c273b13ec7915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605666, "uuid": "10553c0e-3b0a-4fab-aa86-dac791f0b88e", "comment": "Malware payload (Loki)", "value": "ea3188d05eafd62dccf27a71e7504ccd9ddcf3753e0e2f928eb6504ce7265cc54f9d8f5e52688e5be5a69ad54c0df997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605666, "uuid": "69843422-6438-4373-a6db-8e8d1e4ba431", "value": "2AF4D0343AE96614F177AF3A4AE4749587FEFA532303D41D28A1138A4763F81CEA193D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605666, "uuid": "b3bf46e8-1939-4701-ad63-d0d119ba2484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605666, "uuid": "26a57351-e75e-4063-ae40-c2492c2858fe", "value": "12288:hcsZ+zGWSE5D1kIpNFkMqLh6/8vnjS91MqLmJcfm1m92D99Y7t0vJZaF75GF2:hfhEp1tne6/8/mjdxu9Y7bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624605666, "uuid": "61e12a85-cac0-412d-93bf-a9fee1f4c88b", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624605666, "uuid": "89a3c03f-ae20-4ae4-8276-40d1779da8cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605666, "uuid": "b23c668c-522f-4f16-a9ae-571cbe29a592", "value": "July order #856394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4260f1-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624601301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601301, "uuid": "4496088e-5904-4968-9bb9-521df5ed2e32", "comment": "Malware payload (AZORult)", "value": "1ef675851c86356130d11d79047ccbea", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601301, "uuid": "bb921ac7-8d72-4342-840b-1372a9884725", "comment": "Malware payload (AZORult)", "value": "63224d20821cc45d3a2d0287a3ea30a43049b0724cdfb5720f1323b0099f8628", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601301, "uuid": "03e40382-f9a4-4ca9-9946-a68d7dfb6308", "comment": "Malware payload (AZORult)", "value": "6dc5530c8b97c28f05aa65867dc3b4d98a5c3cfd", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601301, "uuid": "87ee1087-8d24-435b-86dc-bab73fc968cb", "comment": "Malware payload (AZORult)", "value": "32e311a75f5258286e47f26e071b222249155c7b8b47bd9c95d771b2bc4ab1a5129e27e92893432268adf9439d16cfd5", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601301, "uuid": "c9ee37ed-d6e6-4162-952e-1ce90b394864", "value": "C0941A6E1AF5AF7DF90AD1B710C64D012EA0ED61A9CAF94EB77E2C610F20525FE03542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601301, "uuid": "dee214e9-adb9-4062-b0b5-38567f4659e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601301, "uuid": "036bc5fb-79d9-44fd-8294-db07baadc887", "value": "6144:9XreaYIMsNIGHuyHXV2Rh1KXBHBQ/c/DJEJorPjM93A3VeWrCEfekcMg:BrpYIM+RhXsRPKXBHBb/DJEJorPR0E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601301, "uuid": "ad4b24ff-5d64-4a28-b3e0-3dcf44627ab2", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601301, "uuid": "70ef4146-149e-4fd5-ad4c-f52676acc870", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601301, "uuid": "e83b3614-056e-4626-a784-07c5d28be1dd", "value": "Order Specificaton.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9671fce2-d566-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624592215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592215, "uuid": "f2444f76-7e3c-4815-a2a1-742383991e47", "comment": "Malware payload", "value": "fcc83042ab7323421e15e263bb86bc6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592215, "uuid": "ef9e221f-3da6-4774-a94b-b74b9e7fce8f", "comment": "Malware payload", "value": "644c41a4311cb26bf1e4b1587a7c8b4e843395cadda1f9ab710a585658c829b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592215, "uuid": "5d2b50f0-0379-45ec-9e66-e108931af5b7", "comment": "Malware payload", "value": "5e7687a1ec726fc7aacf192257b735d29a95da70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592215, "uuid": "e3b7fb39-7a6e-4277-ad0d-0188fea61cb8", "comment": "Malware payload", "value": "ca935d6ca0cb6b7089fed5641b682c2efff9d808daec65e119a90125dc1cc0211333a918e10975ef68f4fab4ab1baf45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592215, "uuid": "b7fd7b6f-5e6f-4cab-96b3-a5c3125a6190", "value": "38749C00AAA0C035F6F712F88976E368A93E7DB15F6450CB52D5EAEE46346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592215, "uuid": "1f6edc89-d872-43b5-9b63-c3c6f8683258", "value": "3696836e697e34abe8d01359a9095212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592215, "uuid": "502e8123-ce03-4e13-9d01-bc5f4ca82907", "value": "6144:HgdJFnAG+ULJHUUb5i6G0KbinHfjAokfOPYjVJQcaqcZuyuyRk:EJFnAG+ULJHUURPKbu/UokljrsPLLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624592215, "uuid": "0d707010-e381-45ba-a08c-9d3062fd986e", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624592215, "uuid": "fef7d1b3-004d-4bbf-a48d-453c001bc752", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592215, "uuid": "662b248b-8ed6-4d23-b8d4-b153f19ebd96", "value": "fcc83042ab7323421e15e263bb86bc6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293de045-d587-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624606205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606205, "uuid": "faa002c7-3ada-484b-a435-f29fbed2b610", "comment": "Malware payload (RedLineStealer)", "value": "0e5a341c5452df8e1bde9b0e31ee916f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606205, "uuid": "3e19ffff-d8b8-476d-be2b-4ea36aa0f6f7", "comment": "Malware payload (RedLineStealer)", "value": "64b7cc199a71a63a7c4b14950dcd1d8231d80e47f77dd5598ee4225cae4810ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606205, "uuid": "5fd1be75-82ac-448a-a9c8-79c1d6c84afc", "comment": "Malware payload (RedLineStealer)", "value": "0ecf01db3450c602e886bdb6049a13a433e3b144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606205, "uuid": "f5c5d1e7-b327-4fd8-8196-4336ed1b6ded", "comment": "Malware payload (RedLineStealer)", "value": "c1c18b01baf12cdac650128aefc7225ec08d8b68e5c243067b6d65114208410bd80d9f7d724c95f7b378a50eea083237", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606205, "uuid": "b13d821e-4b51-441b-960b-cd8c1eeaf3ef", "value": "D904AF6363A3D471C1C42230E465CB3B2664CD2717B4724B71CAAE9BBD6B29D49BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606205, "uuid": "9bfdcebf-20b9-4504-8c66-f98862dbdd81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606205, "uuid": "7e67a5e5-6af6-4292-8f87-3c82fdb01cfa", "value": "1536:zQfomjQ43YL95ceJb7X6RRv81oyyWGP6OynME/ItUI7LgTzVD8Mc/r04sqIwVDEd:Lmc4opX6L81oCDRqATJPc/wgVgOi5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606205, "uuid": "0fbf4724-a3c5-49a9-ace9-16956ae23f2a", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606205, "uuid": "ffc1ebf2-6a6e-431b-b826-d3bf814e4f80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606205, "uuid": "a844005e-c813-4af1-8173-a6e02421a109", "value": "0e5a341c5452df8e1bde9b0e31ee916f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c213ec0-d609-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624662017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662017, "uuid": "566d4390-ed56-4edf-ab9c-65038c7a771b", "comment": "Malware payload (RedLineStealer)", "value": "5592372d74e7cfe35193fa6f116713c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662017, "uuid": "aba3149e-2b59-45dd-9e4d-9dcc0f51960e", "comment": "Malware payload (RedLineStealer)", "value": "64e60caf3b4942d09db9164c8748b7bcd16fa341df00ffa41f6044254b45e568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662017, "uuid": "9da85f13-ed1e-4e8b-8a32-48c0e42ebfce", "comment": "Malware payload (RedLineStealer)", "value": "d4e9ade6b4f49ff5713a3cc22a64c1d74e47689f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662017, "uuid": "1d1cda0d-c8c5-47e7-8410-908af14abdce", "comment": "Malware payload (RedLineStealer)", "value": "a88a80661daf432384c678516857f4168652c2702f572e6c5577c5993f06e92a135e7f59e81a328ed938382d1a8b72cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662017, "uuid": "5c2c23f9-fe27-4e26-af78-24b858f94cee", "value": "84E5338135C340B3DA501471916CAFF7A5FEDBD40B6858E733918A0E9B7EE68C31E8A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662017, "uuid": "1fbac017-431e-4e8a-a6fe-33edf45cd902", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662017, "uuid": "785949e2-6b75-4e57-9c2a-f237b5786162", "value": "98304:xF9cmkfYbeHsk8meBJQRcNmmoR1/EWb4iCvLUBsKW:xF94gbZXlwR1moR1T4TLUCKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624662017, "uuid": "13281a42-093a-4e06-8760-3054c9b3e63d", "value": 3317734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624662017, "uuid": "ca5e356b-ac20-4e83-8417-9933fd02a81d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662017, "uuid": "33bd116f-495e-402d-a6b8-a5e4673b01f9", "value": "5592372D74E7CFE35193FA6F116713C1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478ca549-d5d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624637609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637609, "uuid": "bde2e606-6e29-407f-a0c8-f41f11cec58c", "comment": "Malware payload", "value": "bc04d972c194799efbfe868cc0638483", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637609, "uuid": "f3c0927b-8147-4262-9fd5-39e4b176fec6", "comment": "Malware payload", "value": "64fce96e0bb9bcb37d060524b027b87aa3cdd7cc8986608e3eb124fe7f82741c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637609, "uuid": "e8535355-2ed7-4e7e-9c72-f2f1e7fb95bb", "comment": "Malware payload", "value": "086a4c779c61b5afa7f2dbb375d296f7123a5dd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637609, "uuid": "6f81d7f3-a958-4136-a8f9-acf27623b3f8", "comment": "Malware payload", "value": "53e64d1e93fd623b0941392df10f730604627a4407120c0bbe56159d1217d365b2061d8326887505f5ad5060ccfc6030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637609, "uuid": "375a2101-bec2-4e54-bd36-b5e01e808847", "value": "DDA49EAC36A435EEC82BC6BA9EA87C54EA657577531B910A801301DD9E4CBC7CF205F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637609, "uuid": "a1e597bb-b157-4b95-9355-3dd2e2e99684", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637609, "uuid": "8c373c0d-60f5-4253-a520-2afdbf4250b0", "value": "12288:SP3E3EGE/OBT6k4twR2+BKcfTpXgZVnS0WvUgRH5EfcNuX09:SP3E3BE/uThrRD7fTuVnxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637609, "uuid": "a7ce41a7-d780-4f53-bfdb-f59eab7f2beb", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637609, "uuid": "0ed17c86-128a-49fd-b63c-fe95ea7e78e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637609, "uuid": "655768d1-fe58-4cf9-8d15-f4dae0162e57", "value": "bc04d972c194799efbfe868cc0638483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab23ceb9-d54c-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624581083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624581083, "uuid": "c7f90e03-1110-463b-8bb0-70519d088d23", "comment": "Malware payload (AZORult)", "value": "6eb7476d161305b1035e1fa456e6a660", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624581083, "uuid": "4ccee9e4-dad6-4d05-b484-4ffa565bdc17", "comment": "Malware payload (AZORult)", "value": "65c61a91eccc511339a3da608359490bc22a4c4624ff652fb7d41f7a3ee24d63", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624581083, "uuid": "d5bfa1d1-27be-4bcc-986e-ef18152ff9c5", "comment": "Malware payload (AZORult)", "value": "e428e8d8850731315256912df8fbda7dea7596fa", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624581083, "uuid": "628270a7-81b8-4cf0-8382-8474c01cbeb8", "comment": "Malware payload (AZORult)", "value": "93e411409b6c714baa9916fc43e5b24e41aab810b8fd7e44f81bbea76e0b4bfda64ccf159432d7c05ae0777a1b68657e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624581083, "uuid": "27958f93-6742-4c05-a0a1-227400e55d0f", "value": "64559E9713E9415BC23141B2B955BB906E76FC782B61F5173E80BCADBE303E1412A6B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624581083, "uuid": "1f4e3b14-ddbe-42e3-a98f-b4383af574e6", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624581083, "uuid": "af06ae3e-1d8f-49d1-8efe-7eb3a1189d4e", "value": "24576:Qtb20pkaCqT5TBWgNQ7ayZcsLkBlWazBoSKgjfr9f16A:ZVg5tQ7ayZcsLgf/Ku5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624581083, "uuid": "5551f4d1-b362-416b-9649-c24d1f681750", "value": 1399296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624581083, "uuid": "55dc3361-c5e5-40c9-b43a-591f34635c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624581083, "uuid": "caca7626-83a7-4b75-a971-f8d9bfe9a93e", "value": "6EB7476D161305B1035E1FA456E6A660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a9e36c-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624600823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600823, "uuid": "fe1aaa7e-7b18-4929-ba2b-c85ac231ea9d", "comment": "Malware payload (Hancitor)", "value": "838bf14a6a0327f6f0718ac78d1d483a", "object_relation": "md5", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600823, "uuid": "57b6f3cd-9807-4e9a-bca1-434c052943be", "comment": "Malware payload (Hancitor)", "value": "65e021fb000ae5bb8ae8de779ed224e30536a1923ad1b225e781ec7a0150be0d", "object_relation": "sha256", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600823, "uuid": "53b6e6cd-0db0-4d3a-9f88-8ced3e8ac4b7", "comment": "Malware payload (Hancitor)", "value": "24ccfb6a64cb26e07d85cf1c4968145a64da16a1", "object_relation": "sha1", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600823, "uuid": "c8f66d04-2613-4bf2-9142-5fb94703367a", "comment": "Malware payload (Hancitor)", "value": "ebeb9305ede22ff5e4580618e543422bd07c0d8f82cdbfb1481254bfbc1e6110cd52237a3d7e9f3a7f2fb498dec442fe", "object_relation": "sha3-384", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600823, "uuid": "106c3823-8d99-4514-8c11-8f8ca7c3e7ae", "value": "DC947B0079D1D432EAB219310F65D696537CBC540F308AEF73D83A2E9F785D2AA31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600823, "uuid": "80ab56c4-e02c-4d8d-946f-7c6918a7d6e9", "value": "261159aa0dec628d55f3b801f7220f93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600823, "uuid": "541c0307-11ca-4168-a613-71da2e4a9193", "value": "6144:b4A8eyBxGOBnKwOCd2gya6tglz2XD98v6OZrfdAOl7jsFcKa:bl98/OCd2yVlQSvlFEuKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600823, "uuid": "9d906d1a-bf64-4d49-8452-7de449c5e104", "value": 424335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600823, "uuid": "08004f6a-51e1-4316-aca7-a96ac1dd380a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600823, "uuid": "206c0bc7-bbc8-4f14-9d5a-4afce9733f24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1d9fd1-d5c6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624633219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633219, "uuid": "026171a7-9296-4147-ac50-fea1d6730db3", "comment": "Malware payload (AgentTesla)", "value": "906ba239b210353bc1b8d052af431f99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633219, "uuid": "30ee71c6-e5a8-48dd-a6ce-8956fbcdc5c0", "comment": "Malware payload (AgentTesla)", "value": "669e6bcb89355a0e4e293c60f3afd47c671f0d01e7cab9fe00fe48b7e878cf90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633219, "uuid": "b3cecf07-ba24-4198-a46e-cd149a4c7d38", "comment": "Malware payload (AgentTesla)", "value": "ed0055db940a4cae1f1f1701cd975c49c57eff0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633219, "uuid": "a3a98db9-5ce0-4c91-a206-fd58f8d8d34c", "comment": "Malware payload (AgentTesla)", "value": "9a7c94f35ddd419cacef1d3d443269cbedd5a74f56101a5f0d290b0baa415d2ef2ac7e289294aff5c4f7a76f72919569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633219, "uuid": "374aede6-0798-4924-89a2-e5c31669726c", "value": "7AD4D51BA5FD5AB9EF09E37B10854DC41AB09D21698DF40B77AD78798F38022AD0F90D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633219, "uuid": "828d5b51-d906-4e7e-8589-4d276c3090cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633219, "uuid": "3c95f7f4-2f06-4f40-ad63-b2978095c1fa", "value": "12288:+Cbn3Gsuyyrs9pSZaNrx/yUzk1kadojDAlmD:L3GsbmsiaNrdyU4ya2XAsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624633219, "uuid": "b03bbe50-1502-4f72-ba2a-4ade7507b4c4", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624633219, "uuid": "c2f703f0-43ba-45c9-be8e-4f5b713f15dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633219, "uuid": "c19f8511-5aac-4d0e-87de-e477b123c7c0", "value": "906ba239b210353bc1b8d052af431f99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35d9340-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624641736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641736, "uuid": "808da330-09ff-4038-8576-2774382b2984", "comment": "Malware payload", "value": "fc2142218de9a72bd4c82d6cd1d109ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641736, "uuid": "5a98ae1d-8025-442d-bfcf-f0ec42bf1099", "comment": "Malware payload", "value": "66cf7cd9325f3e92960ef151c8f97ae2065c514b64f606144938ef60eef3eb35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641736, "uuid": "35a3f99a-89d9-499f-a76d-6bf5e9f0e759", "comment": "Malware payload", "value": "4d87632d6d38339d5ad4134f0de272efc5d840a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641736, "uuid": "dc599143-c2e3-4241-88ba-56c4ff8d7c06", "comment": "Malware payload", "value": "2c7e8c075793754a13681a5db9ff6d94f2808074ef18e8ea12ae418dfe14edc4000d2f5b2c6ccb2d98e2232f53cc0cdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641736, "uuid": "a924c904-9a57-4ab2-b978-4443e4008f8a", "value": "F7B2D0A1214F247DCBC12C72D5DD4186B62CBBD8C056366D2A1043ECE2E302BA6FCE14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641736, "uuid": "6b7b8c63-0401-4fbe-8334-6502292046fa", "value": "384:/15dj7ZNe/MiyML/SMkkSgrshjMmrMpSoiF3N2J6GLHSckmPi1VxnoNkH5amdGUc:/rVne//3lRrshdjF3UP3aPVckw3Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641736, "uuid": "c03344a7-2399-4f1b-a036-0ce53c11d800", "value": 24656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641736, "uuid": "d47ba664-4936-4d99-9b14-45bd8b42a17c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641736, "uuid": "bbe420cd-5e20-4d9b-ba93-6d2eef66d1b1", "value": "fc2142218de9a72bd4c82d6cd1d109ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a530da-d5e3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624645956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645956, "uuid": "e137164c-4c17-4bd2-894d-85302fd545a2", "comment": "Malware payload", "value": "3e9e2e9218391d2b2b1e12d35c25f56e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645956, "uuid": "56882471-f0c3-41c0-adfe-aea31962b5df", "comment": "Malware payload", "value": "66db49ca182a2c915b9096a53c4c675d452b9fa6b23a0282fc0656ba55b18b63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645956, "uuid": "6aa05ff9-7efd-41ed-8291-976823568b14", "comment": "Malware payload", "value": "1b67757b890b00bb96381f63f3a858c1a9472c80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624645956, "uuid": "fa3a55f8-67c9-421f-98d3-dbb5714391de", "comment": "Malware payload", "value": "ada69d3e2926258cd93552750ffe7b9ff8d1b9d0110b04fe97c85add694cf5e5465525414073dfd7579d05a87b18ac1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645956, "uuid": "f3ef16ef-4ad9-4117-bfb9-7b61aad57b54", "value": "9DB4DF983BB85FA3E1BA47F956B16000C3FA792B653AE4494CC370CB05B5F104D66E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645956, "uuid": "1577a7c2-0edb-431e-92b5-c2626f25f6a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645956, "uuid": "ec7eb489-a56f-4a00-bfeb-615a5928fd84", "value": "12288:yY59i0bXTPQ3Ruc03NBQ0VuzpdVhvzQigEm:yYjiSDI3Ruc03k0VuzpdVhrQigT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624645956, "uuid": "3ac2c07c-51d8-4259-af56-4de1ea8cadb8", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624645956, "uuid": "c523f2b4-1813-4cce-8e9f-7533e0697649", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624645956, "uuid": "a86bf2fe-f127-46a6-bc17-25096108172d", "value": "3e9e2e9218391d2b2b1e12d35c25f56e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4f21f5-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651685, "uuid": "c4793d3a-5ad8-4302-a419-94c2e709a7a7", "comment": "Malware payload (Mirai)", "value": "54705e80b6fdff0c6409e8e2ff1b01e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651685, "uuid": "c6d59378-ed44-4aeb-b204-9a8e921b8228", "comment": "Malware payload (Mirai)", "value": "67b513b6d2df414c06396a097dd0c63757d95437e4a5cf30167de1f8bfe4a4ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651685, "uuid": "5af4dc01-0601-427e-93d8-d89a8d53240f", "comment": "Malware payload (Mirai)", "value": "3d9fcc1e74561aab00046d2c6e40c7b880cdfda4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651685, "uuid": "7a7e4d8c-a573-492f-90f3-d65daf590f85", "comment": "Malware payload (Mirai)", "value": "fc087d071718d37e90fd4620e7855a656b60a275aefbbe55fb5502e17eb1804cc5cf365e2a2f2cf458fc23095ec7b4bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651685, "uuid": "b88ce6ea-726b-4a63-b13e-71bd27e3a2e7", "value": "2FB2D0B17011F8B3C7A200779AEDCA43FA811EFCD0E8B3395469099DEAD5953AAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651685, "uuid": "a430599f-b2ed-46ce-a9b2-48339d7fa34d", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pWrhymdGUop5h7:QX9nxn8o9wnBoWzEQf2EjKb3pKs3UozN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651685, "uuid": "2030e725-f712-4d11-ac39-9af23f5af826", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651685, "uuid": "446ca326-48e8-40b1-aebd-b968eda66111", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651685, "uuid": "d6155da6-3ece-45ea-bc46-a7017c98c0b4", "value": "54705e80b6fdff0c6409e8e2ff1b01e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a040e38-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588194, "uuid": "9a9ecef2-94e5-4323-9974-40444b19fd98", "comment": "Malware payload (Gafgyt)", "value": "91446c2797922361c7c0e4baaffde7c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588194, "uuid": "d16415d3-c869-450a-9520-1f0cd074541d", "comment": "Malware payload (Gafgyt)", "value": "693613da982ebed1d541109f81b35afff6d3cd50d104e24b04d1995008af6570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588194, "uuid": "764041ec-c255-43af-adb1-d31185ab2dfb", "comment": "Malware payload (Gafgyt)", "value": "40aff1130e5ce1fc2097c4ee1185d3fd7296fdda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588194, "uuid": "3f748feb-c45d-4b9b-9871-7f2f167258c3", "comment": "Malware payload (Gafgyt)", "value": "9724b5ec7a642edbddf36372b8839972e576404269dc9ed8f1bfb9d2b05acd68ef48a3447a3a66bc736c23e6153aa2a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588194, "uuid": "79db2162-87f0-43cf-a1fd-b2d5c44565f0", "value": "F213F1C6B6B8758AEE4D0EBBF0CC51E30AEAF044A647C7DC17552CC909E095BB1CA257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588194, "uuid": "aef4cdb1-4537-4eaa-8a79-25714d4f0587", "value": "768:QkVHN/i9/aLQU6HmjO9C8OcnBy3F6LI0pBIP9+weWBWiPdqP:bQU6HMLIzBI8wgMdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588194, "uuid": "96b71673-c5c9-49ce-9455-c97fc2e515d1", "value": 43280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588194, "uuid": "e6633fef-cc8c-46d2-8663-6c1751886553", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588194, "uuid": "51efb6bf-38d3-4a70-bb48-13034a3e3aea", "value": "91446c2797922361c7c0e4baaffde7c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45648879-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624641471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641471, "uuid": "ef19b92a-a64c-48d2-988f-b33cf41747a7", "comment": "Malware payload", "value": "41382729d92d1abe6e2aa94371789d27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641471, "uuid": "f1030413-ae88-4396-8545-7dbc69591c70", "comment": "Malware payload", "value": "694434ca755fd9890dbe6f0d6da77849c486701471964652478b70644d27683b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641471, "uuid": "c4ee592d-dd6f-4f68-b62a-83f3e92f57f4", "comment": "Malware payload", "value": "15a98925fcd7c2afe1accfe40b20d021dc0da7c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641471, "uuid": "82671c2a-73e7-4473-a9d4-31edd46dbf18", "comment": "Malware payload", "value": "bd64c5008d8513464a21f6788f4a39e1f36211e347e3d032960b606ffd4d71598316a626b1a993808f3dae85ff91ee1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641471, "uuid": "6bf2dd79-8282-408a-8ef6-f3bd7dde18df", "value": "C3C2E15DC5E53C4AC99E0D3905ED2AA1A483F2C403AD6F8D17D48F7DEE6E407A2CE5A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641471, "uuid": "cf9c53c3-52d8-46db-ac20-35ca073be496", "value": "768:79LimbGjKjddK/wWva42cBh660DCoWR/v:71EKjnK/XvpLaDDCLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641471, "uuid": "465eb46c-f8ea-458c-9317-da61e7929205", "value": 27008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641471, "uuid": "ac830231-35b6-428b-bc57-88e2ee58c416", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641471, "uuid": "e4f28fb2-c450-4df8-8194-7bb9cc1346c8", "value": "41382729d92d1abe6e2aa94371789d27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a20263-d5e1-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624644961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644961, "uuid": "ecccf578-37eb-47f3-8a8a-d71718cf85dc", "comment": "Malware payload (RaccoonStealer)", "value": "290e771886673240b0e6a87c5c810a86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644961, "uuid": "c2cdad6d-8c2b-4e35-b6d4-9f30a6cf6cf9", "comment": "Malware payload (RaccoonStealer)", "value": "69560e95c91d0e4117cc932b14bf8ab4869c8a83ac0e48f509c6e642946eda02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644961, "uuid": "031831c9-e9f3-4d2f-8fba-c842db9c3e4a", "comment": "Malware payload (RaccoonStealer)", "value": "447c375b7960d773b3c8b93d3a875fc116a84751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624644961, "uuid": "6a396fac-3e62-4dce-92dd-b5a8a0f59440", "comment": "Malware payload (RaccoonStealer)", "value": "fba6b6887d03062d77ce54661c5a46bda1d3289e49e975013dae87ae8431fb2e384e7076fdd74b0e18f2c64abdf9af7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644961, "uuid": "32aaf67c-b04f-4c23-ad1b-44e7cd2a6c57", "value": "61A53C18697FD01960F3FE916EDCA8FADADE55D3240D743B106163278B22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644961, "uuid": "b87f627e-05a3-41bb-be67-f168e127992d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644961, "uuid": "b2c42598-6590-4cf2-ba30-91f068fdf862", "value": "24576:R9OaS813eWAz847WH99+eUWCMSsv5NGpT7jJKvBZW/82U9wiQUqQv80ShCPsaWh+:bmuv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624644961, "uuid": "09f60731-9dd4-4a69-bb12-05c1c1422ed3", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624644961, "uuid": "643d52da-ff80-4084-bfe7-04cfce61f233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624644961, "uuid": "f4e42020-0c9a-4773-8c24-4e5d64249fa7", "value": "290E771886673240B0E6A87C5C810A86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c03b84-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601580, "uuid": "4140425a-0b25-4f14-8027-e1925c8beffc", "comment": "Malware payload (AgentTesla)", "value": "cf78714d1f3b643e678ca835ac788f1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601580, "uuid": "c156af51-d836-4c05-b377-4878b30ed259", "comment": "Malware payload (AgentTesla)", "value": "69fe616030700ad9134941e501f79cc47026bac9202471f233d96c7596c8c31f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601580, "uuid": "59c2602d-e5cb-45d1-873a-7d6093f1e10f", "comment": "Malware payload (AgentTesla)", "value": "540e5eb2440d952b9881cb11b85936b1cd300fea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601580, "uuid": "a0db81fc-ce41-4419-9923-d689f75b075b", "comment": "Malware payload (AgentTesla)", "value": "5bc6e7619b9175bce922420a15861f3cbbcc6094bcce4e957f4cb65318fce3d4a0ca1a2844af52e36739f8caf34cba16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601580, "uuid": "1a9a55f1-ce3d-4eea-af92-1906ae805e1c", "value": "01E423BA7D2AD862E7589238B190D133BCFE77B5073F90B8690B9AAF51C0D90C557C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601580, "uuid": "6d9176ea-8ecf-44fe-9803-40216f74af44", "value": "12288:K9UOud/7M6GpCxJVfeE7lNFfQoMrabn/FlHuhrE1nAAykCrATNozh3f9Yite9:KaHFGpCx3Gmlar8n9l3KAyvo8VYT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601580, "uuid": "8c9ea982-ee7b-478c-902b-65bb5e527ecc", "value": 699418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601580, "uuid": "49ca928d-4429-4a2c-9cd6-f7e320fc91a0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601580, "uuid": "52370055-5dc4-4434-a43f-b3448af2d6a5", "value": "#CI-PL+HBL MBL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9119ec4e-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602943, "uuid": "2232b22c-7f76-447e-950d-9974fdc36faf", "comment": "Malware payload (AgentTesla)", "value": "b8204a87c95e8b949838d934dd781053", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602943, "uuid": "ce0d2912-7a63-4edb-ad4d-d084f648f236", "comment": "Malware payload (AgentTesla)", "value": "6a0fe8fa33fc34bd648c16ca69050ee23d2ea2bdba35016fc26b8ff0ce88ebaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602943, "uuid": "609e014d-c27f-4d84-9938-57d5ba3a1a55", "comment": "Malware payload (AgentTesla)", "value": "c9a0818737b330251319ac51ce737a0008250623", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602943, "uuid": "7b029062-33ca-4c3b-b4e9-e7347780f47b", "comment": "Malware payload (AgentTesla)", "value": "02438a40bbd4a2d2649beccd5ab4ee7ec53ba406291f6222253d5c05395ac3cff05f59877bdb7019b1f1ebcdddaa8213", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602943, "uuid": "42ef0496-daf2-4a85-84b4-01310e4a76fb", "value": "87E423160D30EEE41FA64113277C5665BBF2361146E013FD49A68FF09173FAF2A29B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602943, "uuid": "d8b2c6e9-f0b8-4a70-adec-bf82e45b5816", "value": "12288:o8MHNMGTHdA9tCpOTc2VDeT4Zrz4wvwqbMHymsvaIOQk6effZ3Pp5oNSD3:y9b+cgDrRlb4oask6effdpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602943, "uuid": "dc0d519c-d890-4573-bb34-bbeb84c2b7ca", "value": 683165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602943, "uuid": "55d7379e-a305-4fb2-8e0e-80e4198b30f1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602943, "uuid": "1aacbf91-930f-45f1-9784-512fce6eda22", "value": "Bank Swift.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c455e6-d5e7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624647427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624647427, "uuid": "d93d0397-bd6f-42ce-94c7-efd076205433", "comment": "Malware payload", "value": "784307274334e2f6a527d66d258ebf4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624647427, "uuid": "d5b65637-6404-43b3-9d83-e364d8a1f504", "comment": "Malware payload", "value": "6a6d545fd995dbffb75332ad4a05e32f20777410b36e633c42e4f6c8cdc685d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624647427, "uuid": "16753827-fe7e-4fd6-bac0-b1800f6fa2dd", "comment": "Malware payload", "value": "6e7882f260d11bff03c8b70ea6ee2f5262746c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624647427, "uuid": "1bacd965-74e6-4ae8-ae45-63a2d37f77df", "comment": "Malware payload", "value": "8c099769347848fb49a8f1f9292514a9d8065a4ba089884d1f396686b6fc8354b1a98a04a94b951b78d73f29023443d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624647427, "uuid": "f2532280-eb70-4d14-8db9-fe8a79107584", "value": "1D057D63BA928877D16104785D0BDFB4A91B7F10653864C1ABF02D6DFF3B7607A3908A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624647427, "uuid": "00b8aaef-fef5-485f-89ea-f958eec2d364", "value": "6a48f924a282039a5db311ed672f90ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624647427, "uuid": "f65bc019-4d07-4f54-a6a7-c60b3424210f", "value": "12288:7NgPr+1U2uRKPWYhvkmeYSd4FlAj06s1LCj+jSiuPBR5lpbTYwOQU6/Q:7NgKxw/UcmlTnxYj+SBR8bwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624647427, "uuid": "8ea69edf-327d-45b7-aee6-176dc30773fd", "value": 839682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624647427, "uuid": "c203d41a-1f3b-451b-ae42-d03618669804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624647427, "uuid": "e0fe6815-e76b-42ab-a5b3-77dc16fe562e", "value": "Gnqavfhmcsecxlwdiltkkverstraextmrm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf71b2e-d5eb-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624649429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649429, "uuid": "70ead16d-31c3-4f16-9e57-ab513d6a818d", "comment": "Malware payload (RedLineStealer)", "value": "1d5236140d1ed290e2ee8764cc9d9b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649429, "uuid": "c8c3918d-32b1-49b1-9bb5-c0603bb28582", "comment": "Malware payload (RedLineStealer)", "value": "6b1901a0869ace34caf5f28585e7b47df631708b16a55e4c9c0f4be765bbbaef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649429, "uuid": "358489a8-c4a5-49fa-be93-e6a135f5a3f4", "comment": "Malware payload (RedLineStealer)", "value": "79e8dc84460d2effb2767c21fa095addf3039477", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649429, "uuid": "cbb9dc4c-5b34-4afd-b084-15ac02c63770", "comment": "Malware payload (RedLineStealer)", "value": "f5c7f42e87db5c1fa92f57f84e7c2747506684efdb6d507a4cae3a6a6abf1be8e99b6e10edab2ea98c7e6936ad6fa4e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649429, "uuid": "63f4333d-8c5f-4072-9ee0-0a6323e243fd", "value": "E5F53395ADB23392C8C2517A15B11ECA3D66D250604FF88D33A7D6C6FF31281EAE7B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649429, "uuid": "a766d000-cf6b-406e-8777-e96780e38095", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649429, "uuid": "3b5c2d9c-49b3-4ed7-8aef-7444904faef7", "value": "49152:EgHwoxNXL4pA2fSAF4OFGyIQILngOiy2pgnPIJEn6Tz5NBM5yupgbpCRdrZBWs8W:JQoDPAX0lQIbgOFkU2tGyMDDx8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624649429, "uuid": "ceb6cf1e-ca86-4b26-b406-640e713ba4ae", "value": 3336565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624649429, "uuid": "1698a85a-f9bf-4f00-9c6b-c0465c54b12e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649429, "uuid": "6355b383-5e1d-40e0-805f-5fd50fe48401", "value": "1D5236140D1ED290E2EE8764CC9D9B30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141746cb-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603163, "uuid": "c76b32db-4932-45e6-8d1a-6b99def84766", "comment": "Malware payload (AgentTesla)", "value": "bf9488fc2b60f274199ce0f4a678bf20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603163, "uuid": "3b3b862d-f505-435e-8801-d02284fac294", "comment": "Malware payload (AgentTesla)", "value": "6b97fee9e0dfc5d4a87b180330869a09035b5ef04fe2e7ce7c47666166636432", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603163, "uuid": "767e5cc5-1bf7-41da-b89b-33e5b8ea0904", "comment": "Malware payload (AgentTesla)", "value": "fabb9ca7a60e275e82efb0316dbdf07e375d48ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603163, "uuid": "399f1120-6e64-4f4c-a9cf-cfe8df93d2f0", "comment": "Malware payload (AgentTesla)", "value": "4c9b73882dd25db4ba24582441d681d851f97d1923fcacd25f2ba10ffe09191b3dfd501639fe8ed5cbf08e73b75842b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603163, "uuid": "7ee3d3a8-8b85-449e-9b26-589ccdb09b94", "value": "E635084BB94076DFD057CB79AE560C74AF18352E974B929F40230DCA6A1CB63CE0A1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603163, "uuid": "d677e99b-f8e2-46da-9be1-2fd07d3e1404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603163, "uuid": "45a0f07a-d429-4905-ac18-b028bad3da19", "value": "24576:II/nhCh0hJhphVh4hhhAhW3uD7k8pTYJqrn12fQhXhAh1:PhCh0hJhphVh4hhhAhWc7k8WA12YhXhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603163, "uuid": "1014c21f-c26a-4641-82b0-899c3664ff30", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603163, "uuid": "5c5e9044-2eee-468d-8d51-32f62b161b69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603163, "uuid": "e589af23-86b4-4eed-b9ba-0ec6507f37c2", "value": "SMK_INV_22032021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cb7d96-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641732, "uuid": "5977999a-a387-4801-b764-9361911648e2", "comment": "Malware payload (Mirai)", "value": "f1230b19f443674ef473f05bdc6474e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641732, "uuid": "85beaa9f-650b-4700-8b33-294e21728ad9", "comment": "Malware payload (Mirai)", "value": "6b9f1e3e5df9898a21d412a8ca3c1e9d492178435ba5bf8ee3bc05b599576f89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641732, "uuid": "e1dd5634-c952-4c3e-9709-d43403d586f9", "comment": "Malware payload (Mirai)", "value": "5766b928f4a0edd81100b810df5c94539c1a3b35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641732, "uuid": "c5bff1de-3172-43b5-9614-d5083ed08be4", "comment": "Malware payload (Mirai)", "value": "47019a04775d20b3421642639d70884c7e980ebaa504e06fb4a14282609c25049c7dadd9abcd9a44087b324e95e51ca7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641732, "uuid": "8ec1cbea-ae5a-4383-91eb-7f1e07c2454e", "value": "5F831846F8818E16C5C513BAFA2E118E331317B8E2DEB2269D14AF2077CB92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641732, "uuid": "cb900257-1d31-404b-809a-d9c936e65d96", "value": "1536:2Rnx6mu/B72ccGKj0ATxSaCAHIkgqPDIVFmEiN0XHuWXUnaC4tL4IJi9bXVDdu1H:q6poGg0KxpCtkgcDcnimXuKMaGbXVDdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641732, "uuid": "3a1de9e3-2471-42fb-a342-cc695a5402fc", "value": 87180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641732, "uuid": "d581cef3-de8c-442f-93bc-5ec86f86f020", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641732, "uuid": "fff3f0b2-a801-4bf3-98f3-1cb17fbd3bed", "value": "f1230b19f443674ef473f05bdc6474e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a255f3-d5c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624633517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633517, "uuid": "e8094cba-017c-424d-a638-700512dfb63f", "comment": "Malware payload", "value": "d337ce3673027b5ada079afeade07a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633517, "uuid": "8aaeae8a-af9a-4bb3-9166-11edf6222ed0", "comment": "Malware payload", "value": "6daa33fa17b113a10a797fe9fc170e11170549c2ca5eb609f0f9d9f64283abac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633517, "uuid": "21fcbfb1-75d9-4cf5-9ffb-5912f9fac545", "comment": "Malware payload", "value": "2e1df897475fb1877a4121e488071df3522b5368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633517, "uuid": "9a5c3f95-876e-4928-a0d8-193412cd2831", "comment": "Malware payload", "value": "fcdadb3531c06e1cf2a10f0d6ee6ebf114bb2bcbe8379a99857da8d24eac3768025bf6fd132110f5673ba70d103ab2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633517, "uuid": "f52f8986-5612-405d-83d4-606e8ffb92ce", "value": "15C3E63BF3C00489F829AB723567D7F16357789A0F07465B7188A36A6C75E302E2B947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633517, "uuid": "08f0d19c-baa4-49e6-9a18-4466267fd836", "value": "1536:2hbLuXzqWU58g2G/fLVw5yuf1SUj9AZNworhyioFDnouy8VD1:2NuXzg2GnZwAufi9hohoutVD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624633517, "uuid": "3c9cfcb0-2d7d-42f5-a41f-c6f8ee10ecf6", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624633517, "uuid": "d482bf77-8d5c-4cd9-adb3-9203f79d3c67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633517, "uuid": "53315a33-039f-46ae-9289-29bba7396b98", "value": "6daa33fa17b113a10a797fe9fc170e11170549c2ca5eb609f0f9d9f64283abac.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8307f0-d5bf-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624630348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630348, "uuid": "060a52ca-2d37-4a06-b3be-f1e085eb0a14", "comment": "Malware payload (Formbook)", "value": "f3c9093843cb99abb526c24e5d5cb8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630348, "uuid": "c24588af-88a3-473d-ab2c-1996ea4a2eb9", "comment": "Malware payload (Formbook)", "value": "6e71e82dcb056af810baae26909b712ec2dc1610bbf8ebbee00b62f9bb2b3189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630348, "uuid": "9d0e3f6f-4636-4dd9-8211-1a85f5211177", "comment": "Malware payload (Formbook)", "value": "d63fc0888cee40b90f2dcfb96605b8720b60736e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630348, "uuid": "5845d881-a3da-401c-ba52-9b28b340d3a5", "comment": "Malware payload (Formbook)", "value": "740db2207122c2b820abb33e3e7a0d49b5e3b67045ec1be278e3025341b92f83f6f61b6b32cae19bc41d1fe03241a36b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630348, "uuid": "9d205a59-ffaf-4ef4-a197-f76220232731", "value": "32341215FBC152F3E6A305B209E353B6FB79004D5263B5935BE00F3B2E5368AD968782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630348, "uuid": "77da38cd-9da6-40ae-99ae-24135e4beb5a", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630348, "uuid": "4d1be07a-b64c-4560-8948-f71abac0c5de", "value": "6144:sTqjF9xMIMgoQS636xTz6bOrmKOUbAuQ+d:ssxnS63KrRAuQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624630348, "uuid": "283ce97f-1d00-403b-8794-9d68a043bfc1", "value": 251432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624630348, "uuid": "46a39003-93cc-499c-a4f5-f2415cc4ad16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630348, "uuid": "7ccf5ab2-0e8e-4232-8205-7f00a3eb9764", "value": "Invoice confirmation & NEW PO for 2 sets of items.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30810db5-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624601493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601493, "uuid": "add683ee-3f64-4dea-a04a-232167890d19", "comment": "Malware payload (Smoke Loader)", "value": "acdf555b283f3ec7382df24bd414f391", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601493, "uuid": "4c992c28-2eac-4f6c-ad40-2dc9eda15e03", "comment": "Malware payload (Smoke Loader)", "value": "7043c30db0e615f64815652081a27cc0b50596543ad25b03ed4faae4162ff0d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601493, "uuid": "c6af1ebd-5dfd-4e13-a73b-1356df6134d9", "comment": "Malware payload (Smoke Loader)", "value": "ac04013c0f819567820a1ec970b0afc93c124d53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601493, "uuid": "1a420af6-9453-4119-8e6f-51ea0844c82f", "comment": "Malware payload (Smoke Loader)", "value": "e79048930832fdff1d1c08905b351e1d85d6c5c4a534cd4edb35692d12ddb1980938cb14cdac41c7532c2f9aecd3ade6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601493, "uuid": "94fe6b86-c947-40db-819a-da1a77617b67", "value": "3F748D00BAA1C035F6B312F88976A36C993E7EB15F2440CB52D5EAEE56346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601493, "uuid": "4083b022-3bd9-4d9d-92de-c56badf09b11", "value": "a8fd13cfcead7aa4bc2d91debc97c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601493, "uuid": "91cb1148-20e2-4f0d-97be-c467364a5f18", "value": "6144:g7FfdFCAG+ULJHUUThiJG0Lbtogcka0tYyJ7w1KqDZ+xLlKk:8fdFCAG+ULJHUUSPLbtoL4d7Fo4Ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601493, "uuid": "f0e4685c-576b-477b-9954-7a8e14c97a6a", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601493, "uuid": "309fa0d9-fe46-4d0a-8758-db3445b90a14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601493, "uuid": "57432751-4c2e-49c9-865e-8cf9162d7f53", "value": "acdf555b283f3ec7382df24bd414f391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb8ff93-d5ec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624649912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649912, "uuid": "3134233c-3a19-4b9c-877b-67a397ec96b4", "comment": "Malware payload", "value": "b14c3884704a0f55d94b8046e241d82f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649912, "uuid": "114cc2e4-948b-4c01-9669-44f1f57f5c73", "comment": "Malware payload", "value": "7088d13f2ee39eff00830e6d851554b4a38065de5a661eb089f2226c60131017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649912, "uuid": "daaea3b2-d2f5-4b03-a60b-f1b39826d9e6", "comment": "Malware payload", "value": "99715c5cf8f504679d4be2bfb871e21e6d811863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649912, "uuid": "55f9170a-0359-4e01-9843-58a4749cb71b", "comment": "Malware payload", "value": "c6996b54ee21ebd853676abc99723009d17d32ae95d8ac0c46dd5abea0c28f225b00cb66deda8f6d440de08141988fec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649912, "uuid": "f3f39298-bf25-4eb0-b8f6-6d54c54cd763", "value": "7792D193D912BE92F3BAF9B5E173AC33719060489414F2536035794BE0EA616397AD24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649912, "uuid": "c438abb1-3416-4282-a9cc-2abd1c0de065", "value": "384:RqQ3bIqRDQqbfZS900oOc4I2FPc8fXBgQhwwR3lhuNp+aPGgSNbU4aPL9UhWj:zL1QqbfQCX4I2FPcRaTNUQWGgiS9UWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624649912, "uuid": "deebf2fe-aefb-41fe-a864-4685414f9a8c", "value": 19840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624649912, "uuid": "264cc0f6-c4bd-479c-8d6d-c7670233aaae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649912, "uuid": "835d06c2-def8-40f8-91c8-2a1d18e8c21a", "value": "SecuriteInfo.com.Linux.Mirai.BGU.5229.6777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3353cb-d59a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624614372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624614372, "uuid": "a75e55fd-381d-4fb6-a700-2748459d744c", "comment": "Malware payload (Formbook)", "value": "33351949749d92f0c1fc87e7529e59d5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624614372, "uuid": "7a3ba50d-2e43-4ec4-9081-227005f7dcb9", "comment": "Malware payload (Formbook)", "value": "70bbe5e2d1987ad7bf4cb067ef7c2447ef8fbc668078e725abd14d49857a8d3a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624614372, "uuid": "96603b81-670c-4f47-9316-cf9b0b7c61e9", "comment": "Malware payload (Formbook)", "value": "0796cbee16089f0d582fb06233f52898b0457449", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624614372, "uuid": "5e67ef73-d654-4b67-ba49-b2cc4702e995", "comment": "Malware payload (Formbook)", "value": "f09bac76160233fb19df60c9edfcf8279faf71358585fc70f4e5adc8ce8d591a468db683b4c41fbfa2b1d548edd2b036", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624614372, "uuid": "68ce209f-7b2d-4b29-99c8-4777c3069e01", "value": "C9441268B2D0D8B7D6529A700E728B7EE773DD000B56B7039BD83E3D1DB24978D16192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624614372, "uuid": "2fee9d4c-9c59-4586-ba99-0edd7838558c", "value": "6144:+EtTqjFalCtjOw0B+oJTij3iQnJ+rgyQPz0zRLJauGQ2TRJPiJvT:+E9flvXCj3iKJogT0DbGQkRJPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624614372, "uuid": "ec2ade1a-a50b-4fbb-a7c0-81ca26c3b90e", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624614372, "uuid": "8cc45753-51d0-4c97-a8a7-e29b6c33562e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624614372, "uuid": "f1d2c398-5c98-4cf9-ae2e-b9554eeee11b", "value": "33351949749d92f0c1fc87e7529e59d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1730a0-d585-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1624605295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605295, "uuid": "3b5f1a25-abbd-4edd-9604-b6a7fc60a1e8", "comment": "Malware payload (ArkeiStealer)", "value": "adaa653ea596841f6ee156da11f9c878", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605295, "uuid": "29946607-88a1-4505-88fd-a2462bff9a13", "comment": "Malware payload (ArkeiStealer)", "value": "71407dd4cf7787d2529b435a8e24e0899b0b2e5ab0482abcd507ecd862358923", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605295, "uuid": "65a1e7a1-0e54-4113-b653-84691ddece07", "comment": "Malware payload (ArkeiStealer)", "value": "b05b2a867c086b6841eae23e684407ff4ece3232", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605295, "uuid": "74201e60-6784-4c84-99a3-76eedd0959cf", "comment": "Malware payload (ArkeiStealer)", "value": "d813ab65f39453256681690086e00f25f5c2e0079016a5067c269bd96feffa573fdb5c1cfbf7514ba0dab7d49a5101f9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605295, "uuid": "fd4d971b-eb6c-4dec-aa4b-2c17ab8350bf", "value": "0AE4E0007AA2C036F9F312F4A5B9A678593E7DF15B2440CB12D5EAEE1A389E1DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605295, "uuid": "3b9b80a4-eb3e-47e9-a835-f80eca9def31", "value": "762eb19010c0700eaa21fe941afb9920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605295, "uuid": "e843b0d3-c87b-49ef-857d-2d4da45e086b", "value": "12288:oc50IrE11naiBrn01Oy6s6TBseUS7STLy3IfpfI1+kjOo3xM7:h0IA11JIwy6NseUS7S3yOKx3xM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624605295, "uuid": "2cccddf3-ed69-478c-b0fe-b8d3e075fbf9", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624605295, "uuid": "e1120e4a-411f-44ae-93fa-ebf6304ca7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605295, "uuid": "09d4eb26-2910-4823-99d8-b3e87302d329", "value": "adaa653ea596841f6ee156da11f9c878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbffe87-d5c9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624634771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634771, "uuid": "772d473d-e6d3-4838-89cd-8eacf4c7cd93", "comment": "Malware payload (NanoCore)", "value": "20bd53efc0f0b05bc0f16816176d1b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634771, "uuid": "ea3bb71e-1388-40ca-ad14-86c3d493487a", "comment": "Malware payload (NanoCore)", "value": "72efb5cc1d4805e861acae7c3234b0ebcc718a5e84a224f1c17dad3ace76c9f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634771, "uuid": "bb3973f4-bfe3-451a-9fe5-03410e64bbdb", "comment": "Malware payload (NanoCore)", "value": "a27f2395d4fe41f63bff7d44050d3b6c88cd0f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634771, "uuid": "b7ce00df-982d-4cf6-a59d-1aabdd0c799a", "comment": "Malware payload (NanoCore)", "value": "7dba9575ac6f08ae4feb7961f157fa9ca2905d30adade2ab9d9fe3cf1ea7f792c2ba1ccda16c591fb48042e0f737f64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634771, "uuid": "3a9cb386-9809-4892-9706-14532ec585a5", "value": "23C4BE77A550D82DDB33C53C30A0E418BE636E036DF1815A53D8BBB96A727423178F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634771, "uuid": "16e095ba-daf7-4f39-a45a-26961002e6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634771, "uuid": "5562c638-e166-4cb2-9792-f2479c844101", "value": "6144:ChY7z8Ovg++TbHXt3N3C28J9o+5z9DlrZLi/BtzWhHwNxSpTUQNt3ThxkdZnQqMT:7W7d3s28/5JbEtSqk13Ths+T34Ulqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624634771, "uuid": "843c3f67-8c14-451d-8f8b-95bec69b7ee6", "value": 571280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624634771, "uuid": "1976d91b-6290-4323-bd51-b2db0a271b2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634771, "uuid": "b81e5670-bae0-464d-8261-05ccdf9df953", "value": "20bd53efc0f0b05bc0f16816176d1b41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbfcaaf-d5da-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624641995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641995, "uuid": "39d2cc01-c9e9-4aac-92e4-77d5c8a23a5c", "comment": "Malware payload", "value": "1852bcbc27f4dbdadb9f3ec467f47250", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641995, "uuid": "f571b696-3db6-4bb8-a946-8b41bce037e9", "comment": "Malware payload", "value": "7454a5404b2b8a379556a2fcfbfb3adca2789aa1d8471aa485a1d166c2cc5960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641995, "uuid": "fe37d6e0-3996-40d6-9870-805e88606092", "comment": "Malware payload", "value": "15c9ab21f1121e3b304b80a23a2d0c0fd0b44029", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641995, "uuid": "3f6ba652-2a29-473c-b5f9-989c8c9eba10", "comment": "Malware payload", "value": "fc3891d104c1491613a4c346bbc775ccd7643b2e7dbb87739c79ebeb661709f9611adc723ccc2ed819afa5b633e00bda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641995, "uuid": "360ab3f4-eefc-4bdc-a508-0b928143df51", "value": "84D2D0A3B061D1F2EEF06CB9EAF04003665857B0D0ABF244B65C559AEEF630246F7913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641995, "uuid": "f7bf3b2f-2b8d-4eb2-9db1-9c8af79fd5fa", "value": "768:7jc1tqVgyB5mWRZQB5fSOWfLJY4VjTnVbtAncY1N6Dvh6nTq3U7PY:/czqVz3mWvQ3fbWDVjDVyncY1uAnnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641995, "uuid": "9190f7a6-db28-4ccc-8b04-485334aafef6", "value": 29108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641995, "uuid": "31515dc0-063d-4653-9074-305e9ca044de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641995, "uuid": "e2859649-ffa8-44b5-9be6-19144767f66a", "value": "1852bcbc27f4dbdadb9f3ec467f47250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd29effd-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624652033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652033, "uuid": "cb3479c1-5f13-4a92-b549-f5be93c73278", "comment": "Malware payload (Mirai)", "value": "c5804a95ffd6150e4b5877ecfbd59284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652033, "uuid": "aba1bb5b-84e2-41d8-873a-96ecbdf8ba29", "comment": "Malware payload (Mirai)", "value": "74cb151323c2dbbb215e14d01081425ae012b3443ec990e2e4493895180602a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652033, "uuid": "ebaaf184-e729-4b92-8525-1ec3ae179b72", "comment": "Malware payload (Mirai)", "value": "8b03a7838a99b57154b3d1d40e2b58bbaff42cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652033, "uuid": "bc63ffd8-61b1-420a-a9b1-9bad1791e4c1", "comment": "Malware payload (Mirai)", "value": "657e8f75b1edb0581c7f8bd6935f9d844e3304ebea530243c9e868dc141a06900947d36327a84f094627541e9b5f5ad5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652033, "uuid": "76b2d181-4944-4991-897d-6c0979a7d952", "value": "DB233A41765C0E47C1A65BF4293F27E083FEE9A020F4F588260F9B868275E77518AEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652033, "uuid": "6d172531-3e78-4628-a919-c32feb8bcd1b", "value": "768:BUXIvf3MoLmX7TL7xEzPe4DVXRo8wVOENPsV+L+S+iBCBqO0LPttABU0sBW7pEJ:1f8oLLS4DFqOENPsVM7+0QMmvsM7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624652033, "uuid": "f935fbd1-4da6-4ee2-8cb8-d79f993b00c8", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624652033, "uuid": "d70d10a5-341b-46c3-a46c-6379e13230e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652033, "uuid": "307ae686-2c21-497d-9144-2b579fabdb96", "value": "c5804a95ffd6150e4b5877ecfbd59284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f8696c-d5f0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651422, "uuid": "8288de89-25db-402a-8ad7-0379fe3b6a41", "comment": "Malware payload (Mirai)", "value": "6a7bbd3eb0091573b90b7290b483957a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651422, "uuid": "1199a99b-6fc1-4272-8787-48e912efed2e", "comment": "Malware payload (Mirai)", "value": "75cfcaafeb785ef0eccae16c511166993ed12bbf19625ec9554fdf7ce0681719", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651422, "uuid": "f94aa64d-8cfc-4156-b810-2773ed51e7b7", "comment": "Malware payload (Mirai)", "value": "2e6d5d70386984ac97887d187ec6a3ef74ef5893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651422, "uuid": "376eff11-8788-40fa-8a9d-fea7ad79898c", "comment": "Malware payload (Mirai)", "value": "693cea50cee43dde9ddbf14bd80acd0a65c29be8a0ca58b10f6cd010de8e22b1225d6cf6b34bb0dc7202fdd0bc6a9b5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651422, "uuid": "bdc27e40-b9c6-47fa-be8f-2ea660021e86", "value": "83335B21A8791E2BC0D0F87A62F78729B2F50B0E25A88B4E7D620F4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651422, "uuid": "80177f8c-ea19-46f4-a76d-e7d4ad156111", "value": "768:0790+oMWXq9SsZdSSPTDroYv7MWMyB4GIHXmO+h9OS4FyJ:M90+QXSSsZXPTDroYvAZyB8khP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651422, "uuid": "30c76a86-fcdf-424a-9df0-28d879daa51b", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651422, "uuid": "b01c5e51-2b7a-455f-8e35-334f50b378e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651422, "uuid": "ae8bfb27-1140-48c7-b671-f165242f3d46", "value": "6a7bbd3eb0091573b90b7290b483957a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5172e9-d5da-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641989, "uuid": "21f142ad-1fcd-432c-a95b-2e10c0a14f87", "comment": "Malware payload (Mirai)", "value": "e4bd689998070d04be8063710be8e0ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641989, "uuid": "f2a38106-1b54-41fb-83e0-b79f009ac4d0", "comment": "Malware payload (Mirai)", "value": "75dea68d9dbf6e170fa8a8c40ab54424d13967bd88889d624332c1ca83fb3c1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641989, "uuid": "89cdc90b-3010-42fb-b41e-9b4d8b76ea56", "comment": "Malware payload (Mirai)", "value": "29b60896261d34f4de855f49337ff3776fb38982", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641989, "uuid": "552e0116-5c1a-477a-b210-ac541cea7f15", "comment": "Malware payload (Mirai)", "value": "1b630066b40457a8e6046ba271c99ba43098c0ec6bfc32fd868e00af8147944f5a6911489a96749ecd1316b18f343c49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641989, "uuid": "7aec8341-a557-4a76-bdce-c50778936709", "value": "CD53BEB3C8192D58D65A41B4B0284E3A6B33F01452D76EF559EFC22650A3EECF50A3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641989, "uuid": "8a33892b-862d-4362-90cd-8472618c7f2d", "value": "1536:4/e/aU1ODyazF8vQEHfQ8P51c/kKe1Thb6+/CQI2K5:4W/z119vQEHfH4/LeH6IVK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641989, "uuid": "ca7e7f96-ccc3-41ac-a965-0a59d61fe227", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641989, "uuid": "0ac88ae3-471a-4905-b8d8-0a9644c571b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641989, "uuid": "359ea326-acef-4cbf-ae93-7f301908862d", "value": "e4bd689998070d04be8063710be8e0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdafe41-d5ff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624657804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657804, "uuid": "9799d985-0b71-4d44-823f-0d83b05a62e6", "comment": "Malware payload", "value": "8e6067fd802c5cac596f7bf91bd7e255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657804, "uuid": "aa2cee70-f78a-4a35-8f04-48ef485832d8", "comment": "Malware payload", "value": "761a2e999afac422bbf2879ffdbd2aea8f9adc8ced10e640d7ff0e295e5ccd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657804, "uuid": "b08adffe-7758-46bb-a88a-4e2918700e2c", "comment": "Malware payload", "value": "d25e4cb1263bf84e46851c819886393a645cb1a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657804, "uuid": "eaf35eb9-239d-4e83-ad86-bf865be65f6a", "comment": "Malware payload", "value": "dc65d70b8c86e3decbb89cd39a616d7508a33e01a64377895d01592f41fce25b290bf89379722b66a03b2c799d484d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657804, "uuid": "61954cbb-7fc6-4696-a354-f9b7d7d93e4f", "value": "7FF4D03426ED4609F1B77F795AE471968BFFBA226726D51D2CC102C60633E40CF91A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657804, "uuid": "2f6ebb18-aeaf-427c-be29-cfdb1fde8e27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657804, "uuid": "78819b33-044c-4863-a28a-0631ffaf9f72", "value": "12288:AujjPHHwHmUvKBkYdLvqniPB9YXo/7hGrlzV8Pb0EDzbrDcPYD1PehJOE0H9PuZ/:AMPwHTvHYdLyMMXojhGxUb0EXw+WhJOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624657804, "uuid": "a2abdb0e-ed22-45ad-95a7-eac67bb4d88f", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624657804, "uuid": "707a8a41-6584-48a6-a476-21b4ae7d128a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657804, "uuid": "4940fbc9-89bc-439e-99cd-5e1334c025b0", "value": "Halkbank.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3074812f-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588178, "uuid": "cb92c2e9-3cf1-4165-b473-8000bddf8615", "comment": "Malware payload (Gafgyt)", "value": "a51d9cc1bcb0dff2833cdbc6c60ade11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588178, "uuid": "0845ef6e-4837-457b-89d8-66b1c28a7afd", "comment": "Malware payload (Gafgyt)", "value": "766f6dcf8fe4fa8a89a342bb0d6015f07175f940746db7adcbb964ed7e6fe7a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588178, "uuid": "35586278-36ca-49e1-897a-75a483479006", "comment": "Malware payload (Gafgyt)", "value": "f230eb99ce0cb3034275d84ad81c5af0e515ae67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588178, "uuid": "9af0c97e-00de-4e80-bdd1-1191a57bd510", "comment": "Malware payload (Gafgyt)", "value": "3c34360684d5272a9eaafcc40262d0f90ce497a2032567779178ffd06890c21a2ceca2eac4146ee976bdfefa425122f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588178, "uuid": "4a08eecd-7089-4a10-aa57-202a8432089c", "value": "7613F1911ACA02DAFA57A4341BE207E03A710BF375A4DD06EDCDE561EE951716383FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588178, "uuid": "eab99e29-cb0b-40ac-9a22-ce55d0faaf14", "value": "768:Wfx44C4OnrfQts/qWkgDshzq4bEmDLGg4c9HXAinCDGGlkJgGlzDpbuR1JBZsm0O:3bQtgqWkgsNqmZLx4c93Fe0VJuH9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588178, "uuid": "1f821bf4-b305-4c40-a5cc-a4f422875ca4", "value": 42708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588178, "uuid": "ffe08b02-78c7-4d5a-8eac-5281b891714d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588178, "uuid": "9f2e8a1c-9f10-48f7-8a8a-fd3dbc35e82d", "value": "a51d9cc1bcb0dff2833cdbc6c60ade11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f51585c-d606-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660895, "uuid": "2a2c1516-f415-4ff5-adf7-dc6c23a4cc1c", "comment": "Malware payload (Mirai)", "value": "186074f08a94563c36dc1ba160b6aae5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660895, "uuid": "285a4f78-ca51-4b4c-a6a6-6d5d6c6e0cb1", "comment": "Malware payload (Mirai)", "value": "77595574805274483c3c99b45a6f69e4054b9d0c9000d842c4edee956793ebc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660895, "uuid": "14152b64-55e2-41bd-9d32-bc83e49602e7", "comment": "Malware payload (Mirai)", "value": "784bdb2a2abed74331338308ee155f86d991d518", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660895, "uuid": "2fa94ae2-9f6d-4da8-ba14-1c9799ce307f", "comment": "Malware payload (Mirai)", "value": "f53035c336cc97b08584546aa0b57df599b10da3f0da33580a10e2d487b769a39318aa30de25d4049e4d6c10dcf68d86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660895, "uuid": "5a1bc60c-4881-4d86-8fd6-ae6132c2d1ee", "value": "D7630221DA8F96539EA02DB2CE12888F933E9364C5275133C7E8CB854F53556A6E34CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660895, "uuid": "0ae72e7b-135d-423d-ac15-222730841676", "value": "1536:HISykp+CpyaGfU+OR15418S3dDROcB0L8BWXAlwaV7m239Oj1:/xQaGs+OR1GCSrOjL8Bw87m2W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660895, "uuid": "68db4e31-35bf-4e8b-a0aa-1594e3dd2f4f", "value": 69068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660895, "uuid": "bc8ba3fc-ca8f-422f-af36-2ed623ba4264", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660895, "uuid": "3fcc3957-7c80-435e-96a2-c56ff067be68", "value": "186074f08a94563c36dc1ba160b6aae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0a4a87-d5c6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624633399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633399, "uuid": "b58a5f32-d737-4899-a1aa-c86eb4fd2cd4", "comment": "Malware payload", "value": "3a662807345100a9670e710c8616d1b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633399, "uuid": "e4b68f31-e871-4773-942d-2d636b0d2781", "comment": "Malware payload", "value": "78d69d13a0b072d4f89ad34f4ef07d84917585a5b1d921fb011d8f650ffb88d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633399, "uuid": "65afb3f1-f59c-4863-bd76-8ae5a34e3674", "comment": "Malware payload", "value": "0f3b3f0f0a877d9f1ee410ab0a52bcbe0b64356d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624633399, "uuid": "90abc76c-0da6-4cf9-a9d3-8c38293a7cd1", "comment": "Malware payload", "value": "61de12b8d660f757afb11a6bd46f6504155accf06d309b78130d0903d02c876f913074ac5d814c6c8ddd4cce0033690a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633399, "uuid": "15ae86cc-832c-4d89-ae94-aa0d1efb3937", "value": "77252BD1BDC48CD0C5B3B2F0E96AE76247682C25954942CE1AF83D7A49744A3EE1B13F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633399, "uuid": "10aec08b-ace8-42f8-aa91-78fed2a2c6ed", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633399, "uuid": "4b370193-4eda-4d91-92df-08e39c7d40f6", "value": "24576:1cneJVBvXAvwRJdwvZ5aXSSR0o6y2wr5DGR2:KenBvXA4DAZ5aXSSR0o6y2wF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624633399, "uuid": "cd6369b3-c05f-461b-8f17-e8474ecf9612", "value": 1033456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624633399, "uuid": "94fcef98-b34e-46da-b90b-51416114a6f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624633399, "uuid": "2f9dcc52-b0fb-43a3-80b0-b7ef0c2f19fa", "value": "clvb.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6721fde2-d576-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624599007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599007, "uuid": "f0b029c8-337c-48ef-be3a-c29fe6db8a36", "comment": "Malware payload", "value": "08c941d1513fbd692ec5bca821802d7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599007, "uuid": "cf1b0144-a744-499d-980a-c6cbea87d5e0", "comment": "Malware payload", "value": "78ec39a7de9f9119204032d417cea95b293cec990a187e6884a7ad7242ae0b0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599007, "uuid": "47934d1e-6ef3-4c2d-826d-c37c3af54dcc", "comment": "Malware payload", "value": "c48d7b142a7601ec4ab334ea057072325940e2c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599007, "uuid": "03348ea0-5130-4961-9fc1-30480360b955", "comment": "Malware payload", "value": "42016a68a09c510185e96ab8b76526970cf8090f77990b5491ae3ee0775272a4054d2fba29c12ef7b51e7bfd69bb1079", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599007, "uuid": "0532fce0-dcae-4a0c-bc41-c0989eb29142", "value": "FB73FE6A2060B158E5E308B02D06FD743A18A7359DC4A14DE473865CCF86AFBB4EDDDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599007, "uuid": "13265b81-ca4e-46b9-b27b-b267035cf898", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599007, "uuid": "bd515310-49fb-4e03-b2df-3dff11274ed6", "value": "768:L1jOF21h7G6ZQLPPjGXVcGp4lCljI5RKmkijCzrVTvAy+x4+hb:ZASh7zCLXjGXVKqjI50RrlcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624599007, "uuid": "98a0038c-2447-49c7-95ee-f4cb91be8d81", "value": 80224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624599007, "uuid": "91d18bf6-92c4-4dff-9335-76cba1102c0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599007, "uuid": "5c1b7a6b-57ee-4d6e-af4f-eb979bc0c37b", "value": "08c941d1513fbd692ec5bca821802d7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810de84a-d5dc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624642859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642859, "uuid": "28bb40e3-fd03-4a2f-a945-88fa56221d64", "comment": "Malware payload", "value": "dfbcb549053e6e727c970b3bbfb7fde4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642859, "uuid": "8c12285c-4c91-407d-ba14-ddb76d5f7ce6", "comment": "Malware payload", "value": "790142ed0d9083d3e8f6185b0315c165a9f6fdcac256cc2e0dbb58771df1a345", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642859, "uuid": "51c91179-0662-45db-8d4d-090d880d8ee6", "comment": "Malware payload", "value": "37c6a7a686ff46c5d41b9b6807593692ebe08ef4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642859, "uuid": "d16d3211-697d-497b-8340-7c5e5e1945f0", "comment": "Malware payload", "value": "ae984992aacf1355ffa0ca6da4dff53dae56f2f39dffd0346ca2228d6f9b008716cf484059a2e785c109ca892b1e88dd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642859, "uuid": "42df03d8-b88e-4536-aabd-daa84a960fe6", "value": "63C20EE7B6C6AC45CE59037948A787A06717FC215BA7838B3389F7161FB1AC08D0365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642859, "uuid": "0e2f8e97-5acd-458c-af61-c83ca175fb5e", "value": "768:lPpRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ8WK:Nrk3hbdlylKsgqopeJBWhZFGkE+cL2NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642859, "uuid": "475439bd-ebdb-4e8f-a78e-806d4976c293", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642859, "uuid": "5a7e91f3-ea6f-460f-ae8e-abcc22837758", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642859, "uuid": "a8a1881e-673f-46e5-be96-d4d29c0b584a", "value": "SecuriteInfo.com.Trojan.Malware.121218.susgen.10405.4966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e6031b-d585-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624605396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605396, "uuid": "e56e1f77-72ab-4d21-a0df-41dc9bf27069", "comment": "Malware payload (Formbook)", "value": "de9725509864ed9e9bf534c30dc3e8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605396, "uuid": "79beca5e-1434-4406-98e7-bdf8af14bde6", "comment": "Malware payload (Formbook)", "value": "799e54b28318ff884e20beae8e0fb5b7290b9c136f4b4e0e38765fb8792bb3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605396, "uuid": "c0bd12e3-7ef3-41fb-9702-2f7d679692a2", "comment": "Malware payload (Formbook)", "value": "f238b38da5159fe5950ec6f3d4e6ebbfe993bf03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605396, "uuid": "206819b4-5aec-42c0-ac61-60a35d711472", "comment": "Malware payload (Formbook)", "value": "36fc8ce5cc125076a483b1a3571a6a166180e9e89d49c3d26320f49bc046ed76ef853923076cc35ef0985fc2df47e9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605396, "uuid": "512662be-5b88-4768-a947-838ced12177b", "value": "98158CAD325076DFC86BC972DA542C24EBA0B4B7530BD203A02715EDAE4D997DF250F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605396, "uuid": "05ac713c-4773-4215-93b3-55c6c3d27212", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605396, "uuid": "8c7d0d95-a14b-4f06-8779-ba122d6251b8", "value": "12288:p7uw9lfVztMcgffGShU/kXzh9gjAkXNS+yq3E0Qyh0v5ZdhD53gDsiCYeg/z0Fe3:NPf1T2z7gjAkXNS0U0Hh0vNesm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624605396, "uuid": "5f869404-7e6a-4cdc-8321-e7101d6eadb9", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624605396, "uuid": "91c4bd54-8394-4b4c-aa6c-4c0ae81895d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605396, "uuid": "952fa4be-5196-4ace-8841-7b03a41c878f", "value": "de9725509864ed9e9bf534c30dc3e8db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a21c8a-d582-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1624604108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604108, "uuid": "ddf0fe3b-b7fa-4827-b6af-e7676865f406", "comment": "Malware payload (STRRAT)", "value": "866aeffbbef60f7c25db53faa6b5e96a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604108, "uuid": "5a648ea1-5684-49f8-8dd1-aecb549f5c53", "comment": "Malware payload (STRRAT)", "value": "79d2344df824e382ac33e4b0bbbef1090f8d451b6a76e9fa6370620c13d3302b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604108, "uuid": "14e57580-0c71-40dc-9ecd-8f90120fb68e", "comment": "Malware payload (STRRAT)", "value": "7f416f8790f541a59ee067734d5c59f71b563c18", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604108, "uuid": "b9b1d885-de48-40fe-a4e6-2a30f3fde6fe", "comment": "Malware payload (STRRAT)", "value": "551d376d1b19303dcd7ea7292dc0dc7b1715b098d56f6447c734f3011c4d34e886f4da966a698adf0f42c8df32392584", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604108, "uuid": "5caa0e1f-9e5b-4df6-84f0-e2031c56604e", "value": "E5B3CF4EADAEC5F8D40B953E11488773E92C05D8E80A482F37EE035A5D74EB9C6125DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604108, "uuid": "acccdfde-6d5c-4817-98d9-b8ba624bb1a8", "value": "3072:+fNwswuZu2NcSWyyvsYPurfIcr33im62gxvfOk79TWiLPR2:Hju0MckIu7hePLxv9BE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604108, "uuid": "56cc8b09-5f65-4f44-bda1-e522961c6358", "value": 109570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604108, "uuid": "75f5b76c-06a1-4f50-8bec-2663fc275750", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604108, "uuid": "c7f67362-6d16-499e-acae-0cd6517df9fd", "value": "CCF06242021_0004.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84db5e7a-d5f7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624654462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654462, "uuid": "08fd8f16-b057-4e43-9844-4b973af38ff8", "comment": "Malware payload (RedLineStealer)", "value": "dda213e302f6eb17de6be68bac2ec8b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654462, "uuid": "ae4a87c3-b452-4cc7-bdca-c423945edf1d", "comment": "Malware payload (RedLineStealer)", "value": "79df455913fcec38a00d44a092191c952718986f13b9d35b3ff99aa8e9987475", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654462, "uuid": "eae51b61-ae10-4066-953f-3075f160392a", "comment": "Malware payload (RedLineStealer)", "value": "182f7c67989c99bca00efcc7af183310dbf64ae1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624654462, "uuid": "d89754bd-ced1-4c39-8bc8-5e4b749976e6", "comment": "Malware payload (RedLineStealer)", "value": "521039a8e093a034334765b3567f110b0ca5392cc733809e8cd8029f41cbf83e7bfb336c2ba70b7369996b86c9fbd345", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654462, "uuid": "2ff40133-1770-4f03-befc-a866ee3e3e9f", "value": "9D459A703B6882E1D1E36430C08EB71245646CF2DAE6C5B3F6947F6A5B41393EF623A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654462, "uuid": "a257c828-39e9-418b-a823-ff32dfcbd033", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654462, "uuid": "a9cbd841-d041-46b7-b2f8-130d4ec95c44", "value": "24576:qk70Trc8XKA/OL9Lrd4rH6lhA8my2AYDAd3SP0QVghWlMnrYF5IZMlfDMUyyvgsI:qkQTA8XZw9/UYriA4AFSPGxCIZMloArI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624654462, "uuid": "bdef9704-ca36-45af-8c52-80e8246d2b1c", "value": 1267712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624654462, "uuid": "c1fff12c-5751-4615-8201-5c9f6b6fea2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624654462, "uuid": "5f63dc80-151c-42f7-b4e5-027c292be46d", "value": "dda213e302f6eb17de6be68bac2ec8b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015730fe-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651665, "uuid": "e0a94d03-9e90-4bfe-b227-eefceb9e9427", "comment": "Malware payload (Mirai)", "value": "c2d947bc3f8cd29ac9e9921e3a927f3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651665, "uuid": "f464579b-f9c6-4480-a544-2f74aaf7a470", "comment": "Malware payload (Mirai)", "value": "7c3dcd45823e1d245906ea859e64d3c9c05cc237c6d8e774333b8213ff6525d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651665, "uuid": "0ba3d1d7-e0dd-49e0-ad23-bfdfc89b981f", "comment": "Malware payload (Mirai)", "value": "9754c8e0443e7780315fcc5bbceca590701c0d66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651665, "uuid": "3cd25a4f-79be-42e6-a2c3-f9a74d20acc4", "comment": "Malware payload (Mirai)", "value": "e1740179d7f28ccecc3901b0710114b7b4108af378bab5956c7a9976eebdbed8dd47cf1cd01d5b7f6ad214e7a327b780", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651665, "uuid": "a15bea21-ec67-443a-940a-6bcf0c1af425", "value": "19330891BCC29912CAD42376FA2E01CD332663A9D1DF72179D216F1137DA82F0DBB652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651665, "uuid": "24a61c82-1206-4960-8dd3-71c63ed97fb3", "value": "768:B3oGCh6mppCK2FdThNutUGUiT5lBCC/L0wIefWBJNoikQCBNwoxBA1sH9AVE:9oGaTDC7F4Uitl0K0wIefAJZMxey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651665, "uuid": "857e732c-d422-4e64-8ea3-80cf5dd4728d", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651665, "uuid": "bd137915-6a5e-410f-89a6-265ed945bbb1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651665, "uuid": "a6aa898e-d5f7-4bdc-b2ee-7ffa40e745af", "value": "c2d947bc3f8cd29ac9e9921e3a927f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b22dca-d581-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624603587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603587, "uuid": "b3348d9a-9f97-4d6e-a6a8-521942d6e3f1", "comment": "Malware payload (NanoCore)", "value": "9a74c5bab15fea9b26ecceff53738610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603587, "uuid": "e3e566b7-a4a1-429a-a913-736897a890e1", "comment": "Malware payload (NanoCore)", "value": "7cc47c3cf5c707f9cfd18d0939807a15727834a4e08bbb6eae605d5f109bb77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603587, "uuid": "d4633a27-0dbe-45a8-8643-2d324c87f047", "comment": "Malware payload (NanoCore)", "value": "5e849099dac6386789f66e6655375c620f192c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603587, "uuid": "07b11bba-1467-4569-8190-ed5e005781a0", "comment": "Malware payload (NanoCore)", "value": "d3dc22361c40e9617ce2e35599e24c103cafe401d0d24d7dae8a69612f5b3e63ac5118e2510c1accca9e4cf684558ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603587, "uuid": "d7c56d21-dbbd-4963-a5cd-90c7655427e8", "value": "07A4010436F9532AF67AABF809D4754587FBB13B2622E54D0D8211CF5926F80CEA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603587, "uuid": "344190c5-ba19-4d7b-b2fc-fa65e46881db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603587, "uuid": "1e069aa8-708c-4efc-bebb-1038457989e2", "value": "12288:394/riJOK8n0FDsF6z/oV+TqZyAwRRMYoHyvQ:twikZUDsFOoV+2ZNwR5Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603587, "uuid": "ba56651d-cc77-495b-a0a1-dcc1fe525253", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603587, "uuid": "d5dd87ee-304d-4e46-bf73-fcc459cf8994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603587, "uuid": "9787f825-f5e2-4914-9f58-89e251aa4e22", "value": "Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b08549-d5fb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624656187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656187, "uuid": "98ce14ad-c97a-45d0-bfc7-3919277c0133", "comment": "Malware payload", "value": "008289b112d3fa5d332c78fd078785ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656187, "uuid": "884b090a-9952-4d96-a1d8-e92a4bfa8ead", "comment": "Malware payload", "value": "7d565fff35ffb8125421bfda8536fc4901dc9fb8c55fae9282e723fb6408deb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656187, "uuid": "9f557dda-ef5e-46aa-9822-283f5bc2d432", "comment": "Malware payload", "value": "07709704af9e86171617bd2356eb4700fc9a5c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656187, "uuid": "21b7222f-42bf-4a9c-ab78-cfcb24c958a6", "comment": "Malware payload", "value": "dc042a95f9c104234a3936c0b9bd9813da4db72e7d7729671c656debffc3993c3af0cd7274aecb62f0a58f6009b9b68b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656187, "uuid": "ac4fb19e-7756-4400-b11e-889a67966850", "value": "6B0527262EEB6F06E2367EF4C9D119C05E6BBF327622B43C9C71324D06725438B53966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656187, "uuid": "f662e071-8912-46b6-83e8-1175026ff3f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656187, "uuid": "0ac797ce-9278-4848-9b0c-6e7340a0dbed", "value": "12288:8JAAFJZaF75GF2Y8TQZPG4TFZxUqZyR8xOhsnqvoMBlLJljiBazTQapFZxKLAU:eA5bY8cZXFYiOh+ioEl9BiQfQapFZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624656187, "uuid": "117713d5-8713-4fe5-b6db-e430b1f96faf", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624656187, "uuid": "00d72a93-b7e9-4485-acff-df9ff40954d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656187, "uuid": "02a688e9-3ddb-4834-9a31-4a4856609043", "value": "008289b112d3fa5d332c78fd078785ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f5173a-d585-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624605616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605616, "uuid": "b840a080-af4c-4f66-8396-461161254951", "comment": "Malware payload (AgentTesla)", "value": "09f44a53432f104b1c1138effb89423a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605616, "uuid": "a3ad576d-750e-473c-a8eb-8e7553c6f750", "comment": "Malware payload (AgentTesla)", "value": "7df668f203f9b6dd4f4e1ddd141bbdc5498f55c692baf653284f10d7913de2d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605616, "uuid": "ce9d3b50-baec-453a-b536-985cd4a93bcc", "comment": "Malware payload (AgentTesla)", "value": "8d00217de1e5545b50c064956c86ed2ddfd645e1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605616, "uuid": "8b079cf8-b835-466a-b16e-1e2133dff92c", "comment": "Malware payload (AgentTesla)", "value": "a6d4d5fe3a5762812ba941f6f2dded2868c1e547a412a6412e1b35145cb9e476dbc8e93614bae1ec1e0cf3a253932e18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605616, "uuid": "9c677cbd-0f52-4aa0-b371-285d134d4514", "value": "E5C4232EB6C7D438E4A862370D1372A1B54C447EB960FC192DD3541E67326B88FBFA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605616, "uuid": "9375da17-17c8-4ef2-9440-3f4de948a437", "value": "12288:gMIfoGBcVsNSUOc9bWM3lQkGNLV3vWzhmn2YK2Qwbs2Ff0npyt:BIf7iGSUB9b53lW3Ozhmn2YKCA2NNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624605616, "uuid": "87550524-9a38-4f03-a78c-16a993e462fd", "value": 584787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624605616, "uuid": "95440802-d3c6-4a72-9273-6f4ef7518534", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605616, "uuid": "f4187588-8472-4613-8696-0586d37d1b76", "value": "SMK_INV_22032021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71763c49-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624617922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617922, "uuid": "49411d66-05c5-46d8-a311-96002dfab3a1", "comment": "Malware payload", "value": "b723f37c510a2466b51a44a09ce1de91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617922, "uuid": "3ff228bf-1ca5-423a-aba9-0e5881db62f1", "comment": "Malware payload", "value": "7fd56bc08ad3ebae244a899150462d6eb0ffaad711e378b4eb2710e51807efd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617922, "uuid": "96dec29e-6772-492c-ba7f-5dc606734a59", "comment": "Malware payload", "value": "bb0a57f9c8bd8a11d50319d55569594e75c4b9cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617922, "uuid": "38632b0a-947b-4878-9e80-405583bfec46", "comment": "Malware payload", "value": "fa39a249ea4e7b5c3543acaa2bcb25b6e3c68fdf732883d46d9bf2025ca00a9c54775612772e69a30ab071868ded2f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617922, "uuid": "5c4fb8c1-a707-4401-972c-f2c8c659fe93", "value": "8CF3906723A7C476C1C42230E4A1CB3B2368CD1717B4B256B4C6BE6BBD6B25D59BC2D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617922, "uuid": "45e6fc5a-437f-4bf7-898c-20e62804d607", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617922, "uuid": "0ac2d363-52e9-4bcf-9269-446036bc6426", "value": "1536:7sO4vWFQQHgdLwf5Fn1EgojOsCjCcCB+mDt2Y6hPHenvKvfBV/VWZyUdT:7KvHQHgqx5EcQ+mDtWeKzd4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624617922, "uuid": "5db4813a-106c-42ca-b030-527dfebf58d3", "value": 166400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624617922, "uuid": "668e179a-3fac-4b66-8c24-61b982131d26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617922, "uuid": "a9b93165-8389-46d9-ad0f-db66b811fb25", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.18609.32001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28faed87-d5c4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632404, "uuid": "716bb1aa-39f6-4351-a4ec-c7047e7af103", "comment": "Malware payload (Mirai)", "value": "0ceeedf40a11e6dea2efee8a33b92b81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632404, "uuid": "375de8f7-a47d-4a52-bb3d-323104e6128b", "comment": "Malware payload (Mirai)", "value": "80483b5e27c8be27233e5a0ec1f5e2dc36a7ee31c821145e8063f84a8d7c4564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632404, "uuid": "617e6b85-f1a1-4948-8a61-211762288624", "comment": "Malware payload (Mirai)", "value": "1bd23f4828bf1459fd50dfdd88f000b5cd7ea41b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632404, "uuid": "dda21e8e-f96b-4081-b224-f9f86123b85c", "comment": "Malware payload (Mirai)", "value": "fb93d659d5188a4c759f802ed27f72dfa03378095f19383d31dfd1f56b1aa089bc825d965524b0b433ddd1f3ccf5463f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632404, "uuid": "e4bcef0e-e062-4092-b399-14d86dce9c10", "value": "AF83184ABD819F01D5C912B6FE2E118E331317ACE3DEB2129D149B2077CB92B0E7B559", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632404, "uuid": "b70dd434-a3aa-4cb8-b14a-578dac56c7af", "value": "1536:6xnSHtXGJ2mM8cg8jBoM5bTGki0aH/fboMaioRkT8nRu15NYOH:dtXqp+Gwa8RkT8nRu1vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632404, "uuid": "b25db073-3950-437c-b0a5-b9a08bfa07a8", "value": 83084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632404, "uuid": "479d5798-ab31-4079-a0a3-485ff31446a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632404, "uuid": "0e274d4c-0070-46be-a314-dffc446a7f03", "value": "0ceeedf40a11e6dea2efee8a33b92b81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f5305e-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642549, "uuid": "c6fd53df-36e9-4c3d-877d-ebb1dd8f56c9", "comment": "Malware payload (Mirai)", "value": "af53dc7da9439e1e5cb700e949db4376", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642549, "uuid": "0021a64e-7f5e-471f-bbf3-4a8832580634", "comment": "Malware payload (Mirai)", "value": "815f12db13614efb01107096a4458fc5b7293b528f2d9c9665a70b9d56139ad7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642549, "uuid": "fef72046-a579-486a-8d22-b83a94fee9a7", "comment": "Malware payload (Mirai)", "value": "c027cc33d9ac4f9115e96d76a8ebab89d103872d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642549, "uuid": "d6264e6d-f1b7-4381-b47c-710ea92aae7c", "comment": "Malware payload (Mirai)", "value": "9b3905b52a69a4c699ba4a48f4342b9672144fb8c70b303517fc939c30725a74c12a986464a4fb79990251f1a96a4b89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642549, "uuid": "175a8d72-21dc-49b4-9925-53f056c9a42e", "value": "6BB2D01AC0AE3E74FED77D395941E2817B619BDF3A62CDC016C15A110722D6C1F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642549, "uuid": "83319300-5e4f-4723-8b58-094733387de0", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo0DSM4uVcqgw05VxQ:KApCdvwJr69VJoA8FZtxCo8NV4uVcqgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642549, "uuid": "a0209377-b3a1-4f92-9d8c-c60634307a05", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642549, "uuid": "462f85c5-2135-42ee-9af5-d05e9b9c9203", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642549, "uuid": "b37f2a45-859c-4f5b-864c-a0c3907b6548", "value": "af53dc7da9439e1e5cb700e949db4376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8cec2a-d588-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624606855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606855, "uuid": "f0b19121-c872-4ee9-951d-b94ec47e206a", "comment": "Malware payload (Formbook)", "value": "4887b91bf9abf0ab5cffc2d112dd720d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606855, "uuid": "6dfddf8b-6779-45e7-b1d8-e57ea9b5c58e", "comment": "Malware payload (Formbook)", "value": "817c40f9c581081a1322dd7c37720bf65113a1e6910a21ce11fe9b3be0cb1884", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606855, "uuid": "d6229439-b40f-4503-b944-bdcb79a50d03", "comment": "Malware payload (Formbook)", "value": "497c5be80520dd8bbd514a49dfa71b6bf144f124", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606855, "uuid": "d1eebd92-fae4-4ba8-b470-4e852cf438bc", "comment": "Malware payload (Formbook)", "value": "b8614fdd030ecf77fe83b803d1cb4d465ba27d914b25ad32ad1941aeb18eff779988dea2b475e939314512708ad90b31", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606855, "uuid": "8b99cd67-5d1a-4314-a78d-72567108bb4d", "value": "2C342347C3C1042568EA5E8BB258E2CD0C6A84F0077D6B61757BF6A637B2420F122FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606855, "uuid": "9e773c4d-bd40-4063-922d-eff059e0d85d", "value": "6144:e1b4uGJsmu3qAUupFYprugx2XkA1wepeyX/wDUifvStpkap:lOL3qAg7xCT1zAyX/wDUif6tpkap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606855, "uuid": "d0bc86cc-a0f8-4ec4-81d4-4a52c7cb4486", "value": 237381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606855, "uuid": "47c801a9-d71f-4f71-b90c-25e9bdcdd29b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606855, "uuid": "9dc1aadd-92af-4168-9f0d-c54cc5435d60", "value": "doc75843.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aee94e9-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603201, "uuid": "3c0dde78-271e-4931-9b87-db6f2a9f875d", "comment": "Malware payload (AgentTesla)", "value": "2be43b210c1cd07b822a12900ec12e55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603201, "uuid": "d722ce30-0a49-48b6-b1f0-0992e1265013", "comment": "Malware payload (AgentTesla)", "value": "81f0a85599da0823bf6d6dafeb6186f06125f253d6152935497a0787a5841c82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603201, "uuid": "40691a73-5795-4283-8c47-0ad99189fe1f", "comment": "Malware payload (AgentTesla)", "value": "ea6bfe20bde6ecc8be49ef73862306174b796f48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603201, "uuid": "c76b54d7-6594-473e-9017-e5bae1c87307", "comment": "Malware payload (AgentTesla)", "value": "67406ad1a070e4af76da5db272f1f0e2881948a79275cd56ed777bb8122399d3d0e61c98cfe81fd7425b086d93f44263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603201, "uuid": "b7225b6d-a386-4b20-859c-e1ff1a7a9fd0", "value": "42E43342C55A67A2D4C8B4FB04EBB635FF50FAA108D4B1F46B77AC3FB56EE204418684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603201, "uuid": "72542a2d-5da6-40f0-b4eb-3c72e07bd51c", "value": "12288:zFBrfzcRxoGNWSKiLygk6ZDxavHdJtfWT/NONJC6CQaqrrgTWHYmUiCZHUkLCTWi:HXifhKmyD6Zov92rNPqAW48CZtlDNSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603201, "uuid": "ebee6d8a-07d9-47f1-a7ad-e1f4d7a6e5a9", "value": 703189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603201, "uuid": "0ee5a669-40f3-462f-ba95-1643102e7d58", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603201, "uuid": "26ff491a-1a94-4ff2-8767-b57ee1042393", "value": "WaybillDoc_3227610761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb2e1ca-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624602912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602912, "uuid": "bcce2076-9c77-407b-8fa8-5727a6def70d", "comment": "Malware payload (CobaltStrike)", "value": "92291225ff934f4877422c6b8efa0d01", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602912, "uuid": "a22b1e8b-37e5-47a1-b69c-e98230b3ba9c", "comment": "Malware payload (CobaltStrike)", "value": "8243df4a5f6c52841fb457f79dccf4e41a6f2ce15a3441160da6f8c8fcd6763a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602912, "uuid": "fab877d1-5a6b-48a0-8f57-8d519da50554", "comment": "Malware payload (CobaltStrike)", "value": "bb1531defc10daca08be95157c6a8276e169eb0f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602912, "uuid": "7d0f6a35-b83c-46ae-9951-251152474815", "comment": "Malware payload (CobaltStrike)", "value": "b63996ef67a458fc3e3865e3dffd24c1e2bf726c1ad6e32501a9b951827352cf15aaccafe2e64ead2c1efe2bfa05c348", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602912, "uuid": "fef9a508-e741-479e-a42e-10fb05be889f", "value": "3B24DFF89265EC4AD226CFB3EC9DCD751E054F43CC45C4CA698ABDABD82DC999133188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602912, "uuid": "63905234-a843-4068-a723-f40d8f99d466", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602912, "uuid": "028e24e5-390b-4109-bd68-33c2f74029ce", "value": "6144:xWnMXojU3i5kGg0D7Zl0hDBrm5vO77iytIe:xWMXoj4i+Ggc7QDBa5veBIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602912, "uuid": "a91b461c-3031-4af1-9aee-2a3d28aff766", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602912, "uuid": "8d72878d-a94d-4c4a-86e0-c1ebe5fd12ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602912, "uuid": "09f9613a-7a7e-4925-9307-7020a85ed3f6", "value": "92291225ff934f4877422c6b8efa0d01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9e5938-d5ec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624649914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649914, "uuid": "f9c1574f-aad9-41a7-9fe6-a1a2a8909d7d", "comment": "Malware payload", "value": "488d15b4b254c28a172987bc4f059741", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649914, "uuid": "7af6b5fa-cd12-440c-8572-6153d1cafdc5", "comment": "Malware payload", "value": "82fcda4081f3ae717551885a3bd4c2e642523262908652678fe97fdf7b1380a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649914, "uuid": "1718b5b6-b942-44e2-aeef-a92a77bcc76a", "comment": "Malware payload", "value": "ca2b14c6ef88655858bba6fdd342b165ab35dc0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649914, "uuid": "b4ab6f20-cde8-4935-9983-953b11046e8f", "comment": "Malware payload", "value": "18dde75bcc2407af073fa896250a5def46584cca0ec5b951b0737122e4d9d6095588fab9c1b2f4acb7879d9b3aa72f6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649914, "uuid": "a91621a3-ad85-4dd2-855f-42402bcb2160", "value": "7882D0907BD79B5ADC70F332D36FA195F050BE21A59252079A390F086DA76CCEA50DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649914, "uuid": "52cd4bfb-31aa-432f-84b5-7a6a2b1120de", "value": "384:rQcnwdN7pmR5f8taveDJUU4sQC5BhodTh:ML/tavCmyQOqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624649914, "uuid": "a6263d6c-aa1b-44d9-826f-1ffed41ad9cc", "value": 17636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624649914, "uuid": "7c6601ab-bfa3-45d1-9d9a-50c4806b2953", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649914, "uuid": "af8577f5-a458-4250-8c50-9ad960efe991", "value": "SecuriteInfo.com.Malware.ELF-Script.Save.382ba150.29064.14109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7701d98f-d5da-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641984, "uuid": "a7509127-fe73-467b-bb1c-665899ca7b7b", "comment": "Malware payload (Mirai)", "value": "5e24962bdedaa5410c4834f446487fa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641984, "uuid": "13451f6c-406f-47d3-ab8f-43a34b86fff6", "comment": "Malware payload (Mirai)", "value": "83e0def3b002bdc2b3444537f285b8ac56e949f853e63763972f12314beab9b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641984, "uuid": "5975e93e-919a-4aa3-bc36-ff1ca563c8c9", "comment": "Malware payload (Mirai)", "value": "ef9527e4c7ce51d60c21603675d7a6f124333cfc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641984, "uuid": "df5e4b68-351c-47a3-8d26-f1ace2de0028", "comment": "Malware payload (Mirai)", "value": "87106121777e1307daee925040604521216fa3464a1f2962d04e0c6a3f03e708c772ac7c9f0ada3af033d65eb78cdf33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641984, "uuid": "f83191f5-1e19-44e5-a10a-f5cc7a48095d", "value": "B2332ADAB402AD7CF98FEA7E80660E08B630325451931727776BFDD37E32154D912E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641984, "uuid": "3d1adcab-6510-47c7-8217-a73dc0cde49d", "value": "768:SYeBOorb/TUL4bfISIRYu1KWGdrc7QQlzrmTgFHcWWGU7samJMf3kw9QGoSO8ZBC:5yIJRYEK9nQ7F3WGUsbMf3kwmGoZ8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641984, "uuid": "27f35468-6476-4e40-b486-055a6b422ae0", "value": 52372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641984, "uuid": "06fee660-e1ea-4807-8b4b-a0f388e4c047", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641984, "uuid": "6ebb9ddc-4411-4e66-ab7e-c0ecbce10788", "value": "5e24962bdedaa5410c4834f446487fa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b4ae0f-d5a3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624618312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618312, "uuid": "b494171f-6dc2-4bca-925a-e19c6ab95725", "comment": "Malware payload (SnakeKeylogger)", "value": "309ea48e4c63d94a27366722ebc761e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618312, "uuid": "ad781b59-216a-4e24-8bb0-d68ff940ad21", "comment": "Malware payload (SnakeKeylogger)", "value": "83fef9d67405ca7975e04fc8c66e7d298809f90260d1b287f709a3bae49f502e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618312, "uuid": "e9d8ad2e-a401-4213-b5aa-d7cb7a42568c", "comment": "Malware payload (SnakeKeylogger)", "value": "25859dc953158b023eb11910b8e3e9a9dc837c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618312, "uuid": "a58257f4-888f-481e-bce9-9a3e1953d811", "comment": "Malware payload (SnakeKeylogger)", "value": "69ed46b619542fc7be150fa3e10939922eac5cc8d3d91992d6be4ebb24d671fc7c076b81532471e3f43250d0181d7c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618312, "uuid": "3d0405b9-5310-43cb-9fc1-a0a5357bcdfe", "value": "81B40182A1D0D167E7F221794FA2CAB5E37B8D850A61971317E47F4B3FFD68B2400266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618312, "uuid": "bdc2fd3b-2b55-425f-a698-790971e12376", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618312, "uuid": "714cefcd-49fe-4f04-af5b-f60f0f675432", "value": "6144:TTqjFjp0y7SeZW726gcdnu6KpIsWjFjx0tQi24D8Cjq3745SMLRywT7nqrIZS:Hep0reHYaIZpjSWi2Kjq3M5SMLbTGrI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624618312, "uuid": "22b397c1-b9e6-4741-9057-f0c018be7fb8", "value": 497078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624618312, "uuid": "b747d29e-2069-4499-a781-a8f2fd1b8e25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618312, "uuid": "9b1f276e-2542-4b47-902c-200af5dcef09", "value": "sdffs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b81387-d5fb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624656101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656101, "uuid": "64a02edc-6cb4-412e-84c8-70fc458968b1", "comment": "Malware payload (AgentTesla)", "value": "4fdba2ae64528591dbd7a31f868a8119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656101, "uuid": "95f17e13-a87c-49cd-8940-b387282de69c", "comment": "Malware payload (AgentTesla)", "value": "85f1d007cca51c7ff3b37dcb3b3492a91ef54c585f08189e8bde10051e52267f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656101, "uuid": "1ccd90ff-9e36-4c2c-aae0-26568ca65fd1", "comment": "Malware payload (AgentTesla)", "value": "41b333f2c7e789762b0928e472f8a3fd37d591cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656101, "uuid": "63e59812-1ac7-4e1f-b49e-23adef25e0b4", "comment": "Malware payload (AgentTesla)", "value": "ccf2cddfe576b82efdd6cbfd276c6d9d2ae9d0a51ad7e3862b42783364971e0e8f94e8455505938fda841df835da99bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656101, "uuid": "9016861c-4e01-479e-808d-1ecfaf862d86", "value": "69E45A59266D6B05D17613FFCA7494C253BADE92BA36D0B53EC637C60AE8B020520F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656101, "uuid": "97ec995d-f141-436a-a203-53225e492846", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656101, "uuid": "4c1ea0c7-c839-4eac-86de-9e9026aafeaa", "value": "12288:xIu940Khj6UpvMHpyd5kwKjT7aUxDg5bf:xIC4PYieT7aCgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624656101, "uuid": "4c3284ad-0e89-4896-97d9-1ef935690af8", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624656101, "uuid": "cdd290bb-e9ae-4276-9ad8-8b98ecd81a88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656101, "uuid": "92d14f15-b045-43d4-87a7-06b06c1d863f", "value": "aRdwHQXGC2Mrfpi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171619c3-d607-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624661150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661150, "uuid": "abc3872d-79d6-471f-9104-bbe596ca9b12", "comment": "Malware payload (Mirai)", "value": "3e9e82ad8cd262510aa12ad72a3d4574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661150, "uuid": "59c2d204-326b-422c-97c2-a3e3281ee5ff", "comment": "Malware payload (Mirai)", "value": "8666b22f4e72b19b92da7529b30cf00eed2a803ebc8bbcfe68831f0d1f5b17f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661150, "uuid": "172a54d9-f200-4516-9d24-fb4f8b69e0ac", "comment": "Malware payload (Mirai)", "value": "657b74915692093c1e60ac63cd3ea85df19f57be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661150, "uuid": "5fa99438-055a-469c-8a51-6506dfe401be", "comment": "Malware payload (Mirai)", "value": "e30ad06b72924c900d7adf7dc8c048c1ee316029f12bb6c372eead67f35b95bfd7d691eacb61c90b06339c3887c09796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661150, "uuid": "cced831f-dfb0-4518-954b-7706f510670a", "value": "7723F1321F46F565C9A51C33C731C9CE78275A7BA04FB24A2614C05067B14A6AEBFECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661150, "uuid": "03c80fd9-d7aa-45e2-a399-e1d9e69edc2a", "value": "768:5yzp5cHnZZE41XjMgHp8A0lwhSgy7L1K9dTk0UT/4vb3gDGlJvlp/JZq6h9q3UEA:Qzp5AnXvH0ehSgy7xK9dJ1b3gDClpfYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624661150, "uuid": "95c4b3b1-51f7-4f14-9628-f030442d000c", "value": 47724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624661150, "uuid": "084cd04d-4291-40dc-adf8-2f6b610adee4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661150, "uuid": "54bcbf98-f9dd-40f1-b5bd-09f4d14531c2", "value": "3e9e82ad8cd262510aa12ad72a3d4574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b450653-d5b0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624623871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623871, "uuid": "21e00ad8-450c-4a48-8a8f-c81ca1d846f8", "comment": "Malware payload (Formbook)", "value": "ec64c996d1f3cf242cc9868682953cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623871, "uuid": "163aad08-3f4e-4284-bea5-9eee6253c19f", "comment": "Malware payload (Formbook)", "value": "872d03fd7d4748230a0e84593f7a29c36f70a5c711ed4a4dc2c11a9d9774d06a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623871, "uuid": "089ac8ea-f6a8-41d9-89a2-2b52e4f51cb5", "comment": "Malware payload (Formbook)", "value": "efcfba0d2909717c223f648f99f7267626aa181c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623871, "uuid": "50325462-5c3b-4af1-ab9e-f79f1a98f53b", "comment": "Malware payload (Formbook)", "value": "aa28a92e25db0e7698d5a1766a3d923a2f6c2aecfa53fb873d3fb862b9fdf8b7ea970ab6ebf46774200ab9f4bd448fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623871, "uuid": "9408e34d-5850-46f5-bc64-cc1a5c2ffe3a", "value": "38F4E1303AED5229F177AF784AE07555ABFFB7636703D45C6C91038A0622E41CEB1A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623871, "uuid": "dded5f92-d247-4db5-8400-680eb18cb5b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623871, "uuid": "1cd575ba-1852-4320-93cf-8b6d166f5924", "value": "12288:wjg0JZaF75GF2ezGWSE5D1kIpNJxZ33IBSR+EAD3xDYTyJFIzeLBsvYJbUBQ+138:1bvhEp1OB2M5YTyJmKlsv2a5Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624623871, "uuid": "adcdfbef-55ed-489a-9915-93a003856206", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624623871, "uuid": "5ce6e1db-6ea4-4094-9a52-a41b77315032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623871, "uuid": "608b4a34-25d1-4a7b-a323-9ce965ee0d90", "value": "New Order062421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9477aa3-d5d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624640430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640430, "uuid": "d4b8dda0-1f11-403d-a8d7-4051a2bbb511", "comment": "Malware payload", "value": "dfd6565ad1722dc7c956c9cd42c1d76d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640430, "uuid": "672ee967-18d2-4899-8c07-fabdf060ec2d", "comment": "Malware payload", "value": "876a3b6ad71d1cd0918d77f0cc6ce07616b7792aff2ddf86b9098170b90e61a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640430, "uuid": "e2a3ec30-bda6-4d15-bb41-8d5556d1040f", "comment": "Malware payload", "value": "5f2b37a76a8b2c92483b9e733bcc94047278e8bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640430, "uuid": "360b76c3-3359-44d7-ace2-0bf6379b61be", "comment": "Malware payload", "value": "a8fda61b6f91b5e6ee90bdbc8153cdcc1efb22697dc7313268ac54c9769b61b3210261981fb2dc0610c8e878721f5a90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640430, "uuid": "a6fc1684-d538-49db-83d1-846012035daf", "value": "0392C058FF145112CE696A3946D192EDA3A3111FBBFC8B4B738A4DD059807A0886DFF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640430, "uuid": "ca8a6cf8-ffb1-4ec6-b7d2-b93a1f25b43c", "value": "384:L4tix6bahCkyrgQz/VQu4dNXGHIMXdcQC4+8uebN3k3:GI6Whnyr3z/V2dNWHIMXFC4buebNU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624640430, "uuid": "ee8ea3b4-2d38-4d94-92b1-a460937fde6b", "value": 19532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624640430, "uuid": "0f48b8c8-ed69-4278-b3b2-7d4f30435a0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640430, "uuid": "245de3bf-fe43-462b-9784-2725133e3116", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f30a2d-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602227, "uuid": "4c9581c3-6b75-4142-aa6c-8b3892bb110c", "comment": "Malware payload (AgentTesla)", "value": "a2c1c7cda5bbac800b556b8f57f63f07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602227, "uuid": "611a35bf-79f7-4977-bb2d-20cd024bcf6a", "comment": "Malware payload (AgentTesla)", "value": "88b271a6d5d6f70b6b1fdfa7c8fae0e636b94dd7ba87c8df9aa969b887c5bffb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602227, "uuid": "aa57f159-4534-4afb-8388-04e61e5109bf", "comment": "Malware payload (AgentTesla)", "value": "713acf1f67a85f242436b02b78da3238c88588a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602227, "uuid": "b8ffa953-447d-4102-af01-dc0ac350d226", "comment": "Malware payload (AgentTesla)", "value": "c74b4f38c79651d880c9f3b45b84ce56c467fc5f71f9f8831cab230864c3a0bb33488858d504e398b4629a954de56db9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602227, "uuid": "ff1870b8-fba9-48cc-92f7-420abea3bcc9", "value": "6EE433D0C50B6806C5BCC33E406AB32961525F32F2D8B7BB953AF5C9C4621B676B76C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602227, "uuid": "9910b6c2-a78f-4f52-aab0-fc92ef142ac9", "value": "12288:xiUKpND5WBreHEWiEQ0DpKsQaA0Ehzm/6bVGo+/hpXZP88r0zjtu+uB4d2Y:JKHD06biT3j9msVGthp5fr0/A+uB8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602227, "uuid": "0d403995-fa61-4cd1-baa5-7493d703e7f1", "value": 714161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602227, "uuid": "e323d65b-db87-4bca-8c70-15ba2b96756f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602227, "uuid": "f518a9e7-e124-4e5d-9e2d-250508bedd66", "value": "Quotation.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c080d3a-d5b2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624624705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624705, "uuid": "3d3ab7b2-1e5d-4c07-8bd9-35e0ab44b867", "comment": "Malware payload (AgentTesla)", "value": "b7ad17e786f060271d1682d91edaa1e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624705, "uuid": "b8f7aa43-323d-4538-a4bd-2ba2121eed89", "comment": "Malware payload (AgentTesla)", "value": "8968c1980f7834c998c96fd5814dd9b828c45917a8aba511078770bf619be082", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624705, "uuid": "8ba38a19-edd5-46aa-9a04-67cc96319535", "comment": "Malware payload (AgentTesla)", "value": "4dba0326013655ab97347d599f311f19d27ebaba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624705, "uuid": "4e84ce67-fa59-4768-b5d4-53e0a05c63aa", "comment": "Malware payload (AgentTesla)", "value": "22fb9420efea4e276945cd3306863bb62bec2825f4387362d1996696bce9ad5ad4e62286955251024a9dddc8225ec38d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624705, "uuid": "7e3d327e-ed02-4b31-9cc5-df1f85b18c69", "value": "7B44120213E34EB7E7BF9A31557354B4F132956A6209C60B4FB10D7A2B2D4960B2B3F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624705, "uuid": "d293e031-f922-42e1-b270-ebd753e570fe", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624705, "uuid": "bb3c3049-21b8-4294-8c3e-88d67666d07d", "value": "6144:sTqjF9v0kr2jvi9lyy9TNbQ91qSdsDw2NCsVlwK0D/qsntfy9d9KAA0bBJs:ssvS698y/8915dsDw2NCsVr0DqSEdwIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624705, "uuid": "d6b91190-f718-4264-8cb6-d813b034c6cd", "value": 271122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624705, "uuid": "692529f0-db49-4768-b57a-a5d8a0b1f912", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624705, "uuid": "0e99c4c2-e358-4203-97f4-35be75089552", "value": "15934,00-USD-SWIFT MESAJI.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7534fd-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624641645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641645, "uuid": "d5452891-39f8-4fd0-92c8-d7fd9cdeee3a", "comment": "Malware payload", "value": "5568bf20dc758caef8b1bdb40300b3ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641645, "uuid": "dec4a1ef-5e5c-441a-8cab-8f2530e71101", "comment": "Malware payload", "value": "8a44ae92e6edd27493253129c7e456d2307c077e8e2e4e482fd1e4cd0c87648c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641645, "uuid": "02a94364-8ce0-478d-99b8-ce3063825ffd", "comment": "Malware payload", "value": "ba1f96b1fa8aa321e3c8fcd3282f1895cbc2c2aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641645, "uuid": "9e0c30aa-fd3e-41b0-95bd-519a47e207f2", "comment": "Malware payload", "value": "fc4f066cf3bffeea64740f9697e909e3142b3f06a328fc01d65756f75e4d2267d0fb6f9c1c318618be3255b81e5c7e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641645, "uuid": "9426b94c-69c4-4203-b77b-d6cd786f2b9f", "value": "C8D23949FA03D0F0E80245705626DBBEEB789D326120DD1BE7983EABEE71A13C51635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641645, "uuid": "c1b5940b-a957-4d44-9c7d-23234bcf620e", "value": "768:CbyGuz1qziR8F4sUgKra/ji813/tWRPe13n8N:auzYN4s0a/j71X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641645, "uuid": "1c60b85c-b5ab-40d2-8961-605fa32e85f0", "value": 29296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641645, "uuid": "7f0bf202-b8dc-43eb-81ec-ac49d920daaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641645, "uuid": "fe1cd191-7836-4f8d-91a7-77197a5f195e", "value": "bot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3852a5b5-d5b6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624626417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626417, "uuid": "aeff89f3-539d-4dcc-a118-9c3365397831", "comment": "Malware payload (AgentTesla)", "value": "d35690305158cda26fcfcc51314320a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626417, "uuid": "501830a2-274e-4f72-9a89-d4f4963b9198", "comment": "Malware payload (AgentTesla)", "value": "8a810873d6ab56be21c21d5a578698b9b6a9bdee4cc9c68aa184c2555b0ecf16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626417, "uuid": "23ead3ee-f886-4c00-84d9-021cb5d58566", "comment": "Malware payload (AgentTesla)", "value": "6a8bf6b3a7e024ad3a7d84333316c5138aab71b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626417, "uuid": "565f907d-1063-425c-a7fd-839581b02c3f", "comment": "Malware payload (AgentTesla)", "value": "7fb7f1679a0c73870c3e6db53b1d22a8d346039ee88b66b3bac38112c69bb0c17a1325ff1b6612e73b0136719dc009fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626417, "uuid": "7d450f4b-a500-4153-8e2e-fbbff5bae76a", "value": "04059D2AEA582B1AF078D1FCC4349F680DA0BD41D11691D77ED7BE9FF3A2241DE0A119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626417, "uuid": "07ebd13c-ed36-45b0-adaa-4b813e315bc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626417, "uuid": "ef0932f9-fa18-40f3-a655-be5d386651ee", "value": "12288:6y71nnqVS6ciFIIHFwt4Z3H+f/rJrm0OvlUNMIiyh7seK88S8/5Y:HsmiXmC09rm0Ove06iS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624626417, "uuid": "cebfdbb2-abde-4994-adab-a2c5a262d96e", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624626417, "uuid": "ee927864-f640-4dee-b4a4-a137ebe5ee83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626417, "uuid": "b18d0dbe-40fb-4bdd-93c7-35695395971b", "value": "Lebanon Khayat Trading Company.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e593dace-d605-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660637, "uuid": "9e3a7b8c-72a7-4068-b832-ff03c8b831b8", "comment": "Malware payload (Mirai)", "value": "7d465bbb780df0e38666ce77bb9c812e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660637, "uuid": "c5446c90-2c99-47d0-b4b3-2f7d2e5f4c2c", "comment": "Malware payload (Mirai)", "value": "8b1f36daff95b2f8ff1c90188b858143e5c6dffa83c2a55fc8e92fe6a154d298", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660637, "uuid": "2b446dad-73e8-4a27-9589-dbc8cfcda16c", "comment": "Malware payload (Mirai)", "value": "eb1e84c8b1625a4620329127a89f7db38541c26f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660637, "uuid": "df3ee403-65b6-4ece-8a5b-bbdb48019523", "comment": "Malware payload (Mirai)", "value": "6631c3f93b395db0e869a5412901eddceba69e2e59efdf8ef282d903ea61efceabc9a11929b26582065f6800d36313af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660637, "uuid": "70902511-9a03-411f-ae40-c9f567c77dea", "value": "A6C35C8DB4024D7CF987D9BE80324E06F920B3519A930B6752A7FE937E331A6BD06D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660637, "uuid": "b1d1f4c1-ab47-4d78-b4a3-0c5849123ca7", "value": "3072:PINOUeMDv9Io7VzOiXoNDmpvatuKwU9lxIw91ss2uk6EpUYBucG9tSEEROAS:PHCD1Io7VzOiXoNapvatuKwU9lxIw91X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660637, "uuid": "fb1f4fc7-3ab4-40e5-9c6d-d62152813a40", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660637, "uuid": "b4aac296-294c-4190-8c1e-badfdd856d01", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660637, "uuid": "77ab2dc3-7212-4cdf-aff3-8175c8a8e0ea", "value": "7d465bbb780df0e38666ce77bb9c812e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6a3563-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624601672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601672, "uuid": "e4480f11-9ce1-4bcd-85c7-212c50e4e16c", "comment": "Malware payload (Formbook)", "value": "e1df9b8f6170bc4241edffd642949901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601672, "uuid": "76fa5700-6743-46bb-8681-39cb9b555214", "comment": "Malware payload (Formbook)", "value": "8b225e713429dd95fed7fe2af260d9076d627279fc86d152baedd973f0b72304", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601672, "uuid": "984d1110-dfc2-4eb2-9511-e0031e013d54", "comment": "Malware payload (Formbook)", "value": "261767a7e271d39393619109d1310f04dfba5b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601672, "uuid": "d994513c-0553-4867-9ce9-5e43cf59fe67", "comment": "Malware payload (Formbook)", "value": "231ba4d86ea06ada2af8fb0876947ba38d43fe3d4f42d302eabda140f7fe4e4a18f401c4eb0a55befec01001023d5eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601672, "uuid": "68de8a76-41ef-4ce1-8753-8b8af1b72559", "value": "BB44F192BA834D6BD885803D0933C6B6A2366F4D0F5A15E727643F1F7C322C76936D4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601672, "uuid": "a1623140-d6ed-4cfc-874f-ff05a3e64606", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601672, "uuid": "7c336564-73fe-43f0-8132-e53d553c3741", "value": "6144:rTqjFeDgN8f9QQbj67yFKvyiUmSw87aplOTCMCNY8r0lkssE3plf:fZg4qQb8FzUmS7ClOTCnJglWE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601672, "uuid": "a7380b98-cfc8-449c-95ff-9ff2c4e7268f", "value": 270861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601672, "uuid": "1ce452c1-7a90-4d5f-8108-8610c6d23762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601672, "uuid": "7d8e2d94-e625-4abb-9e03-27bf43146b24", "value": "DC Viet Nam Order list 6-25-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa4fc10-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631636, "uuid": "7aba3e68-4695-4ff3-a003-67a9d546f6ef", "comment": "Malware payload (Mirai)", "value": "1d1eac14b5defcabcce8b6d1693a9972", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631636, "uuid": "0b0771bf-dcdc-4285-a11a-736619c90bc6", "comment": "Malware payload (Mirai)", "value": "8b4fc102abd06424295be2ac8d834cc9d1dac4a371605b3d417c29e65d0c75c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631636, "uuid": "003986cd-169c-4911-991f-d39fc8cb8f11", "comment": "Malware payload (Mirai)", "value": "4d92ed4c833b3ba1a413fa808552904fd779cd8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631636, "uuid": "408883bc-77cf-4c25-9152-c880d970ed46", "comment": "Malware payload (Mirai)", "value": "be761a4e5a148a7f6dc727249c5226f9e6fa9cc0e513fbfa80467e7d41f2f05161a1d239a3b41a063cc6c9e109abb991", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631636, "uuid": "762fd740-7f8f-4b55-a2c8-1f15e139c509", "value": "57332A96BC919A09C6D023B6BE5FA5AE330163DDC2EE3217DC141F243ACAA1F4DA7541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631636, "uuid": "f3041177-30ed-412e-948f-7f289ae13df4", "value": "768:eMBZvdeg6qYrdSSZ/rfVLqsrFpErnFwuuSjzW+tbYJrMK63RvGBuMKqhBNrB:pgg/QdSSjmskrnFAt+t8J35j7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631636, "uuid": "0d6160e5-2973-45e6-8e83-0ddfe2e67070", "value": 50400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631636, "uuid": "bf5b5b54-f363-4a4e-bb5c-250f08d9c583", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631636, "uuid": "de646f39-560e-4ac1-8914-6bde4a4e8979", "value": "1d1eac14b5defcabcce8b6d1693a9972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e8031f-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602731, "uuid": "4aad50dd-2001-42f3-a273-3dd341359c3a", "comment": "Malware payload (AgentTesla)", "value": "53d6a4dfca488266ad63c603c3213250", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602731, "uuid": "31884b27-e9ab-48b5-b7f0-dc6d5673100e", "comment": "Malware payload (AgentTesla)", "value": "8c2c2d0685ca1beccce588224767369eafd53e50be9b22fffa933d4f82c4f280", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602731, "uuid": "6596ab7c-8757-4c31-96a1-0eecabd836bc", "comment": "Malware payload (AgentTesla)", "value": "791a1608ad9a639c1ce0a347271341a79f2c2eb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602731, "uuid": "73a554cb-9c27-4102-8109-ab09c9071c29", "comment": "Malware payload (AgentTesla)", "value": "b8a564fe44b3b93fca84c476256fc85f0b5f1cda49d5a20bad9ce453711c1983d68952640b571cb56d3d843c30e9fe52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602731, "uuid": "61ef5e25-37b1-424e-82d3-f1169ce94284", "value": "C2B42320AF5518A641D2E56F50FDB3C88E0F0D8F1ABD95A326E19704B34F39F5BD260A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602731, "uuid": "e4c0c85e-763d-4585-90d0-30d600526d7e", "value": "12288:xOJ6BY6ifblDdj4W+0vonkWHab1NPEScYRGVKR:xOkBYp+JeokWiNPpfRGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602731, "uuid": "4d1d872f-17ea-451f-8a15-959518e1d72e", "value": 540203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602731, "uuid": "f35b09b3-df39-421b-ba34-534467d25ac8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602731, "uuid": "2d7de963-74c9-43ab-ad84-8c670a498899", "value": "Factura.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77ede06-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624601290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601290, "uuid": "96f05a3a-e707-4374-bee4-bb29be108c44", "comment": "Malware payload (AZORult)", "value": "90f67636e614ddbdb14e0ee132ef0493", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601290, "uuid": "548029f2-d6c7-40c2-9378-a0aa09923c4b", "comment": "Malware payload (AZORult)", "value": "8c36178491d2f1fbc6ecab813284d8b937989a31572c65d3799025ff685373c6", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601290, "uuid": "dd7296eb-6565-4768-a363-c465a1882cf7", "comment": "Malware payload (AZORult)", "value": "9139d7793738c493afc572532771995308b203db", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601290, "uuid": "1b8d3d8b-bb63-491a-b0ed-42e8ef956f30", "comment": "Malware payload (AZORult)", "value": "e43468d8fb992b572482288d24f25d93c8b24a69c51c09a4a0b907169a8b0a38dc23cf059b087a0d0b42f51f7f6f4c0f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601290, "uuid": "e9acca12-ca8c-48db-b48d-5f0399585da4", "value": "BF642384BD8F4187653425AB8F75CE3AFB8182D9623DEAD8069738245F39B1E29C12D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601290, "uuid": "118dd9a7-0eea-4711-ae8a-2af5c1ef9f11", "value": "6144:QGYYaMs1ISH+yHXV2R51KXBxBQ/W/DNELotRjM93AZVeWrCE5e6G:QrYaMA3xXsRXKXBxBf/DNELotR34EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601290, "uuid": "84993a47-84bd-4707-8d00-5faeccc49015", "value": 313747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601290, "uuid": "757c2a4d-0343-41f4-a2ba-9d8e635639ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601290, "uuid": "9186a136-176b-422c-b4a7-d11000aec01a", "value": "Order Specificaton.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382fda85-d609-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624662065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662065, "uuid": "5db3159c-ac96-4ba6-bedf-4af9c6852b2d", "comment": "Malware payload (DCRat)", "value": "5ba6b57de0f7a435cc0c812e08edd466", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662065, "uuid": "dd144031-c462-4eca-af3e-133947e1e100", "comment": "Malware payload (DCRat)", "value": "8c5b1765be823aed40005938ffe187b65695022920b7f2908ab36fa823379d71", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662065, "uuid": "a712ad35-c795-4ba1-b868-1d196cda1b86", "comment": "Malware payload (DCRat)", "value": "7a8d5b48c912d622864f601e04344d15841ff52d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624662065, "uuid": "fc463ed6-afc5-404c-bd52-bbf7b1be6d84", "comment": "Malware payload (DCRat)", "value": "df9179c91b8f24f8d1a8477c729efc16d452956e90e7e9641b8d7d3f5bd41b64cb7ced8e613016707c5433918ccd124a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662065, "uuid": "d5f7b71e-b9ba-43ea-b719-6763173a7f05", "value": "155533C746483DE7E70747F65A6CEC18E6FAECC6A33883160219D82E74709BDD219A4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662065, "uuid": "4f14ef54-7e34-40e3-89d7-620d7f71a581", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662065, "uuid": "c9c4a32a-2835-4d3d-a1c3-77f298b83d5e", "value": "24576:eyqsMDP2ccl/GHlSOsE1hvfSPLde25eyt5lRvQPhdGX2OxzgoE:loic0GA8xELde25FoPhE5go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624662065, "uuid": "2e6839c8-a447-44db-836a-75a7fd35dce8", "value": 1315480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624662065, "uuid": "d95c5708-8318-4dd7-8ee4-b7e63b5e898d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624662065, "uuid": "123c3d6f-7bf4-4142-85a8-6db2568ffc2b", "value": "8C5B1765BE823AED40005938FFE187B65695022920B7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c1fdef-d55e-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588529, "uuid": "0fbc95d0-af42-43c7-9f8f-5faf8992c830", "comment": "Malware payload (Gafgyt)", "value": "402ec67e9e39d522f2cec2778066b647", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588529, "uuid": "84ee57a0-de2e-4f9a-8aa2-86367789dc3a", "comment": "Malware payload (Gafgyt)", "value": "8cb046ca20dae30aeab22b7ed1595409a4bd1aa5f1f13b5e7bbddffec0c91b41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588529, "uuid": "0aacd649-999a-4d35-871f-f8b6d8169736", "comment": "Malware payload (Gafgyt)", "value": "2b3e939ee313ed1455dcdc8f34da6efcb6dbfd78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588529, "uuid": "61ede1e0-81a4-4830-8add-14a29e5817c6", "comment": "Malware payload (Gafgyt)", "value": "1a44ab8b49186be3f8008439af4b84412e396284c13cedd17c552b654cc60eb4d470ee6b36d255e55739243e7e9dbaae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588529, "uuid": "cce0572f-4975-4fbf-be21-f6037be467af", "value": "2BC32CA2FD01DF66F00A9D3A0AD74B242930FFB70B8229757267765299B62D47413F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588529, "uuid": "72107d7e-7085-468b-a140-96f40b24f10c", "value": "3072:Zs0RiJaJgGd4cRpmSmW+yfWACXimqA0Yzmb+vQNd5:ZwJadd4cRpsyfGSmqA0YzmivQNd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588529, "uuid": "90b72018-1896-43c3-8c64-4fa273e0c851", "value": 118840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588529, "uuid": "de2e5eac-1389-4535-8b4b-221046ebc4f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588529, "uuid": "07d06c87-07e5-47a9-be29-a393e29fc6f6", "value": "402ec67e9e39d522f2cec2778066b647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de89f73d-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603503, "uuid": "388bdd44-bcbd-4102-b3d7-d40928cb4622", "comment": "Malware payload (AgentTesla)", "value": "b6fbe887eb153c53b68c93ca241bfd94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603503, "uuid": "d23c35af-8e99-450a-a0a3-727ee8ed88a4", "comment": "Malware payload (AgentTesla)", "value": "8e2bb2559f12546065c58e1ce777b8b1ef27179466f64443afcfb0ad4ec1628f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603503, "uuid": "c430503a-6f4e-42cf-83cd-a6322231632b", "comment": "Malware payload (AgentTesla)", "value": "24f8b70ede4c0b94d64cc8371f3247dfaf15758a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603503, "uuid": "f06719c3-58bc-4a6b-a2f3-9b79a3c0894f", "comment": "Malware payload (AgentTesla)", "value": "dd7c0685e582bf850fe4197c13de812b644c4800843ee8143c4feb9763b31fcdb3eb7c2e2b7e5f81bf974147b9342517", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603503, "uuid": "17ca7be4-314d-4417-92a4-514745617fe1", "value": "58E4123E576D8F67D26C19BD9422240027F0C2D9FB91F7B57EE170C956C1B808B60A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603503, "uuid": "e31a0997-8afe-48b2-b791-d3d28098cb1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603503, "uuid": "7c0851ee-338d-47a9-b479-03124e88846a", "value": "12288:/JAczGWSE5D1kIpNFaKHd8uo7D2C8snnoNjiWrbEGHFPJi20u8oesv:S5hEp1t3eFv18UoNjbQ+ri/nsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603503, "uuid": "c9b2ffc2-bfaf-448c-bf66-f9f8d98aee0d", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603503, "uuid": "00af7a66-5244-4e66-9dbf-332d7459ac8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603503, "uuid": "d7c55e10-65bf-40d6-b661-90925798a6f5", "value": "Lebanon Khayat Trading Company.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de54d91-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603260, "uuid": "1cf48206-1bd7-41d0-93a8-5b6d11498269", "comment": "Malware payload (AgentTesla)", "value": "32391a9b33a9b8cd12f6b5f8449cb391", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603260, "uuid": "a699031c-c659-4197-974a-f871e8adeaf7", "comment": "Malware payload (AgentTesla)", "value": "8ed427e4d54221dce3e84d19d63d3fe218a0e7d9fd92fd99adba962adeb58edf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603260, "uuid": "9405714f-9d79-4a1d-bed2-3b9b01bb4aad", "comment": "Malware payload (AgentTesla)", "value": "92488f40ca022782665b178341b3cefc6f539446", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603260, "uuid": "747ac40d-ed63-4aba-ba13-38b219a9abe7", "comment": "Malware payload (AgentTesla)", "value": "34b85762f85588dd85dd3514d5110ccc5f46f3bb9f2e969da5f9559d1a280ae308ff616681afef4c9179b98f2f48ba6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603260, "uuid": "3a3e0d58-a02d-4474-bb62-cd4ca39d04c4", "value": "9305E1343AEA9815F277AF39CAD97048CAFEFA633703D96968D613864203B41DD4187D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603260, "uuid": "0fd04eac-5fe3-4c41-bbb0-34aa0f2830d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603260, "uuid": "04310324-85bc-440f-b913-af22ff8a1a9f", "value": "12288:Ko+raEexpWIwkXzGWSE5D1kIpNFS2Nkul6uuvllrczVPNShzdlYZak2Gt:OuEzhEp19S2l6VvlA0XSZTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603260, "uuid": "af31d005-b42b-45d7-b05a-a0d81f6b37fb", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603260, "uuid": "cc295331-03cf-42df-acc2-3c33ac57fb04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603260, "uuid": "d1c3e4e2-6420-49cb-9d28-8829354cc9e2", "value": "EMPRESA_DOCUMENTOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3fbc65-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601544, "uuid": "9e3adf2e-4e08-4759-8426-2f42462ba132", "comment": "Malware payload (AgentTesla)", "value": "2ddd5c8efe99d9e0e483a41e76dc18b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601544, "uuid": "1e91ff59-ce5a-4843-a832-5c234b402fee", "comment": "Malware payload (AgentTesla)", "value": "8ef52baa82fc038e0f23ac9d20aa1ad6a8b4e41440c54ff1f4e05c7336967e19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601544, "uuid": "50d3c739-a8ed-429a-a8ad-e13bfc9e8865", "comment": "Malware payload (AgentTesla)", "value": "359d3e0e532c0cae4bb362231c3093436c7772b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601544, "uuid": "063010c0-5418-4521-b94a-c9829b6bec24", "comment": "Malware payload (AgentTesla)", "value": "a931246a110b99833b0e037c592f71287c5371da104703713389416a241a9a55a29cb60b94d6831e4d275655c01b0a11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601544, "uuid": "a78f51f6-bcd6-402b-913f-b74baa01e590", "value": "09E423BA7D2AD862E7589238B190D133BCFE7779073F90B8690B9AAF51C0D90C557C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601544, "uuid": "101f76a7-3ab9-4a8b-a7ae-253473e916fc", "value": "12288:Z9UOud/7M6GpCxJVfeE7lNFfQoMrabn/FlHuhrE1nAAykCrATNozh3f9Yite+:ZaHFGpCx3Gmlar8n9l3KAyvo8VYT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601544, "uuid": "8b53bcb6-c769-4fca-a364-2cfb7bea4e1d", "value": 699408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601544, "uuid": "b2c8a0f4-7c41-49bf-809f-4e36173a2ff6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601544, "uuid": "3a21f593-bea6-456c-bc2c-979ad3f15807", "value": "LZY062021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e1646e-d58a-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1624607758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607758, "uuid": "6474e550-b40e-4930-b89f-9d3e6d9fcfd7", "comment": "Malware payload (IcedID)", "value": "dab66c277887c4fb2c55748681a768a1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607758, "uuid": "dfe2af23-ba3b-475e-aa37-ab32fbf7a47b", "comment": "Malware payload (IcedID)", "value": "8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c6371e81814edbcd2738", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607758, "uuid": "9276fd2d-c7ef-4caa-8079-099f7727e686", "comment": "Malware payload (IcedID)", "value": "a39a2e78f941cd98542a6cd5c27d960e5e81c043", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607758, "uuid": "8beb375f-c315-4cc1-854c-a03839440ddc", "comment": "Malware payload (IcedID)", "value": "fe40e708e3825f52f19dad16ec0612fc27929ea9cccc5d8ce0c1043aef0e142742b738d5f22effc589b7aaaccc77d3d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607758, "uuid": "176bfab2-905c-4894-8753-2206d98e2c4d", "value": "987422973AB07BBEEEDAB577A0D65DC13D7B23958D28BF8111042A435B97A4138290C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607758, "uuid": "670f8d8f-78dd-4021-86b7-785f6dab30dd", "value": "b431941c337157e834b54d99a8a6e679", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607758, "uuid": "b103f834-c1ac-4fc6-98ac-66cc6027073f", "value": "6144:rVRWiM5gaPSBqqadBXkjQLGwfgArtQLScLyt6Tt+hvwiOTRO9lQ9foF9:xRW7DPS8dBXu8byLetU+1wikR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624607758, "uuid": "8a1689b9-e6f7-43e5-a5ca-4ee1f4271b7d", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624607758, "uuid": "866a867e-d098-47a0-a7db-e1429a560647", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607758, "uuid": "ed910721-8e91-4753-bff5-83f2f0ec51da", "value": "8f9b032ff6f56a685f4c6f9eb57784811d6c98aa83b0c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970a4792-d5b2-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1624624857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624857, "uuid": "f22f3c5f-a116-4706-a36a-c376c87d1359", "comment": "Malware payload (Adwind)", "value": "0c75a4065c17a4e9334b58c8015f87b9", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624857, "uuid": "c5bedbe6-e9c1-479c-a4f9-e7311b7a30dd", "comment": "Malware payload (Adwind)", "value": "90012bf83efdf9750be004245a917e779ac7ec7774768ca183daea5e7abbfdac", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624857, "uuid": "ecc599d8-b7d8-4489-888d-3e9e281514e8", "comment": "Malware payload (Adwind)", "value": "88be0a589c7f25989846015a8b14f3dff93e286a", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624857, "uuid": "c917648a-a7b3-4af0-8035-67bb23a9624d", "comment": "Malware payload (Adwind)", "value": "0419afe5c01eb56c7de456e8649a4dc285a3855169d972315c159bbee01c4413f6085de35d5ecbf4782b7c1ab171e254", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624857, "uuid": "bea70f0b-7d3d-487c-8c9e-521770280e5a", "value": "D2E42375B227EA99EC60BDC6098D67FF7ECC816D984D18CCA3618FDD28AC24E610D471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624857, "uuid": "ae374076-f930-48f3-af6b-9090e419c81a", "value": "12288:5gdPYPiN/W1k9+HxSYFUX39Wlwg9L9+DER0pWZDaaf+ur:6dYqA0Sx6HeVS0Z3fH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624857, "uuid": "4809cfaa-bdec-4a5f-a32e-7167b1d88218", "value": 663708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624857, "uuid": "b5637c48-aaff-489a-a3c1-b7c5d4143aa4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624857, "uuid": "ad329c24-9182-45fc-af38-7a8582fa3ca1", "value": "JUSTIFICANTES PAGO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48de3433-d5e4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624646201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646201, "uuid": "4a87d6a7-03f5-40d3-becf-52b32d03e2ac", "comment": "Malware payload", "value": "f1fa961a297c75a28b500f83859500f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646201, "uuid": "a91d78b9-8908-450f-af07-9c3a6d626d08", "comment": "Malware payload", "value": "90dcec517a0d6daf26758fddf5649425e01a1a1581f2094750fcaeae106f12e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646201, "uuid": "e3f9c3fd-88bb-4e75-811b-42f97647b909", "comment": "Malware payload", "value": "07abb3a03ef1af62012d798d23ca8892a469de7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646201, "uuid": "0f86c2bf-05bc-47ae-8e6b-bd7c55283c0c", "comment": "Malware payload", "value": "a44d8840c57cbbee4de63a849008235780aee89decc1ec9a093172bb50f8c78d56f0656d1096ea90ef89b203be2dbbe3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646201, "uuid": "cbd6a8da-a849-4754-ac54-f702c4b7d2ed", "value": "16F407262FE72F16E276BEF595E229C15E9BAF313213B43D9C71324E05325038B439A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646201, "uuid": "de390af2-408f-4d59-a136-7dadde75cebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646201, "uuid": "aca6bfaa-60e8-4406-bf39-f71b608f6038", "value": "12288:j3oJbtqE/yfJZaF9GF2N2+70pKXQlZ7U4/CcRE40FwvmnFmUU29U/dgx:qtjNEvuQmFmUUz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624646201, "uuid": "9375e494-5f1e-4ace-8bb3-de6177fbae66", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624646201, "uuid": "973c66fb-dac4-4979-92c6-21b003337a0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646201, "uuid": "29d3ed80-9f84-4941-a55d-a1c7ad5511f4", "value": "f1fa961a297c75a28b500f83859500f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507c8cc0-d590-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624610136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610136, "uuid": "3a7e5950-a9a0-450c-ad2b-0fbb3b789548", "comment": "Malware payload (Formbook)", "value": "c37a412f93afb56310b4d54d5d193d12", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610136, "uuid": "c8a7e92f-b639-4cd0-9cfc-148717b25053", "comment": "Malware payload (Formbook)", "value": "9349259160fa0f5b568826e27ea3e372372e7fcf4d0d8b9a7a2057195824506c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610136, "uuid": "361499ff-3bea-40dd-acb3-d64b02127b3c", "comment": "Malware payload (Formbook)", "value": "d2b71b9d8b234c27d47f82c7807aeb8c1e0f59ae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624610136, "uuid": "df6a4850-d87a-49c6-9ff9-da24cdcfd1dc", "comment": "Malware payload (Formbook)", "value": "92e598a78c164d75a1fdd49a3f2c82639ecc4e5afd7be6fcca1d51a50e5ca020e62f2312b9d19be8415ff525249d80a7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624610136, "uuid": "42bb7c53-acfc-424b-81fe-aafe3ff30c5e", "value": "EA441207B990ED23E61782714976E37DE77B9D0102529A4F03D4BF3B3C31A8D9A592E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624610136, "uuid": "2659394b-bd3b-434c-bdd1-a595ea225c03", "value": "6144:KEtTqjFa/Jwu+RB23xboJXMinu9+LExCwC3ynl5np4IoHH+P/:KE9fm/23RoRMSu9cICCnjnp3oHe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624610136, "uuid": "1a5ac896-7577-4c88-b4b2-e5b9a38ea51a", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624610136, "uuid": "36201dc9-f7c7-42ca-b383-9c29d66954cc", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624610136, "uuid": "249726a6-dc1b-47d9-9f56-ecdb86afa83d", "value": "c37a412f93afb56310b4d54d5d193d12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e2e309-d588-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624606845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606845, "uuid": "66f15902-94b9-4e51-b266-08f657c6d6d3", "comment": "Malware payload (Loki)", "value": "19495fff8624e0dbe96c05dd08c7d37e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606845, "uuid": "482b3d7f-1a98-42ed-97eb-6da77de93e9e", "comment": "Malware payload (Loki)", "value": "94ce947ee07dc19d535d78551ba3a64ffc394fd3049b0719f43ec9f78be32c08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606845, "uuid": "5b5ac817-a4db-4b6e-acd6-aad824b793cc", "comment": "Malware payload (Loki)", "value": "df42801769a5014c68d198de08f756dfbe71d88e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606845, "uuid": "cdc4bed1-77ae-42cc-bef3-c15ae9e0bccf", "comment": "Malware payload (Loki)", "value": "e4959cc270f8c69c6041bbe78959f149ad7230c1a7a661a6ae365af6cf151ddbfd4b2039af1beea234b127bfea8237aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606845, "uuid": "73ec93b5-203c-4da1-87d9-25023eaada19", "value": "9F54E101F6C0D2A6C86547314DFFCB28BAB6AE583515874F33983FBE3BB22C51A16156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606845, "uuid": "978b7bea-b44a-4091-97c8-28cafa850985", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606845, "uuid": "bf9677f9-5c1a-43cf-9ab0-cf87512e86d4", "value": "6144:3TqjFiDUFbCFLaL5BcBQ9ei3er8yvVOuK+w7JXe:DNDUcFa5BcBQzmVOuPwhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606845, "uuid": "332d2a18-bef4-435e-80f2-07dea9a1a53b", "value": 290111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606845, "uuid": "b00ce871-415d-454e-8f99-571b2302e7f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606845, "uuid": "aa8cf5b3-37de-4c61-851b-3f7563450e0f", "value": "19495fff8624e0dbe96c05dd08c7d37e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394f1c73-d5b8-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624627277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627277, "uuid": "2db03ab3-3e6c-4b9e-8ce3-ed69fbe3caab", "comment": "Malware payload (NanoCore)", "value": "b7fce51fa14ff50774a2e9d6d17d9fde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627277, "uuid": "e885e9d6-fd68-4c4b-ae1d-0f64fa691ba6", "comment": "Malware payload (NanoCore)", "value": "953af70b66f85393d92d5f9fca7feed759490cd31db58a2785191db8d8e0588d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627277, "uuid": "4ca3fe62-4114-4919-b604-8e31a856c59e", "comment": "Malware payload (NanoCore)", "value": "d7b4e974bf9a74a0d7f5d92305c4474bd31d0606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627277, "uuid": "1bd6841a-b2ae-4026-992e-ffa3a725a53c", "comment": "Malware payload (NanoCore)", "value": "98f864584cd6069ddbb4f98d0ef5880b13e4b105c27dcdbb6ea4f74d6524d7a74425d53109a06cff3a62425c4d38aa69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627277, "uuid": "89e749dc-d08c-4259-8b2b-9b5c2770f308", "value": "5BB4ADBC31A435EEC46BC6B99AA43CA4AA657077531B9607901301DE8E4DBC7CF209F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627277, "uuid": "cec31391-3e05-48e7-a2bb-2317789abd9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627277, "uuid": "17b1486f-46aa-4eec-b7c7-3546d731c38a", "value": "12288:H+qHA3BTV5NUWukW0Iunjwgw22m2/SLqDcdsrYN5WT/wl+yyj+Yd9:eqgBrIunjjZz+8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624627277, "uuid": "a580c369-b0d4-4d13-b757-bd1292c1f05f", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624627277, "uuid": "b0bdff28-c094-4c52-9e64-6cba335451da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627277, "uuid": "16601e26-5af3-41e7-9fff-2f41bdcc3324", "value": "Mwasiti Mnindy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b79e8c1-d607-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624661157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661157, "uuid": "5950f519-278d-491c-a98a-5e62fcea9bcc", "comment": "Malware payload (Mirai)", "value": "5415957805c76fce4a4dc2eb4483dfb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661157, "uuid": "bcf77bc6-2f2a-4223-a4d3-eba164c0e9b0", "comment": "Malware payload (Mirai)", "value": "95564e20722a60e9d66686f4f7868584009c236185f52e7100e737851c7a36c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661157, "uuid": "2982b2ea-94c2-4505-8618-e94ae49c5914", "comment": "Malware payload (Mirai)", "value": "35d9e2566afd076b533ca20d1e5d0145555c6d9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624661157, "uuid": "8f6cf58f-18a7-43e5-b4d7-32cb10dc0d66", "comment": "Malware payload (Mirai)", "value": "55878e2b9858e0f152fd5095849b18113db34e3165fcc105a0f3b92e74bc22e1832759e4cc31639a8d8c0b6427fccd09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661157, "uuid": "1ef319aa-932e-448b-91fa-9ea911b3af97", "value": "A803019092D48EC5D796CFA42C0065D227A61F9E7B1E4DB35111F7280385F59F284FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661157, "uuid": "ff36e88a-c9ca-4a5a-ba04-60f97aa45897", "value": "768:U8zXUwu2NtBqpGU54O0SRAV6jKXqcHfScLdUbgEcnvER7uDxat2CC94uVcqgw09f:UcX+2NXqpGUeSRAzqc/BI68uDXZ4u+qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624661157, "uuid": "086279ce-7e67-4f90-a6ec-3de985b07fee", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624661157, "uuid": "4cf6eb9f-5e68-4ec6-9c08-7cf3ab6d1660", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624661157, "uuid": "747495f4-7836-4a2f-a0a8-727a13823019", "value": "5415957805c76fce4a4dc2eb4483dfb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e151caa0-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624601360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601360, "uuid": "f580a235-6e08-458d-aab4-df19cfcdd731", "comment": "Malware payload (NanoCore)", "value": "a0886b0e0250fca0724c9ab731b7a0c8", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601360, "uuid": "b179f5ce-c267-4df7-9a45-f70b89906ee1", "comment": "Malware payload (NanoCore)", "value": "9562357a3d296ba7ff5aff1c90d977b8864fe1d909fae56bb03253718378c906", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601360, "uuid": "ff1f1481-55f9-4443-b27a-b4b264dca48e", "comment": "Malware payload (NanoCore)", "value": "4a4c989b4c239d97a7329d95aa0a14a20e4d622d", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601360, "uuid": "fb9f6cf2-7ef9-48d7-8324-249d4a1a53d6", "comment": "Malware payload (NanoCore)", "value": "46389f71db52c2656af16e2f9583ac215e66e281c3ebde3351005a688beb7271841a2b7f9618026a2cd28074279bf255", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601360, "uuid": "e4cff528-b4a4-4dc0-a202-78054b72042a", "value": "31153339A292DB9892717AA16FD711304B1A6B14765C3AF1E3D39A00BFDDC31B2C84DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601360, "uuid": "6f23273b-f612-436f-9b15-b8d5020401bd", "value": "24576:QR+WlxG4Guz0vNW3O+sVGmx3yRN3Huj63Alb:SATuwvp+stxiw66b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601360, "uuid": "d7de8164-55da-4837-b87c-cf0193eae4b4", "value": 905387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601360, "uuid": "72de156a-bc75-4970-9ef8-c102464bfc85", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601360, "uuid": "4fa1f6d7-9be7-4de5-9c55-d0df3aed5331", "value": "NEW ORDER \ufffd121120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68828614-d5c5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624632940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632940, "uuid": "85b34105-ceac-4ddf-abb7-2310e5a7df0a", "comment": "Malware payload", "value": "8f7224ef8d130901c7ace192453abea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632940, "uuid": "087e70b0-85bf-457d-b0bb-7b11e74aaeae", "comment": "Malware payload", "value": "95c4e07b1aec57b008fefe2f9ce187dd537200c5eed3b5e4723baa4e71479d62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632940, "uuid": "153a6558-132d-4381-a4df-2b76a0a06ed6", "comment": "Malware payload", "value": "c9b3e789357dbe58f30f74c533efff165f9117f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632940, "uuid": "e4b6a0ac-e428-4ba3-97d7-e56895961224", "comment": "Malware payload", "value": "997efc584f457a07516fb4675e4fc09e81cc26b42ac182837697c0a10dd5ca7864e1b62582dc9ea490c4f0d9ed50de16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632940, "uuid": "3199afe8-1875-4df4-b31f-921a0dd30d03", "value": "E6F2E132F1C91DD1EAEB8AE05CB99BC03FF4D69522D385E1D5C26F04E6225727104AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632940, "uuid": "774806c5-58c7-4286-9456-c66a1c2ffa95", "value": "768:L5nGGh+LqlSQxpnzptaFDv2cQGzDTkEnUFHUEJsuT4uVcqgw02NWXe:BGGeuSapzHGDv2+zDwGMUK4u+qgw06WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632940, "uuid": "ac2f4ba1-d920-4f43-937e-ecbbc8961aba", "value": 36512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632940, "uuid": "63ee7f22-6fd5-43d9-8565-5267e1c8e16a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632940, "uuid": "cbe0f426-5bbb-4e55-bbeb-c42c8daec1b7", "value": "8f7224ef8d130901c7ace192453abea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eda5e10-d587-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624606214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606214, "uuid": "51e3104e-7223-48a4-b166-948e0a72f4ea", "comment": "Malware payload", "value": "d81c085b14eba4b6c3fef37322289c65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606214, "uuid": "57c532e4-7c05-41d7-8970-379ded81a54b", "comment": "Malware payload", "value": "95d7bd4c503dd59d01cd8ebc81807ee6646da20c429f4e53bc73786845e75d69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606214, "uuid": "bf3f6c47-49ae-42e6-8d73-d1daf8a349a1", "comment": "Malware payload", "value": "300b8760b42d07eb725447f62bfa6df3707e6f33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606214, "uuid": "42658473-e838-4396-862a-e9c1facf9e38", "comment": "Malware payload", "value": "e989b0b2d7d94939ac8c34bde2b1dd87d1d59ecdef0178ef3d8deea18e94f51af2bff14ff22ce8398f1bd3c705703a3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606214, "uuid": "3da456ab-dea1-4218-8ae8-cfee6bd4f11a", "value": "1C04C26623A7D475C1C82230E0A5CB3B2628CD2717707257B1CABD97BD6B25C8DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606214, "uuid": "e2a6b639-9c04-4f05-a92b-bedaf2874f21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606214, "uuid": "92de7692-02b9-4eea-9ad8-0cf50e0e4cc0", "value": "3072:JiJQ4ocnp1KrzEBhja913QxOwmk1A7+PvxI884040404u:JiW4bpW0hja91gUk1A7me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606214, "uuid": "7f480fb1-9229-4d0d-b2db-95b81dccda8c", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606214, "uuid": "9a7b7ecb-a30a-4a59-90ec-204714432d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606214, "uuid": "17469f26-635c-408e-bc42-ca37d95e576e", "value": "d81c085b14eba4b6c3fef37322289c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefe9691-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603477, "uuid": "d83cbe23-b25b-4cfd-8e9a-304a678b6688", "comment": "Malware payload (AgentTesla)", "value": "b0fb3dea178fd74c406a275776421735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603477, "uuid": "58b8c0ff-f928-4e75-b910-1703dd8827e4", "comment": "Malware payload (AgentTesla)", "value": "962e36cc88a95881f13c4a22c40ec59d6a0a4dfb0427357995ed2605dffa5a33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603477, "uuid": "9a94051f-df14-40cb-92f7-6716f9472a25", "comment": "Malware payload (AgentTesla)", "value": "b5ba18fb40a95824e4acad4548c3dd3264dd4b0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603477, "uuid": "e10a880a-ae4f-4957-9c99-7b687542c92f", "comment": "Malware payload (AgentTesla)", "value": "63df0720a155310b5943d4354ceee4e4474e99ede0d35e5c9866aa070ddf15d100e60f788eb28fc90a99ee7d71e50a70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603477, "uuid": "66468dfd-c560-4caf-8473-335a7e341755", "value": "89E423FEA017D0D2930E4296C0453D36FF12CAD6FED0EB7C4EA6E921A9147C997A4890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603477, "uuid": "d20dd80b-f3ee-4f77-8069-74f0524fdbc1", "value": "12288:G1jVEU2T6xFFHdsuo7DKc86nn6NjiGBbEGdFJJiT1ge8oec5Fog+c:wjc6xFtKFvb8u6NjzQexiTyXqFoBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603477, "uuid": "45bbc0f3-4fc2-4ddc-8b3a-9b99d86edf2e", "value": 663051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603477, "uuid": "76469629-22fd-4f61-b80b-5737960e88c5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603477, "uuid": "d20a7f98-c653-4730-af0b-87d03dc570e5", "value": "Lebanon Khayat Trading Company.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cc9a7d-d5de-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624643572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643572, "uuid": "2809b716-d641-4700-b21a-7f04379ffa87", "comment": "Malware payload (Mirai)", "value": "bd0bb4160887d0d1be6b27ceb84e6706", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643572, "uuid": "15696a46-21cc-470e-a6b2-78c7ab7b3e57", "comment": "Malware payload (Mirai)", "value": "96a7437f36863edcc303788f8746f41e7e2288db02215da09fe953ed2b7289f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643572, "uuid": "423349f4-d08e-4d29-aff5-99f2bd045dbb", "comment": "Malware payload (Mirai)", "value": "d9997edaa784a580661e7c8dcd6a4744a0910a21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643572, "uuid": "e354ff2b-8006-44d8-a214-90d6f7d62671", "comment": "Malware payload (Mirai)", "value": "e6e02490cbf8fdb4d5595684fe5fbdb5bbfdb625095fbeac4302e0b457af8063b3146382210cb93c76277541a0c64288", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643572, "uuid": "4951e03a-6f65-4e39-8197-62a2e69a49f8", "value": "AA432A25AD792E26C0D8A57E61F78314F2E2620E65F4C65E3C720E4EFF04B4065637BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643572, "uuid": "7e095d4f-4507-4380-a5fb-7d6233c05737", "value": "768:PaorQ3Qfq9NaymN/zsn2pB2X6Ws4Pm8NjddVwvGFaO+m07B:Pa6Q3QfSNaymN/zY2wX6v4JBFIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624643572, "uuid": "d2cef03b-60ac-4069-a243-2f5d135358f5", "value": 59844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624643572, "uuid": "4f1021b7-109c-4368-a4a2-44c595a45d1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643572, "uuid": "e31cab19-ab08-4741-adc5-98ff01ff1a6b", "value": "bd0bb4160887d0d1be6b27ceb84e6706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29101975-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642282, "uuid": "6c05c853-566d-460d-9465-2386f12eb08c", "comment": "Malware payload (Mirai)", "value": "124a23ac9e52bd4f19ff837582addaff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642282, "uuid": "9e4b919b-b592-4bd2-b884-4edd9af4e3f0", "comment": "Malware payload (Mirai)", "value": "96d9e91553d966d6e377d62b33ac14250ca1d84486875c90b6c8ca1cb95a0bbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642282, "uuid": "42cdb61e-4c8e-4169-8187-ebf7381b49e8", "comment": "Malware payload (Mirai)", "value": "215636aa435c5241a35f16880a386717a53d26ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642282, "uuid": "527d5969-635b-4e35-a435-74146aed2a0a", "comment": "Malware payload (Mirai)", "value": "e5d8c4057d81cfec7f4ffd00b5823cb865a40ad97be9aba952a6dce57742330b7407969bf9f1e1509e0e9750bd3ed535", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642282, "uuid": "c07a45c3-518f-4186-9d50-8f5967245050", "value": "E0733A55BCC19A13C6D113BBFA6E40CD371623A8E2EB7207CD156F11738A86F0EA7661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642282, "uuid": "984f0eb3-3195-4c12-af33-0f010e088535", "value": "1536:usO1+BkQ8yi6dT9ncsnxLs9ewNJ4HtGKu/NsAqXLH1iNODui9VAU1vS:usO1akQLY/yz7ViNi/pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642282, "uuid": "5eae52c4-2469-4491-8155-7efaaaa37c55", "value": 75860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642282, "uuid": "309db384-db5a-45a5-bcf0-118dc8807a0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642282, "uuid": "6742f98c-8eb5-4391-9144-c09d009475c7", "value": "124a23ac9e52bd4f19ff837582addaff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4d847a-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631901, "uuid": "0a3203d1-d9df-4784-8f6d-58a6c96ee836", "comment": "Malware payload (Mirai)", "value": "8f0ba5defb37479477f34da985ea36dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631901, "uuid": "01155960-c2b1-488f-97c3-769c13fb9db9", "comment": "Malware payload (Mirai)", "value": "96f90a6cba0ced78889036046bd36b6072d8d370ba59007dfc3855a7e7d9e87d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631901, "uuid": "33d42a41-ab2f-4ad6-a6cc-eefae1dfbd45", "comment": "Malware payload (Mirai)", "value": "6f3d6c28f6b163c9d48237801dd8f8360821bc99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631901, "uuid": "440642c9-cb30-4dc0-8077-03b5f6e3b7a6", "comment": "Malware payload (Mirai)", "value": "2024fe8b0a2141d45fdafe9ba37c0b4f35355741e4342573cfc6128c59af1eb0ec4515f2e87a6f909448db3179c88dca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631901, "uuid": "802a045e-3e7f-45ce-b2fe-61a59a8e6036", "value": "91E34C46EB408F03C0DA2775BAAF424A33239755E3DB73069D28ABB43F83A5D4E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631901, "uuid": "76e81ff0-d524-4f85-a007-a4d1f9a5983d", "value": "3072:mntHwe94K+asiopO7fi31MBa//x53bniM/9Of:OS8V+asiopOji31553biM/9Of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631901, "uuid": "5240532e-af2b-4d73-b6c0-e130cc0268a7", "value": 151891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631901, "uuid": "a4e4ceef-319b-4793-a493-dd8c21caa43d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631901, "uuid": "740aa45a-2d13-4e23-a1d2-feec9df6f28a", "value": "8f0ba5defb37479477f34da985ea36dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f469b840-d5af-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624623726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623726, "uuid": "1d252584-3ec9-4f08-8d96-0eee4166ed2c", "comment": "Malware payload (AgentTesla)", "value": "ac03afdb4d748eb88cbe79b157b1ea61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623726, "uuid": "690cffe2-7176-47cb-9fb0-7faff4032d7f", "comment": "Malware payload (AgentTesla)", "value": "9720423765c71803b7385e9f2e898b2be759d767e446b6d129f7aa6ea2ac65e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623726, "uuid": "dd4e08b1-32d1-4ac9-bbc9-e7c2d510bc6b", "comment": "Malware payload (AgentTesla)", "value": "a48fc42d621065ea1473f3f8c2c994ac3e6f2185", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623726, "uuid": "cba5a74f-f599-4d46-a1fd-02d010051629", "comment": "Malware payload (AgentTesla)", "value": "75976cab7e59a21ea31b5eb343f17b7a44d128381a17fbface3e50769b82f2dee9ccfe81d7bc1abedfe356e25f529a60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623726, "uuid": "91e96a2f-6a4f-42cf-9808-1a792907a11c", "value": "4A1501751720DE9BD3B902B88852F7380BF4AEF9AD81E70A7D9430DCB6B7B144E52518", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623726, "uuid": "5c99d5b0-1ecf-4ca8-a3d6-69553d4ebf65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623726, "uuid": "299566cf-507d-4eeb-9999-0a07ebdb3442", "value": "24576:Q7hEp1BjLEeMSPe7fVvQqlNvsI3MjUAvLeS:Q72a79vQy7wxvL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624623726, "uuid": "e609f333-8707-408d-8ffb-9f35ba6f9802", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624623726, "uuid": "6034a559-a9a2-42e5-8357-f010171a495b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623726, "uuid": "b8c69001-5a9f-4fc8-8972-935b0135a879", "value": "usd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cf6d91-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651670, "uuid": "b73d5c9a-24ef-48fb-96d9-6b595aef3177", "comment": "Malware payload (Mirai)", "value": "7859606166c5e0216c81a1864a1e1488", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651670, "uuid": "fd763fce-5e08-4a17-9a85-584c41171e14", "comment": "Malware payload (Mirai)", "value": "975bb71d17437b5b2feb0522bfe750a04b26d9c58419411d8cd154307ba5fba1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651670, "uuid": "5c32f2e1-abd8-47c2-9b20-7c3c15a7a247", "comment": "Malware payload (Mirai)", "value": "4130c6d0c4290d8a7bbad04a4f8a6ecc846a8c80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651670, "uuid": "480368c3-7d20-4f01-a7ea-230fb596c96b", "comment": "Malware payload (Mirai)", "value": "9409c78029e8e0816d6acacd7f9caef3cc604bdfc74da9414bb54127b9f73d6289c3aea0009c420a1916c57f4d25bad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651670, "uuid": "9b426ceb-1a01-4aab-80bf-8070a7eacc66", "value": "79434DD5B400DE7CF98BEB7A80224A09FA35726154A30F27A267FD93AC720565C2FD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651670, "uuid": "143ef302-1068-475c-ba65-49162a856492", "value": "1536:ntCdFUWyWse2sRP876XyLCkBnKSQDViQFM8e:isDsR5XOLNmi2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651670, "uuid": "805ca2aa-3172-4d36-be39-352567770438", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651670, "uuid": "7ad6ab67-caea-4e80-84cd-77c350c8f4c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651670, "uuid": "03c04343-d0ca-491e-ba81-c5efca400605", "value": "7859606166c5e0216c81a1864a1e1488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b351957-d5b0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624623791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623791, "uuid": "b552a596-ffb9-4ac2-898c-095093e82118", "comment": "Malware payload (Formbook)", "value": "ec5f47fe4a35107c14c9837b1737e7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623791, "uuid": "2fdc35ff-5182-429c-81b2-d0cb7188d91a", "comment": "Malware payload (Formbook)", "value": "97710e37b088b72c870ceb2a4c03a04625f800a83549ed4537dc64893fc33587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623791, "uuid": "5e47bbe8-27e2-49e7-b827-fdeaac529504", "comment": "Malware payload (Formbook)", "value": "fd6070cd7662568cfc1e9f6451cd4a30f866b62e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623791, "uuid": "203cff34-f434-4004-b3bc-c8ae93335bcf", "comment": "Malware payload (Formbook)", "value": "2151a206a6304267461e91602df8da6984ccef0eb4ef3bc8b1addc1bf0d288857b23a61c0f7116c484b4dcf82f454ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623791, "uuid": "91d9f00c-6eeb-49d7-b708-fc71cb9a01d1", "value": "15A48CBC72A435EEC46BCABA9EA83C65AA653077531B8146901301DD9E4DBC3DF604F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623791, "uuid": "70d4ac7b-14d2-4e44-acea-ac947d6f8669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623791, "uuid": "b5b0751f-e7c6-4cc7-aa35-60c00187bf5c", "value": "6144:ttVixIMpYEEsD5S5OMykMS4vk2VuKDMP9N1bIyu0TFxYVYQXV4bfxZpHVWKl5azI:fhE7DUmvRSIyuEFxISZZpHVWKrazcl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624623791, "uuid": "5a693f6f-8a91-44de-b6d8-b0042c10d463", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624623791, "uuid": "f47b3dba-c862-46a1-8e86-c0bb5289c696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623791, "uuid": "177155f5-88a1-4c65-8989-970135cbadaa", "value": "tt0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65012ea3-d5c5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632934, "uuid": "abb4f0f0-ebd9-491c-a8e7-ce6c4f064d77", "comment": "Malware payload (Mirai)", "value": "e9ddf9de17b5dba33c361ff77d1b454c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632934, "uuid": "da7c40b1-0365-402d-a482-494ca9d0cd5d", "comment": "Malware payload (Mirai)", "value": "98393c12f2604a305e96f4f01e07237caac5e343cc9f96e476e2845ad98fc145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632934, "uuid": "5ca1a40d-def0-401e-b843-6b104f01ccc5", "comment": "Malware payload (Mirai)", "value": "4638c210f31a203a58540f73e40863d1346ae902", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632934, "uuid": "28793aca-b8f4-4177-aaed-2cb54c229bf6", "comment": "Malware payload (Mirai)", "value": "c6aab6fdac2b57431f557986a1c2141f0071bc0ff962d7f9c810880914a2cf07762518f5fcc6a25754a6687d0be7ee10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632934, "uuid": "dccb290e-dcd3-475b-bfb4-66ee63f18774", "value": "5793B309BFA05FF7E8AFCC3345992B4528DD555A21A83B79B830D828B25B24F15E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632934, "uuid": "50462da2-6461-40e7-bfa5-30e587ba1c5f", "value": "1536:jj39JOfB9t8NK8WI/ZJh8RZSQkH9X6ox+:jj9JOfB9t8NV2ZTkUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632934, "uuid": "f5653988-ed1b-4bf2-827c-aa9395723dd0", "value": 96608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632934, "uuid": "67f85990-46b5-4c82-a3dd-dcd1904f6551", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632934, "uuid": "9997ff59-826e-4101-9346-ba8d71bf5d8c", "value": "e9ddf9de17b5dba33c361ff77d1b454c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ed35d1-d5da-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624641905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641905, "uuid": "a1459a77-dbdc-48bc-a94d-ef0c83fc73ad", "comment": "Malware payload (Formbook)", "value": "73eb22341ce8fcc60593432d2d37c872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641905, "uuid": "819aac41-1fdb-4312-a97d-175866b673b6", "comment": "Malware payload (Formbook)", "value": "985c930f9f983d8ec93977335ebff73b477d7aaa678c163be58714525fb9f273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641905, "uuid": "979d1547-63b0-4a92-8b8b-f33532db7172", "comment": "Malware payload (Formbook)", "value": "9aad11376e92a7b87ae2296e1c146ef88e2b3e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641905, "uuid": "770390a7-8836-475d-9d5e-bdf2fbd144c8", "comment": "Malware payload (Formbook)", "value": "4399317ab87b92ff2c5f16b15d46c161260c268e1ff09a62d2b3333b653ab6c8bbdc9bf1287cae7e64767e3befe34cc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641905, "uuid": "6e362c21-f393-4619-9165-28da9c0c8d33", "value": "DEA4DF8837B94FA3E1BE47F696B1741083FA692B623EE9095DC320C605B5F004D65F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641905, "uuid": "e7f26c93-06ee-41ed-9438-6b50bcc340c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641905, "uuid": "06d119a2-7bc1-4598-a98e-460d39127950", "value": "6144:g34P86jIlgv5aK9rj5vVFfAb04v+M4/Vf9fkhqx4YYAdCSjtDU/5hL5WwHPc+nfe:eYd9rjB14v4//f13RcatDAL5Wwv9f6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641905, "uuid": "4422923b-ef89-46bd-9597-91e1ebc96b97", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641905, "uuid": "468aaf8f-fd7e-4d8d-bb6e-7d2d1550562b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641905, "uuid": "9f26d8f2-e71d-4ff3-b4ab-ec36986c323b", "value": "SHIPPING DOC CICOOPLBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cdf9c4-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603243, "uuid": "73dc3077-194a-4ddf-a299-915da4592164", "comment": "Malware payload (AgentTesla)", "value": "db24b43e9fdbaabf7d9680ce9ac41b31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603243, "uuid": "d206646b-8ad1-4f4b-aefe-e43c9682a8c4", "comment": "Malware payload (AgentTesla)", "value": "98a1d9f6f3f91ab72548c157dc9a9f8ff78f17a062161cd212e1673606fafce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603243, "uuid": "ac2e8e39-8733-4768-97ec-1ba95ab4c112", "comment": "Malware payload (AgentTesla)", "value": "a902197331ef31f579daaedc57820e75381f5c21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603243, "uuid": "69527c1a-9d59-4865-8423-e2ae263b3ade", "comment": "Malware payload (AgentTesla)", "value": "9db555ab009c6008a1fa60ff2493061adc6365a11fdf84de068fd61329160871ab96b1bc4b7526d42e9f60dbf8e351f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603243, "uuid": "375e7cc1-e692-4bbf-abc9-2a141d3d2585", "value": "77E423A5E1C7C27DDCB208992E17DB3134B1E3EA8C25CB1A42CE78240B597E44599BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603243, "uuid": "9214394d-dfce-4b87-9c81-765e0b807fed", "value": "12288:ECp0tN1eS9qWCAmZHD08QFo2j0AYO+fKzK0cb522lwQx7jNVuWolJXxw:P0b1Hvv+HAxFoO0AYOyKzK0cb5Z7jNVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603243, "uuid": "934ef0b3-8d61-428b-a9d9-5d64c905b2a5", "value": 683669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603243, "uuid": "c5e67971-cc33-4773-b02d-41109eb7eaed", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603243, "uuid": "39c32e6c-c0e1-4f40-b825-fc1af3a0978d", "value": "EMPRESA_DOCUMENTOS.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab71f84a-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601699, "uuid": "181c2ac6-8919-44fe-b788-7ef95079dd8a", "comment": "Malware payload (AgentTesla)", "value": "81a9c901c359528acc4d27ce464988de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601699, "uuid": "0f35de9a-c82a-4ca2-920a-2cd6a9fe0cd6", "comment": "Malware payload (AgentTesla)", "value": "9940dd5ca9e502ac7e320c970d86e80491a8d6aa1ab5c649b10ae177042c4757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601699, "uuid": "539c310b-c5d7-4a59-a2a4-99e80979594b", "comment": "Malware payload (AgentTesla)", "value": "194bfee9ef768bdb123baf1af16faf4412bc4278", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601699, "uuid": "493234e8-8e56-40f7-b4d7-6031c381b0f0", "comment": "Malware payload (AgentTesla)", "value": "2f56f6a57815803a111e7aeec19a1c92862c1f7bebca83171c65d9f3a82acee3268c7a377a9dac40b4d58034e0fd2fca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601699, "uuid": "ca46f3e8-a5de-4061-a02d-5d3190846d6f", "value": "0D253306F581B2FDDC09FA9B0D003AAEE4C68BF279665C4EAC28BC11323CB157D75916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601699, "uuid": "d620dfd5-5e3d-41ad-b506-cda0f9aa1cf4", "value": "24576:wlL67J6EuLeLTIYyO50390/C6uF6xuC2b83ZJnHhJHbcVzE8dqsR:wA96EuaHIYy089qCgxO83ZxXMwOqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601699, "uuid": "4bc371a3-342a-4d57-a6c1-e5c54948c4dd", "value": 1039151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601699, "uuid": "d00c3053-0589-4b7f-80bb-4a9f430a6348", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601699, "uuid": "25577aa4-e97c-4b76-ae08-bcfeab81e71d", "value": "HL-883525800 DOCAU BC ORIGINAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5ee84a-d5b1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624624226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624226, "uuid": "73f4915b-1e66-49b3-acdd-1354092f4dfb", "comment": "Malware payload (Formbook)", "value": "5f4e6c1235a44e9ad163ea8d884be780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624226, "uuid": "185f8385-1476-4a15-a7ff-9e3e0b30bbca", "comment": "Malware payload (Formbook)", "value": "9a280dbe747fd0138866ce3eed8cd95ab86115e7d779d85f160d8350785a2d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624226, "uuid": "43288b1f-4ef4-4179-b341-7a82e683d2e9", "comment": "Malware payload (Formbook)", "value": "aae60dc983c2b9f7140c9c8916e8f2f0f2fb7d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624624226, "uuid": "8a2dccc3-a4ad-495a-b676-d2937037165d", "comment": "Malware payload (Formbook)", "value": "351d8d42e1531e1679a51c5a42505e2ce4d4505ac2571c2ba96d7f064ee7f4946ea524ce7e6fbc16293193a7280559ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624226, "uuid": "3f2ad032-e1bc-428d-b1b5-b9fbf66e3f74", "value": "AD05E0383AED5424F2B79F3ADADCB145EA7FFA633303D85D1850134A4A53E84ED42626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624226, "uuid": "c020db3b-75fb-4771-9033-6f5b8b8018b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624226, "uuid": "ddf51fa8-272b-4b27-aea0-43284c3e0212", "value": "24576:WJf/hEp1SkVxyapRJsWxRyodpQyjwMXB:CEyapRJsWZ3jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624624226, "uuid": "6df5c88e-f0f7-4cf4-99b8-96bd18061381", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624624226, "uuid": "9d086155-4579-40fe-9c29-36f2eca071f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624624226, "uuid": "0c750c78-e139-4c7d-b283-3ac4506d244b", "value": "payment_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726b0e43-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624602892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602892, "uuid": "f3dbfbdb-5361-4883-ac74-385d62a6a5a4", "comment": "Malware payload (SnakeKeylogger)", "value": "bf430deddf941c66699e61dabe99161c", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602892, "uuid": "5baf8a7d-87e3-4216-bfd5-ad4eaf176b63", "comment": "Malware payload (SnakeKeylogger)", "value": "9b665e3a9bf7e5fb967be0c1d54c19967250e796a190d2bc55380fbdfa7e426a", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602892, "uuid": "69393aa9-6430-4f9f-800e-7592e5673081", "comment": "Malware payload (SnakeKeylogger)", "value": "46aee4fe73e41515604f0becf7f0aa73a118e96b", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602892, "uuid": "3b8aa967-e81c-427c-94ba-6217183012a9", "comment": "Malware payload (SnakeKeylogger)", "value": "0b0e11f3fb6a251debfcc22fff2c5f1c0034d71318d9f02f0bb16b61fc68e0b7ccf9a8be2c116b2abf37919f84ed2209", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602892, "uuid": "227f31d1-e8a2-43bf-9759-b2c48d0021dc", "value": "80D423F89048F8DD6E18E47C99B48511BC9A00DEE7E2FBA35FD200165BE16507B896CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602892, "uuid": "ebce0e1c-32c8-4c16-aca3-6c61a2fa6d8f", "value": "12288:WRtvAX4FFa6/Bop0V3gCru9HbtZFeY4yb/TNReIgwD9f:WHvARp0V3gCru3eY404AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602892, "uuid": "6c7d1c68-2d74-4bcb-a7b6-763d17a1101f", "value": 654998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602892, "uuid": "22ccebef-e80d-4533-8dbf-359d35c3f9a6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602892, "uuid": "1410a5f6-2341-40b6-8dab-45f89a4af030", "value": "TDX Drawing 07482#.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1c6567-d5d0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624637622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637622, "uuid": "4fdc88bb-cd8f-4097-9866-09869849f480", "comment": "Malware payload", "value": "f930fed502910c89267677b84e2ad7da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637622, "uuid": "80ebdeec-c474-44f1-85fa-5892da8aba1e", "comment": "Malware payload", "value": "9ba99db4c643c7b335b73fd5c52062f25f1699cda426b09710db4e0337360e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637622, "uuid": "1ed18c98-f587-4fa8-accd-0120c475ec2e", "comment": "Malware payload", "value": "1d4dd4aa8961c2d86728ee0ad8ba2b068f61b70b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637622, "uuid": "b2a956f4-376d-4a0c-b3dd-75da68441fd2", "comment": "Malware payload", "value": "2f26187497abde193011ffaf756df39966bec0c29ae26026b9a05b9e6645c927cc31b684d5119183c5362202178a05b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637622, "uuid": "c145ef96-1c3e-45f7-9e27-a4e0359f69fb", "value": "A575B69C7610B5DFD417CA72AAA85C74EA107CB6570FD203909726EEA90EA97CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637622, "uuid": "fbd3edd1-e113-47a3-a8db-9f097aaefa60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637622, "uuid": "62d45756-c71a-4937-8aaa-ba043103d9ee", "value": "24576:08ybpNuyClMeGMR2M9Hw1LOjlnh3n+87CSui83e:tGOeeGM0wHYLO+87z8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637622, "uuid": "17dbda25-2643-4660-9fec-593f135eccf6", "value": 1650176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637622, "uuid": "39b55f18-7da0-4f37-8bf3-c266be8c8c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637622, "uuid": "5c53db65-e8e5-404e-8a37-939ebfe0d0ac", "value": "f930fed502910c89267677b84e2ad7da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d401ba7-d5f0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651416, "uuid": "9dd2730c-5621-4f26-bd9f-88cf17138e72", "comment": "Malware payload (Mirai)", "value": "a9e7731288110f950d1b9c93eeac055a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651416, "uuid": "7ee75c0d-40dd-42e3-b951-00d7b430d781", "comment": "Malware payload (Mirai)", "value": "9bdb33d2437aad31acfa5d25053102cc7da267dedcb64066c2d7e8831a0ca78a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651416, "uuid": "d6655f41-2c55-4cf7-96a6-060f960e1777", "comment": "Malware payload (Mirai)", "value": "04617e1b9459115680342764b1425482fca96d29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651416, "uuid": "b7769f5f-08ef-467d-aa87-f667c2a87cb0", "comment": "Malware payload (Mirai)", "value": "618343dc72d35144d096e3005c105899a9c445fdd974dce86bc47ea58f2867cd74960e2df8c752eb3d44a80593cc4080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651416, "uuid": "c7a0031b-07e7-401a-8115-aace7beeb9cc", "value": "D2338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651416, "uuid": "8c40a159-6226-4aed-b49f-ca5586021144", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvA:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651416, "uuid": "fadda8ac-aafc-4ac9-9116-5c7606ed2ce3", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651416, "uuid": "a221728d-e4ee-4327-9186-5d6a230d04e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651416, "uuid": "c824262e-bc07-45ca-bfbd-29de54d6d090", "value": "a9e7731288110f950d1b9c93eeac055a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b86fbb-d5a9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624620745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620745, "uuid": "1fb63c8c-9c61-4753-aeb0-c2c86e2aa7f3", "comment": "Malware payload (AgentTesla)", "value": "7dd1ebc63b220b227fa01b1764947e3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620745, "uuid": "b4c98ce6-be4b-451f-84f8-08dfa9db9385", "comment": "Malware payload (AgentTesla)", "value": "9c4331dfe69481186d1ecc0026751207e164d5b7b206f456fb5e91a7e263008f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620745, "uuid": "3a5921e6-651f-497d-aef7-78826d29c4e2", "comment": "Malware payload (AgentTesla)", "value": "6a92e5290eabdc18b2a1e06e6e3ed3273b3f8e10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624620745, "uuid": "4f7185e7-17c1-4d98-8ce8-000ff97c8bc3", "comment": "Malware payload (AgentTesla)", "value": "48f8e6ae64c58eca2e844bd44143c3ab2e07212cf0e64bf9442c2a68465fc6d2080650b0e5a399ccec89d2cd789e0370", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620745, "uuid": "5a46949b-09e1-4f10-9ffd-c744f048c98c", "value": "81159D206A9C4308F076EBBCC9B06E514EA9BD12D611D1DB2AD33E8FF732541CD5662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620745, "uuid": "70ca5695-027b-4622-8f0f-f48743831b08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620745, "uuid": "90a8cfe9-b6b4-47b4-86c1-2aeccaa2dbfe", "value": "12288:6RAhJZaF75GF2lmekWaWXSkUrFHLInUzEBlzeSPDRRH43SZvfC+mQd6sLuk1d4:4AIblmRWXsxETzeAl4CvQq6sLuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624620745, "uuid": "173ce7f3-b127-4a08-92b4-17e814c07a0c", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624620745, "uuid": "8737fb30-b4ad-4034-b8fd-1924ba2ad290", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624620745, "uuid": "51ad4c79-2a6f-48c4-8df7-bef7d62bf309", "value": "WaybillDoc_3227610761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bfdc92-d5be-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624629763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629763, "uuid": "1608b315-2a08-41f3-8a41-d4cc8ae46ce7", "comment": "Malware payload", "value": "933095058228b63d67b54c251e6543c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629763, "uuid": "da4a148a-4635-4d66-950a-20a889aa3809", "comment": "Malware payload", "value": "9ca380b9e68f8aab9d08c3357ce286ce087c81c96b64923f6401dc31679b5453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629763, "uuid": "7e39e7c0-408c-45d9-a8fb-9dcdf5dfceca", "comment": "Malware payload", "value": "05493a5f02170fd59276dd900bede85a12176a26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629763, "uuid": "0b9ce230-45d3-4acc-97a9-329e25bf7c2f", "comment": "Malware payload", "value": "b5019b3d2ef30d4437d4c64f682d4c47d0b5dadf08c5385ead2d1438ba20e98c2384bc8fb85ffdb15e54aa35f53fe8ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629763, "uuid": "0782e6f3-1494-4e1c-855a-c1042ea9fad8", "value": "F0159D206D980319F076EBBCC9B06E514E99BD22D611D4DB2AD33E8FF733940CD5662A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629763, "uuid": "78f05332-211a-4a72-b8a2-5780a33c3683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629763, "uuid": "e5e62255-76ea-4ad6-9518-7dd08d1a0ff7", "value": "24576:DAub/bv2amrdve2P7LlJ3482OIKwSGuT:nzDZSve2z5J312ewSGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624629763, "uuid": "5bf1ee0e-3af1-4475-8a09-f6b22151934c", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624629763, "uuid": "6c0d6973-fdd4-4f43-ac34-91be5d30ecf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629763, "uuid": "16c43aed-9b60-4704-bddf-74078f216638", "value": "fyi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617d5165-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624600716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "cf2e7536-36b1-4833-be34-60d7bddda966", "comment": "Malware payload (Hancitor)", "value": "fbf9faada38a52880c6a1e9113c50ea6", "object_relation": "md5", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "e21bab6c-3c1e-48dd-8305-c2a6f0938026", "comment": "Malware payload (Hancitor)", "value": "9e94c305f6d7a7af5ba3555ef5c3e9d98d66fe5c9b639f41c8fc044e65091ae9", "object_relation": "sha256", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "f5012d07-ab36-41d9-9497-437345d6f405", "comment": "Malware payload (Hancitor)", "value": "413900b646a03929a116ee53c5857508a9cdbbc7", "object_relation": "sha1", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600716, "uuid": "40190efa-aec3-4c38-8b1d-9bd6f2e7aff7", "comment": "Malware payload (Hancitor)", "value": "b7eceb8e3736212682e9996dae307cd4204ce0abd41e0acdb38f469547dc8c6668a0d3fbf26a5f1065b36143c6983a86", "object_relation": "sha3-384", "Tag": [ { "name": "application/msword", "colour": "#8B4B1A", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "5f0c9dc6-f688-4316-b120-1076592be2d7", "value": "3025E000B9D1D532DAB315350F65DA96133CBC650F208ADF73D83A1E5F785E2AA30BA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "db3d1474-1567-4889-b0b0-dc7357dd1516", "value": "12288:NBGIYW4wA74FRrUSJUnKERsY10hYBzSF6G8MHZf5th8NS+LB7l98/OCd2yVlQSvn:NEIZ4wA74D4SQKxZcy8gthDWxAOJEz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600716, "uuid": "667ae9b2-aa8b-489f-9a5b-6daf208bea08", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600716, "uuid": "6dc60981-73fd-4dc7-a7d9-6a7ab9a492ce", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600716, "uuid": "ff033d48-b697-4a15-ae83-e9b91b3534b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7545b529-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624602896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602896, "uuid": "2bd515bd-b6fb-48b3-9241-e72e85f162e3", "comment": "Malware payload (SnakeKeylogger)", "value": "9df40067f484021025901f609a62c38f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602896, "uuid": "55666faf-273a-4d1a-b51d-c1052f0be968", "comment": "Malware payload (SnakeKeylogger)", "value": "9ea12e117942f679c15e78812b3300eb3cef160625a3d4f9e047a357e56da19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602896, "uuid": "186b8526-46bb-4582-b17c-03d635dc4ad5", "comment": "Malware payload (SnakeKeylogger)", "value": "d82730f900913b21a379e71c31240f8ee624c86a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602896, "uuid": "49f06666-9589-470e-af9b-2e08ff3daa28", "comment": "Malware payload (SnakeKeylogger)", "value": "93a3353f1b709fc24d43fcc279611167f1fd531f180a7965edd000262486d370cb336da62bae8f55a66d513907158310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602896, "uuid": "a621c935-0936-43fd-85eb-689ad302d076", "value": "23F4C0202AE95765F1B6FB388DF0F7915EEBBB53E303DC1E389112450693B42C9A2539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602896, "uuid": "5611455d-476e-4d38-b9eb-891006e75456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602896, "uuid": "e9084a00-1a0a-4c7b-8da6-4551845b90b2", "value": "12288:ggUmJZaF75GF2MzGWSE5D1kIpNm0EzvmTdpefqAvTPU44YdMeEupJlT2:fwbphEp1eH8dpeyUUeZrn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602896, "uuid": "5926df7e-456b-4ae5-82a4-e88370d46342", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602896, "uuid": "da811db0-a805-4f9d-8768-9c746dd31e3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602896, "uuid": "3063f81b-22bb-41bd-94a5-81f916688da6", "value": "TDX Drawing 07482#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b97a5ac-d5c4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624632408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632408, "uuid": "fa3d7b9d-8ec3-46f8-87de-f809f825c9f6", "comment": "Malware payload", "value": "f07885f4a45780eaf037a80a3c915ae3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632408, "uuid": "d6be4abb-17a9-442d-a936-e608106ab420", "comment": "Malware payload", "value": "a03d7fdab791b6a0010e99648c94dbeca54512048a8442f3f8bf5e5815b9e801", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632408, "uuid": "d8edb820-266e-49e5-b15d-5e21774f78fd", "comment": "Malware payload", "value": "a292e952b0c06dc2e9a0c5538d091fb266e89bbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632408, "uuid": "b413fe5a-5dc0-49ce-a7ed-4a2ca76dfb0d", "comment": "Malware payload", "value": "d1c4d46965f8da67d99542be8efefafbb4c5211b0376074d52479494149dfcc5c8f0d76b2b35fdf27d656acd989cc011", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632408, "uuid": "a2b075c4-4064-4915-90b0-230a1d1f3d47", "value": "5403E10DE0A00DC1CD7CA632916E3736EF64689C728FC3DDE3919A9990AFE07B44E165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632408, "uuid": "c217a16a-80eb-4869-802d-a63b2565549a", "value": "768:2u+dhF07mTlV27W63RxxMB7PNXU/d4ZrGMhVchbAjiz0076CqWRF:21jZlV2lBAd9KurDchsjig0hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632408, "uuid": "eedbeebd-2316-450f-b760-cb3f4d8d7fb4", "value": 39588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632408, "uuid": "13f9d36c-70d6-4679-aa53-e00bb4d058f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632408, "uuid": "7b09bb13-d259-4656-a799-238a458a8fa6", "value": "f07885f4a45780eaf037a80a3c915ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cea8cea-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588172, "uuid": "b3152c31-9eae-4518-a8ed-8c2f0ce49711", "comment": "Malware payload (Gafgyt)", "value": "a94a961224b77b122d5874d714cb0742", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588172, "uuid": "d2e2b3fb-f420-4f68-96c5-147d767e04d4", "comment": "Malware payload (Gafgyt)", "value": "a05294937a814c534c1b85e086d424ca4d65d82c7d07f3e5335b521002140950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588172, "uuid": "1f01225c-1f00-42b5-bd8f-908f94298878", "comment": "Malware payload (Gafgyt)", "value": "843e6051984085dd404c980776f23b624ea7f45a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588172, "uuid": "677af38f-2ff9-46d8-8b87-502b7b726369", "comment": "Malware payload (Gafgyt)", "value": "a22ddd7249af6ea757f347f23d28be866d0db296b196242c3c000a9f393729fb5728d930c94d6b247752e869a4bfac47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588172, "uuid": "2cd984d5-d1f3-4ef2-afd5-d2fecc3c8a5d", "value": "C7A3094795324F73D40A2A752DBA9960076EAED10F5F1A5B62BC76B0023F8CDF41EB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588172, "uuid": "4b06584d-74c0-4379-b05a-10d9fe9e2eca", "value": "1536:rfqAXUkKkB0JveZRKJ/pOmUUgD1lCEiCxwFLvmI4A0Yhfz+fQNg5:uAjlB0B/JnUUvEiOcvmJA0Yhr+fQNg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588172, "uuid": "a9cf9a5e-1a41-438e-9664-27654aa35ad0", "value": 107221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588172, "uuid": "33425d29-bad8-421e-9e78-3c6877d0e894", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588172, "uuid": "77e86259-7c8e-428e-a16b-92aa2aba5e34", "value": "a94a961224b77b122d5874d714cb0742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a88453e-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624601671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601671, "uuid": "89f8eec0-ac8a-41a9-9377-3f191979ec42", "comment": "Malware payload (Formbook)", "value": "cf6a719fc5ce055c5ea91fd5a72e5276", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601671, "uuid": "5127c38f-e6ef-4cad-b3e8-2a07ce74017a", "comment": "Malware payload (Formbook)", "value": "a05c75cc33b9e7a07f7fed5462e81d59577a90de4f0460ebea2e11865bd944d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601671, "uuid": "afd81c0a-cc16-4510-9786-b8ac414e64a4", "comment": "Malware payload (Formbook)", "value": "3f269af9cdf287515d183c29163322fb70bee505", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601671, "uuid": "0f84dfcd-39ff-4066-baca-89de0d4b2166", "comment": "Malware payload (Formbook)", "value": "fa7fb6405b0c366861cd70af7f71042935a3faa65a7abdde0987a0c8a436b6cd6856bca9147dbe762afe2c9cd90c9443", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601671, "uuid": "083ded0e-5316-4141-b1bb-96ae60db3baf", "value": "5105233536C80EA849C66AE554D7FDA6F12F68EC472DC144CB9050FC687ECA9322FA07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601671, "uuid": "c43511c1-b95b-4903-8434-c11a1e0736cf", "value": "24576:v1qsCjFBq8Lj6pBxKfZKIePDIBixdJaRZMRAxKf:9xm68ABxKsIOIBiLJ8ZZxKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601671, "uuid": "1196552b-a067-4eb0-86f6-6c0f854de1f4", "value": 797909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601671, "uuid": "f3ca24ff-438d-467e-9003-2ba05d259ea1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601671, "uuid": "b5d8bc7e-ab89-4cf9-b0b5-dc5c4a7b3c5c", "value": "Minutes of Meeting 22062021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3905bb8-d5a4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624618973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618973, "uuid": "05af7f20-6399-4daa-ad7b-6e6b0a1dbcdd", "comment": "Malware payload (AgentTesla)", "value": "b59ab62dc16f878a4356b610be474009", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618973, "uuid": "f081cf0d-a914-45a9-a30b-042d4a62f663", "comment": "Malware payload (AgentTesla)", "value": "a08d1f6ad62c47683bd4f7de087c69887b42b138506a226d031ad7f4af316d06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618973, "uuid": "40512907-8b5b-4795-aec1-0c202e57b1db", "comment": "Malware payload (AgentTesla)", "value": "3b3e88bc44d710e3cce4691bccd71b27f01ec5a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618973, "uuid": "f27d6d08-f8a7-4933-b3e0-65a9acc4b826", "comment": "Malware payload (AgentTesla)", "value": "358e91641211b17c94386e2e1224e1c8dbc383bbef0dcce89b4448c606fb85cd91f03d0b08e5bc6e9d82b0f2ec20bd62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618973, "uuid": "e7cdf643-a549-4473-a15c-fae937ea6166", "value": "7C7443A4119B8272E6444E4D75C0B2C95E75FE9230CACC2963AECA71CF65AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618973, "uuid": "72cd824f-64ed-4c24-b5a5-a0bcde1fcd8b", "value": "3072:93BrB2BrBKhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qH2iTqRdzFDr5RDAw5wf/:nVcVKjT6dzFD1RDAUw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624618973, "uuid": "5bf9225f-95e3-4963-ac45-3f071d213726", "value": 358586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624618973, "uuid": "9fb1b606-75b8-4d12-a8b6-0d63e553966d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618973, "uuid": "af008ae0-f5c9-42d9-99c9-ef3433f7129c", "value": "#898765.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09eeedd6-d584-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624604864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604864, "uuid": "61bd3c95-9144-46dc-ad9f-aab35c89ee40", "comment": "Malware payload (AgentTesla)", "value": "a383e1dd44485e175e4610768926aa46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604864, "uuid": "7aa10e9f-5531-4153-9569-df632f362412", "comment": "Malware payload (AgentTesla)", "value": "a191e465282f74cfe89c9ff81221e0a898bba147efe894a9110f9e3474dbe5ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604864, "uuid": "fdb03fe0-05d6-4d2f-a21a-45a450a2f364", "comment": "Malware payload (AgentTesla)", "value": "35a0a96f0655f0d90b73690a79e5b7422e1d4fdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604864, "uuid": "068f33b0-8995-48d4-babe-5c7ec46a2eb5", "comment": "Malware payload (AgentTesla)", "value": "f50eb87a86c3557279a76a89a8c8f02899a348c4d4ebecf9207a86150225dd49362947999b8f65c3000c1eaa3e29faa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604864, "uuid": "e821051e-2e86-4202-8702-dd782ff5e374", "value": "3FB4C7212E4F5816CBE2EAB729154F79BDE574CEB5857C131B40ABA234319F2C783263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604864, "uuid": "c5b2dcfd-3603-4283-baac-539bc4155928", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604864, "uuid": "1fe57035-3f13-42a1-b7ff-dfacd2de6d39", "value": "6144:TTqjFcYOkn/A5PEEBkdZ5gRhm5mbX0mMswKNLB048j18:HLk/A5PpB4CRD7MfKNR8j18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604864, "uuid": "b01878a2-dd78-4910-802a-f14f56c03cbf", "value": 501871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604864, "uuid": "75904d4d-ed96-424c-aeb0-83e425ef0ede", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604864, "uuid": "1d32daed-e32b-4540-85af-c86e34fbba7f", "value": "a383e1dd44485e175e4610768926aa46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8168ab4-d5af-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624623678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623678, "uuid": "09d9bb18-6e3b-47e2-80d6-f211e5e46433", "comment": "Malware payload (NanoCore)", "value": "84220856166a1cb4b7d4716907f7cf2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623678, "uuid": "f1d6e5dc-6ec2-4bf2-b965-905afd21fb64", "comment": "Malware payload (NanoCore)", "value": "a24208df654ff01f46fc3369e7927af815dcfee871e9a2e46b03cb493561953e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623678, "uuid": "5ac6dc77-eeb1-40ba-95c2-40b187779216", "comment": "Malware payload (NanoCore)", "value": "ab9ae59efe67be7dbae53f811432162f29fc20e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623678, "uuid": "082d9580-7076-40d8-bd2d-d15b4174a35c", "comment": "Malware payload (NanoCore)", "value": "3381ec9e5afeef7aba2e48df2220f3b28dc7bdb46f7af6268a1b183582eaddf6294c3af58c823116932494e0dcb85efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623678, "uuid": "d06d39ea-3374-4f99-a5be-a01f5d784aa4", "value": "E34413112DC258BBE69716B049F6EB76FFBEDE005273461783940D7E1D202476F2E2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623678, "uuid": "51f03c75-1125-4e16-ac5a-06afb8befacf", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623678, "uuid": "d5b83940-13ea-459b-981f-08f92afcc913", "value": "6144:sTqjF9cyv0+3+KGlQXX+L+bxXiUp+uIH/3WJVE4f6R8phk/:ssD02+KGU+6bxi0c3WJVwR8pW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624623678, "uuid": "87285d0a-4dec-4994-89e1-a01db264f6c6", "value": 274770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624623678, "uuid": "31740191-d897-4b7c-8910-42afb668dfe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623678, "uuid": "48e71be1-5d4d-49c5-96a8-bb2c108ffbb4", "value": "13934,00-USD-SWIFT MESAJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07af379-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624601681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601681, "uuid": "efa08c07-55fa-4dc8-b141-8563025838ee", "comment": "Malware payload (Formbook)", "value": "1359ae1847f22700703a538be1e7ba4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601681, "uuid": "b90c5a38-5782-4aaf-aa1d-bc58fffb09d7", "comment": "Malware payload (Formbook)", "value": "a29d5d9dae6f9937c1f0dcf733031f3478d74f326c1913727eb9e65e53c82ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601681, "uuid": "b3da3740-74d4-4cc5-8f6e-45c99f766d53", "comment": "Malware payload (Formbook)", "value": "820ee9b16690bbb893f036b61a436ff126c4f841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601681, "uuid": "fe04c922-cddf-4804-ae71-884c8b6f6d7e", "comment": "Malware payload (Formbook)", "value": "8e7a475c8acf6be1bddf2b447cb7d2adabdfa5a9e3f9d61e4b3a8938de83264cd011f371907a8b15b21cbd215628ef4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601681, "uuid": "8b2ff5e0-5c68-40c7-b139-eb85b32e6eab", "value": "0C45F11429D5901AE176BF7859E0E6F98B6F7FA27B13C40D28E13E473633B429E80179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601681, "uuid": "526154c4-8723-4ee8-ab2a-4cb5d9ebfc23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601681, "uuid": "aedf27d9-94e9-47ea-851f-610b2a0848bd", "value": "24576:n6j8+bAaMd3REebAaMd3gm2DiSlJMA9kzFT56ciQh6tIkAT1S:6VAaMVRE2AaMV52/DRghUIkAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601681, "uuid": "d064949d-4218-4e59-92d8-5a4edf69fc18", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601681, "uuid": "12876be5-4bb3-45d2-93ed-27a27b37949b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601681, "uuid": "5e1bc9f0-0c5c-468f-b2aa-4fe716216574", "value": "Minutes of Meeting 22062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0397c3b-d588-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624606861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606861, "uuid": "67086380-83e3-451f-bcd7-f44c44a30070", "comment": "Malware payload (Formbook)", "value": "765b1bb3690c9bacdfa38e18d788efbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606861, "uuid": "2cf1d3e8-c15b-4313-a335-71b185275eb5", "comment": "Malware payload (Formbook)", "value": "a3703cc485d2a99cfec122203ed2d7dd83274af8bd0b3bcfab3fd590dd5c308c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606861, "uuid": "0a4498a0-c008-46d1-a88a-7f000f615487", "comment": "Malware payload (Formbook)", "value": "391f2f157ddec18660fa5aa397618c4b44cbca0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606861, "uuid": "7a133f36-40e4-45e3-b5c9-9a9901ac8583", "comment": "Malware payload (Formbook)", "value": "a46d5bf873df5db8da98496adcd306022bde70d138e688253765a3d1ac7ba1ccc42c00ec84201f3958c490391030034f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606861, "uuid": "777ae116-93b8-44d3-b767-3864afc578f3", "value": "3A34121AB6D6E8FFDAAB90301D7AE33CF972D151431A590387805F37397260E862CA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606861, "uuid": "63d0fcf3-c440-433b-ba91-ceb8b6f73030", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606861, "uuid": "f76fa76e-00c3-47f9-8e44-ac5f5d84d29c", "value": "6144:MTqjFAdWMbSChmll5dKk3jQXzk0KX03SfFnEx:MZdWuS3FBjQXzkVX0OEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606861, "uuid": "9f0953fe-7b23-4f6b-88cb-e41da2f40224", "value": 251853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606861, "uuid": "59208c73-39af-41f3-99f9-d7c82f4d0c8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606861, "uuid": "e9e15768-7574-4727-8a6a-40adc9b87dcd", "value": "doc75843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b632a350-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601717, "uuid": "e3809dfd-295e-4602-bbe0-89837e0ce683", "comment": "Malware payload (AgentTesla)", "value": "9364fc35b039d12530af6537f699767b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601717, "uuid": "96067dca-ff6a-466c-a0ea-350adace710d", "comment": "Malware payload (AgentTesla)", "value": "a3d6f15b63a6b27f9457d61e12e6943ee1d4be5f91d04225a2794692a5b7576e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601717, "uuid": "3513aab2-5b84-49c0-88b4-8ab211b24921", "comment": "Malware payload (AgentTesla)", "value": "74c8c22662d20f9dc934a852ee6352456d45220b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601717, "uuid": "a6b3ede2-7eeb-4136-a328-df400960fcc2", "comment": "Malware payload (AgentTesla)", "value": "28cce98a725ea5cb5812cfb969f92923cd2eb994a2a18af9563b061f7c59c2e621378d55d47716c7901896b5805d1a7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601717, "uuid": "8939ee11-5e63-4389-b611-bf5b171791e4", "value": "B145BFD06E9AB41DE03BBB75359060FDC7AB7E23168DE7DA16C3FEC6432350089906A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601717, "uuid": "ab285cf3-2e51-4cb1-8ee1-1b71294c592b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601717, "uuid": "534ef14e-bf74-4820-8763-d37b4e4bc66e", "value": "24576:XkOjc+bAaMd3REebAaMd3PGuJ6DkK2V8lZJdFVzJHcFz7CfLce:VtAaMVRE2AaMVPoDe8lZxDYOLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601717, "uuid": "0578258b-0e15-45ad-ab41-87d097a61e7f", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601717, "uuid": "15104016-2852-41a6-8c85-93e36dcd033c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601717, "uuid": "c39ffc3c-9b60-47db-96a6-64388f880e55", "value": "HL-883525800 DOCAU BC ORIGINAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cf7b8c-d575-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624598498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624598498, "uuid": "de3897b2-e1a7-4609-9d7f-ef27431bb17f", "comment": "Malware payload (AgentTesla)", "value": "c2b358467f83f13a6334c27219eb0553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624598498, "uuid": "99e0ad14-9f1e-462e-9bdd-f49b1a5954d8", "comment": "Malware payload (AgentTesla)", "value": "a502c3b7706afa7fb97f8b5d8af2eb2a0737ccf00033ac682bc26f23eb5953f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624598498, "uuid": "85670e91-8076-4c54-8a18-9b03d6ce3603", "comment": "Malware payload (AgentTesla)", "value": "7990c58c682def8deada6922c8e14dcf81d8466b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624598498, "uuid": "a2ecebeb-a566-4235-854f-f1c04f81dfd8", "comment": "Malware payload (AgentTesla)", "value": "17064cd98f5bc4f996e6e556e306b273bf03f189f1a5a7e32a3774a6b68b74d7b7cb69039e54552da0505aa427c94f6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624598498, "uuid": "1e547ba0-c073-45c4-9bdb-4d45d981b421", "value": "ACA44C2E16F5BF7DFA4A92B710C64D101EA1ED61BDCAF80AB7BE1D915F10418FE02942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624598498, "uuid": "ab0d9adc-0c61-404e-a851-96ff60b86c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624598498, "uuid": "b14cd7dd-3aa7-42dc-9fe8-8055e8bc10d6", "value": "6144:trL5Jgl2NbPikkM+ufRGErSXtHKpxDhEgidXyLmEDJeCLDgyb2eLH8py:t/a2bkgGQ/l1XSM7zb2eL+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624598498, "uuid": "3be61fdf-94c0-4bd7-a71d-916a5fb00987", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624598498, "uuid": "1370738e-67b5-4ea0-a935-f058318a541a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624598498, "uuid": "9d85acdd-9282-481b-964b-73a1b82df13d", "value": "c2b358467f83f13a6334c27219eb0553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51b7d8b-d5fd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624657147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657147, "uuid": "16e4da55-a5ae-4e9d-b807-bfece426b0f2", "comment": "Malware payload", "value": "57e89c28665801cb8448937e05dd89d5", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657147, "uuid": "0d5d45a5-ac4e-4420-85ea-cc5fbfee691f", "comment": "Malware payload", "value": "a80576f241544e6fbd0a229b4d969f9934a77e8dc26f53b1243e7f639f28bcc6", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657147, "uuid": "a2857fb7-4e55-4f85-a622-e5306e5d95e3", "comment": "Malware payload", "value": "5a75811a2db79ad2108188a7d1c3377493383f9e", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657147, "uuid": "cb76b37c-7e63-430a-8bd4-86e816ba8954", "comment": "Malware payload", "value": "e3268e533c80598b8a216d8104d1ee6eba145090bf4960ca7c08bc98c4691a5b9bee2b46ae0428d371013ac0fce1c12f", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657147, "uuid": "214aaf28-9b95-4c71-bd57-70e779e897fe", "value": "D193022B8F48C6ACE409B2D395263C381C6FB36186D4F4D2386E4F46E750D566FC4AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657147, "uuid": "0fafa206-52d7-43a0-acb5-19e175e2f31d", "value": "1536:uoxBv40gNeg13esr8sa9TKZEG8hSpYJLixGaX0Rr+qVcNBHLB/vKdtEsfG:uWGAEOsgsa94OSp6RqqVcNBrUPEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624657147, "uuid": "9af53ad1-35cb-4a56-b411-ccd1233fb504", "value": 89952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624657147, "uuid": "9bf445b9-2a5a-4d13-8954-137a8a51f910", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657147, "uuid": "6ab024e3-be55-46c2-a072-7d77ced1abea", "value": "Invoice-1002.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b874c157-d5b8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624627491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627491, "uuid": "84703570-cba9-4177-972e-4881fdded396", "comment": "Malware payload (AgentTesla)", "value": "853d8e273a07da962fea6886c3c0fc44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627491, "uuid": "84b3ab15-89b4-493d-b9f8-7f474fedce15", "comment": "Malware payload (AgentTesla)", "value": "a883bd2ac2e17a1077eb8407ea425d4b8c6f669c2e53a6fdc997aedb24418904", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627491, "uuid": "dadaea24-6a52-4f48-bae7-c2567ae4328b", "comment": "Malware payload (AgentTesla)", "value": "4e0d4ac4984ab9e0134a1579c175d5bffff4a1ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627491, "uuid": "3f4881ab-3d0f-43ea-8f8c-358dad49fc7a", "comment": "Malware payload (AgentTesla)", "value": "91e25d65926c30023bf8e57fc1668e899f76293eb066205e09affb88cf1a83ef28413fe9ae15dade5da7055a3dfbcc10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627491, "uuid": "5cfb54eb-6b56-4ea2-b826-ebcd9e92f91a", "value": "FC75A5983611B5DFE417CE72AA645C70EA107CBA570FD203A09726EEA90E697CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627491, "uuid": "6151cd74-ee2c-43e5-8c1f-7d38457564e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627491, "uuid": "68d524f6-07b4-4ec4-b06d-392c9f9fce6a", "value": "12288:oSDPqXYgKBHQ3JzCBio/NDs4WbHh6poG2lP6BroBjzJ6hxZ78FgVqXcBGdfEqu4x:F4gBHiWfNA9h6poVxBEh3agV2cyhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624627491, "uuid": "9f042f97-326e-4487-a5ff-610797568221", "value": 1554432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624627491, "uuid": "1be91af4-27e7-46d9-afbf-d31febc5c434", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627491, "uuid": "987baf23-cbd9-4acb-a504-65b16a143aef", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055aaca8-d580-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624603138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603138, "uuid": "f05efd33-2852-4437-b900-e4c507a48201", "comment": "Malware payload", "value": "f0630d63569e268a3b64e5f58fee6168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603138, "uuid": "e5c563d3-690f-434b-b90c-9dc5428a69ac", "comment": "Malware payload", "value": "a8a8f480674f1332d382819416bbc934a28d098e52f3b3fc9cb9a29ea9bc3e7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603138, "uuid": "5ccc1153-5712-4f01-ba49-1b78f1cc4dd6", "comment": "Malware payload", "value": "bd1bc72b9dea9e780b203da1ff0b539289059401", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603138, "uuid": "c79c3282-9e18-44b1-81d0-e63d0d1af6c6", "comment": "Malware payload", "value": "6a1bdd6aa43d38782bdbd6150dada7d1ced7ef407423b173f5b2c4a53f06f884cbeddb28186c1565deccfe3bb67f3066", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603138, "uuid": "03c81e57-28e9-48d9-b20e-6a81b5fe12e2", "value": "0D748C00AAA1C035F6F312F88976A368993E7DB15F7040CB52E5EAEE56346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603138, "uuid": "2185f9fd-fa67-4426-b772-c741205d2d64", "value": "a8fd13cfcead7aa4bc2d91debc97c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603138, "uuid": "58bc23b4-066c-440b-9125-996791b1dc10", "value": "6144:+gASFUAG+ULJHUUThiuG0Lb0vPjtOP+vrPoc9QjSqKZ3/PEk:USFUAG+ULJHUUtPLb05OPMwc9b5P8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603138, "uuid": "89e4ee1a-1885-47ed-9b72-38cc6b863a09", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603138, "uuid": "835b83c7-ca7c-4bd8-8bb6-f0d017db4c78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603138, "uuid": "9e8731cf-d067-4273-8226-9e0921e309eb", "value": "f0630d63569e268a3b64e5f58fee6168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0650b5c-d57a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624600956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600956, "uuid": "b2b7eefe-c4bd-4f41-9971-69791c614e3a", "comment": "Malware payload (AgentTesla)", "value": "fad5844e0344228a51fee7bc4bf2c1b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600956, "uuid": "679a00dd-4087-4a50-b453-d3be9ce21516", "comment": "Malware payload (AgentTesla)", "value": "a8c0a3bc262d4d8c2ad8515a809dc4939e35e1546a814ecb449422e9e4c00a41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600956, "uuid": "60c18397-53d1-47da-b903-615ee8ecfd6d", "comment": "Malware payload (AgentTesla)", "value": "278be17e15f05723302b53b717f120b8477af846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600956, "uuid": "97c3a428-2bbe-456a-ae17-3ba0d92e7baa", "comment": "Malware payload (AgentTesla)", "value": "2f5c89dc24980f6e10b7faf5dc7ee8fdeb3bce400e2c8d53237640cbd4ceec3fbb011557788308a1a5e67f95bd82fcfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600956, "uuid": "b330cd13-62c3-4d4c-b7d3-e7314b8d782a", "value": "30F4132136DF521BD6B61B7801B681C012B7FC3B7B14EA6D5D4623DD9E6B3A28700A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600956, "uuid": "78b19c3a-fc83-4189-8676-36359ace9e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600956, "uuid": "1e34c4f4-1dbd-4e1e-b10d-a8e85e2a7e60", "value": "12288:s7grMTjmG1ifHEP9RrnNTby2CN2N2OMfTxnXOiMMZsEHEB72+B021:rSP1ifHEPzCcMfTxXO9MnHS7K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600956, "uuid": "97e82e27-2559-4c25-a17c-62511e7d5f77", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600956, "uuid": "294d7bc5-355b-4019-9d96-c0e6ab8e66f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600956, "uuid": "c7bbcb00-d358-4210-934a-7ffe703eb488", "value": "BAPATOH OFFSHORE SDN BHD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ee544c-d59f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624616507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616507, "uuid": "c2eaf071-b507-4e80-b967-490d770ad187", "comment": "Malware payload (NanoCore)", "value": "b3585c314b7bf553a22130cc1606bbec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616507, "uuid": "f839ad5b-e5a4-4900-be79-df2b14e8164a", "comment": "Malware payload (NanoCore)", "value": "a8c1e4e4823c9eb956946df867f03307cb36d1a24e025c9e782ba6b4748a37e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616507, "uuid": "8ee81864-db6f-4d45-9a2b-0eb39e0e824c", "comment": "Malware payload (NanoCore)", "value": "1923e911161a28085245fe18d82085f358008d65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624616507, "uuid": "e7504eaf-1d33-4579-88e5-f358de92dcb6", "comment": "Malware payload (NanoCore)", "value": "6476d1a27b25c14d2dfd7f29763f9eb327dd41bce4095ed02080508bd1c2d684724836bc1311c76d45637ad8cbe3d604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616507, "uuid": "c1658bcb-ec8c-45a5-92b9-d6a01c6d45e1", "value": "CE15AD6AEA182B1AF178E1BCC4349F100DE0BD58D01195D77EC77DAFF3A2642DE0A15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616507, "uuid": "20262e47-dfe0-4262-9691-97436aa17125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616507, "uuid": "ce2ece95-bfbc-4f1c-b4a7-e9055c422050", "value": "12288:y3pddD/k2d9fE8l/sOt9va7J/1GcGAxK6vUdI0+rKKK5KctbSfcb7+ldBUff:4/k828lnMRmGsH+rKKK4KuVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624616507, "uuid": "17c0f098-89af-4089-972a-6acedaf0b4ea", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624616507, "uuid": "9f2aabe9-f17c-45b3-9f39-c077a3638624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624616507, "uuid": "c205a5e2-c3c1-4c09-8ba9-91f82c9c1df1", "value": "b3585c314b7bf553a22130cc1606bbec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaad4b0-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624652029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652029, "uuid": "751f50b6-38f3-4cec-b7ce-584048f8d446", "comment": "Malware payload (Mirai)", "value": "4420aba79de6dfb519c8c9f6cc6c3bd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652029, "uuid": "19fd5bf3-8a2d-46fe-bd3f-ddcadf4f01be", "comment": "Malware payload (Mirai)", "value": "ab46be1362d9235bad9f361d96478cc3b810a5bc0b4b26af93409ec8dc6b14a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652029, "uuid": "afd28407-8035-4490-84c5-49ebf58d5ab5", "comment": "Malware payload (Mirai)", "value": "1fa1d25316eb771fc7f25f9d83ac643cf9fb0c96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652029, "uuid": "b1520206-6db2-42d8-871c-4df66d7658a1", "comment": "Malware payload (Mirai)", "value": "efab91dc4f7283ae72903c3662f2a4709294601706806ad64cf93ce18cd3bee4cfc771bbf374754a52e7c8c24f8f70f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652029, "uuid": "a0d1e1ae-388c-4d87-9729-167461597f0a", "value": "D9332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652029, "uuid": "402eac83-3b95-41e6-88e1-05d6d732063a", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638g5:mL/4f8F1ef0YgFvimzpZi2UJJnHY8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624652029, "uuid": "399e1f8d-bc84-4061-87cf-5251a6e7d363", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624652029, "uuid": "4c88018d-e1d0-4251-adac-e9e9793954a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652029, "uuid": "132878b4-875c-4b29-b4ab-fbd96bafd910", "value": "4420aba79de6dfb519c8c9f6cc6c3bd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce3b6bf-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642557, "uuid": "5eddc462-a58f-4f2f-9c1f-1536d15f68e5", "comment": "Malware payload (Mirai)", "value": "bf6693c82f128ab09e9d4f124024bb3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642557, "uuid": "5e4e5a67-9255-403a-902d-6bb3d9633d47", "comment": "Malware payload (Mirai)", "value": "ab7c5eeadfc844a27fb504a5771a35440bfd3a93eac34fbcc39f8009aca32063", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642557, "uuid": "8d91261c-ba43-4a0f-b402-cee66c043900", "comment": "Malware payload (Mirai)", "value": "70bd58c7c369b6758358062e50703034e799f565", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642557, "uuid": "98790958-f288-494c-b675-a6cfdc82f88b", "comment": "Malware payload (Mirai)", "value": "3e1658ac23c68898aed084eb5bca4ba891c8ee4903e5211a032c279b71768d77b4790552e58ec6c7a7b6c8b94d07d40a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642557, "uuid": "9c71eab3-127a-41ac-9a90-0e6f101226a2", "value": "65A2D01826CDE922D170903BE13DC35BAEDB43B652FE313A1E08079CE05590AE7BE985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642557, "uuid": "6aead2b5-1986-4994-9983-14d66f6a38b3", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbuRhymdGUop5hXB:YDgoh/DxCvhdR4IjWVFbSQs3UozJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642557, "uuid": "3909a576-4a9b-4bd1-82df-fd9fe7bf8a02", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642557, "uuid": "d7a4e14f-e917-423d-882e-0c039c3cb890", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642557, "uuid": "4785feec-c3ad-4dd8-bc3f-d62d563edab1", "value": "bf6693c82f128ab09e9d4f124024bb3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729d8993-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (ModiLoader)", "timestamp": 1624602033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602033, "uuid": "00869c28-02cc-4396-9eb4-6003281c54a6", "comment": "Malware payload (ModiLoader)", "value": "c5144375e46344d6abb9784c2f477504", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602033, "uuid": "fe8837a1-2d2c-4301-884c-8c7a8d97e193", "comment": "Malware payload (ModiLoader)", "value": "ac0c607a38214d7bf1cdfe073a5656d3565d4af43f4591702b398df6c36fd834", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602033, "uuid": "50eefa83-8230-4e02-a5c0-da347453f332", "comment": "Malware payload (ModiLoader)", "value": "03475997b566f167826e2394ad0b0e5d8ef82999", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602033, "uuid": "43e25e96-5666-48b4-b284-5a9e46c62dee", "comment": "Malware payload (ModiLoader)", "value": "ad981fdca194883bb7f553950e7246a64b62b50b413c9a891b6ef9b6bda6f89597b8cff7de45761a6ebc24b9fbb43aa6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602033, "uuid": "0e8d42d2-654e-4925-92f0-af775f465ab1", "value": "37057CE1B75004F1E517763ADC1AB6E5B43C7EE0291498C2AAE87E0F3F35782745A06B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602033, "uuid": "36b8d824-ec53-4ffb-9721-5b47b0af0638", "value": "da178bf3a0222ee4f058fcebd7c1ef62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602033, "uuid": "bef467f8-58d4-45c0-b3dc-c9ea31b212a7", "value": "12288:IIDlXMiKYI/rv5zsThfj3lDx4TSVnb7x3cKf/jhgnfPnbetkkkSd:IGtKYI/9wTBVSTSpb7x3c4/jld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602033, "uuid": "778ff167-19e7-42e8-a150-e4c45ff8dd7f", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602033, "uuid": "b8b9858a-44c3-42f5-8a2a-0311c9580e81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602033, "uuid": "59d487f4-bd21-4fa5-8ecc-3a92f38df367", "value": "EIVEDHTY.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f153f307-d577-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1624599669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599669, "uuid": "38785f25-e647-437e-9bb5-fdaa651d7682", "comment": "Malware payload (IcedID)", "value": "30b55a9c8d6b4dd0daa146b97f2eca30", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599669, "uuid": "64f9b116-2bc8-4231-b4aa-616e4634b18e", "comment": "Malware payload (IcedID)", "value": "aca9259ef8a1da7a559be169d2f6a106a86834ba54dc187ee43bb13c4317aaf1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599669, "uuid": "edabf36e-6185-48ea-82ed-5107997c29d7", "comment": "Malware payload (IcedID)", "value": "4a06154a2e04f0c6ccf5d22da753a74038d030e3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599669, "uuid": "ad9bb41c-cdad-478c-a002-b21591e09408", "comment": "Malware payload (IcedID)", "value": "0a63e9fafec0dbf934e2190bc7a568928bc0267ec1ead7e1573c15bae7d7a398ccf56e5711a013f2a0499899409efacc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599669, "uuid": "478ff82c-e2d0-49fd-9a31-7f08e9fef3ca", "value": "B054DF8B9A08AB92F56482B5FD171E694F052A0DF1C276BE346F0DE72B247350C8E47D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599669, "uuid": "405141e5-e57f-4e2a-b06a-7cabc2625e54", "value": "6144:8srUN3eI1cuk8BKZnXKYjq3gI25zP+G2chblBbQROsAEhttItp4:trUN3zVziXKJQIezPfThblBsROyLtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624599669, "uuid": "b68450b6-52de-4a59-9be3-4fffbe2734f1", "value": 295047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624599669, "uuid": "b779fbfd-f99e-4c3b-9623-2fe2d9308572", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599669, "uuid": "667b9004-b7e8-41c6-9e94-d3e1bb49a838", "value": "718421.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1901b6-d5d4-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624639283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624639283, "uuid": "5fc93bac-079b-4024-b438-580485102e8f", "comment": "Malware payload (Quakbot)", "value": "2cd2fd004b5589a595239f202ac648ae", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624639283, "uuid": "5919d15c-ee02-46ab-bc11-5e8bca63c4e1", "comment": "Malware payload (Quakbot)", "value": "ad3071800cd6852215e7ffcc6c65e7104e3d6e10bccfffc8249d73be0512d6dd", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624639283, "uuid": "4b707edf-764c-4de9-9ef2-6eb68481b87a", "comment": "Malware payload (Quakbot)", "value": "ac02da8a953fd89f325c64bf5df93e415350ec12", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624639283, "uuid": "a4dfb7b9-c2ac-4a67-ac26-796887fc2973", "comment": "Malware payload (Quakbot)", "value": "3d23129bf8c06089173dfb176f41c141fc87739f858751ac8b150a5ce135308b2e1c5b66fe94c007abade10a6325f170", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624639283, "uuid": "6a21a562-ab33-4c7c-b1a1-0b1b3eed23d9", "value": "84E38D352A24F2A3D57282381DE84E7CF53A2B06B16FBB65B8CF95BD5762E43044B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624639283, "uuid": "8f80a460-add9-4e5c-bc08-23c6c2b6e7fe", "value": "3072:QmKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOYJ:P4P4346PgZw9gQaVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624639283, "uuid": "957848e0-6dea-4662-9a37-47f891090e61", "value": 153750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624639283, "uuid": "38a3cdbc-a3c3-4c38-a3d5-07462fe22324", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624639283, "uuid": "5a2bc232-b0c6-46b5-981a-df4ba4d6d13e", "value": "Permission-40776837-06252021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca40c9d-d551-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624583206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583206, "uuid": "794f5294-9da1-4fcb-908c-c31e3c85c7ee", "comment": "Malware payload", "value": "843840748ac648d2c09b8cf1ab9669fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583206, "uuid": "6f5e79b1-3ffe-4c1a-b4c7-22b5fd148f70", "comment": "Malware payload", "value": "ae3342fb97dba876323c6ae13ae2dd46ed8c2ad3e4153baa14a5b9cfd5729c69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583206, "uuid": "cab52733-0292-46aa-bc03-38090059a262", "comment": "Malware payload", "value": "aa4d1e501576fb738f71c4a36d2023170f55c83e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624583206, "uuid": "8e9a2b25-111b-4556-bd3d-85862f0be8b9", "comment": "Malware payload", "value": "054995f739873abe06253ce7fb162ab7dac738fb982a6e1c20690a82acb3b63d5778849842c625638f0ff03966044eae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583206, "uuid": "2d13fd33-aad3-4c9b-86e7-72c6889a0e68", "value": "CF251279A181897AC12209359C4BC279F53A7F006F6968DFF7ED0D1CDD232952E3239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583206, "uuid": "d2eb7aa2-ba1f-43eb-ad59-9c18ae8ba516", "value": "b8494300a1f7342d4c600a7b12e15925", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583206, "uuid": "18fde7bc-c6d3-4033-82c0-a365d3446aef", "value": "24576:TX48QE+Ux7dySwUXTj3WAEQwmlD+SpP9O718d3OW:TXz+mYQDj3WAEQwmlD+mPYxUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624583206, "uuid": "596f8885-32aa-42be-8e80-617c5ffb0356", "value": 978014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624583206, "uuid": "ef8106ca-11fe-4733-bade-381d0f00bf71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624583206, "uuid": "3b414668-0664-48ef-b462-943f025fe497", "value": "843840748ac648d2c09b8cf1ab9669fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e925da-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651167, "uuid": "24e2e1a8-3b7e-4303-9266-00cd735cc50e", "comment": "Malware payload (Mirai)", "value": "907d6d182d6f90a467046ed2e85c8bde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651167, "uuid": "a9355166-4f14-406c-bdc8-024cc2757a41", "comment": "Malware payload (Mirai)", "value": "af44b2222c030e5d5c0c59166f38fec15f894374d99ae19adcc40fff9774ee2a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651167, "uuid": "ba650b43-c997-415b-b640-1ce5f38450f4", "comment": "Malware payload (Mirai)", "value": "c1f43fa0c142b5c3b2627b02c3f84b5b4ea5f57f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651167, "uuid": "015cabb5-633a-4e03-bcbc-7a7f0f9cfac8", "comment": "Malware payload (Mirai)", "value": "2dc5d3b6f0bf62bdefa15ea9f5c303c7e6287306baa092c1ff4aca288b88c76dee1b0694f234a2fecb720e80904684bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651167, "uuid": "3773ed00-c0c1-4df5-93e8-5793b7efe24e", "value": "6F531855BCE28A12C6D462B6FA2E418D332663E8D1DF3207DD216F1137CA82F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651167, "uuid": "eb02b5c0-ce7d-4b18-a487-b4f984eb42fb", "value": "1536:hQXM23x+JdY6j0pTqBSjdmVrL2yBCtt5KwaxlR:h6f+Jdy3QlvYbKwaxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651167, "uuid": "831d6b8b-3b57-4c12-b5d9-de8685bb8548", "value": 60792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651167, "uuid": "4634918c-dd5f-4eca-8640-5d2669c33410", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651167, "uuid": "ac42a72f-5cf9-411e-b699-55e2b246c6aa", "value": "907d6d182d6f90a467046ed2e85c8bde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae192002-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601703, "uuid": "b0f159d1-f679-47a1-b827-dc502ccd0ad1", "comment": "Malware payload (AgentTesla)", "value": "d3171b922515814f62041fa42c58547f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601703, "uuid": "7107e744-8ea1-4ba6-af3e-91919b00b598", "comment": "Malware payload (AgentTesla)", "value": "b091935387e34aeb39e80d1172bd83417a3e11bb78a3d1ff2fed2151386b1cdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601703, "uuid": "15d99e09-bd17-489e-8cd3-7fc02252f420", "comment": "Malware payload (AgentTesla)", "value": "0b5b11db1663cf8e7844a83db0a66c17687b7779", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601703, "uuid": "d6341244-7e08-4e28-b003-dabdd51249ff", "comment": "Malware payload (AgentTesla)", "value": "67683f5a118b24165640fda310f07925be36d8c18f4f0915727eed0813fd8d2577b229d5eaeef8f4ac0b4778c4c22b39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601703, "uuid": "fe9bc1aa-2222-4579-b11e-235760a2edc5", "value": "8305D0343AEAA815F277AF7ACED86049CBFEF6533703D919689113864602F41DD818BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601703, "uuid": "e1bf116d-3daa-4bde-a7a9-b9a6a7c7e94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601703, "uuid": "af9cdd8f-b003-4d01-96ac-fdc0e6aa6ce4", "value": "12288:Ruy0IYT8n4FwM2g0jWHzGWSE5D1kIpNct5L7BNYH+uh6xOdzFIQ+8apQWj5MIZ+O:N0JeMGhEp1A5fDYeuIYrzC+IuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601703, "uuid": "69fe2405-f8e4-4dd8-814c-326c6b05023c", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601703, "uuid": "89dc17e8-9899-44b1-affe-b907ed5453b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601703, "uuid": "f9eea769-efb4-438c-a646-008351ff25cd", "value": "Burgan Bank Hesap Ozeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c098741c-d5c4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624632658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632658, "uuid": "c476b1dc-dfa2-46ff-8834-2af7cab78ec5", "comment": "Malware payload", "value": "b12ee1cc1fdeb60b6a1f4bbc4d9257a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632658, "uuid": "c0a86bfc-49d0-40b4-88b0-bd1fcec8b26b", "comment": "Malware payload", "value": "b265a8521d998eb753496fd27f557874eff7c55c78c403366f536e270eb007c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632658, "uuid": "4aaadeac-caaf-4acd-85d1-7647eb329433", "comment": "Malware payload", "value": "9a8cff7f0165c53a498cc6b5d9e02d51cc9aa385", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632658, "uuid": "88e51f54-1dd9-4819-9113-943b20b4983d", "comment": "Malware payload", "value": "18dbd4d06a31feb1567f08490151f54be80837e94700cef649aa2da00602010ebc172eb2d31955f2bd73bdff8d4849fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632658, "uuid": "d2755688-3b5f-48de-a702-3111b36deefd", "value": "6B030234030121E8D569B77E789347F0AA240F6737439A93E5C5B1FA9DA36297A23FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632658, "uuid": "b60552de-a015-4ac0-a667-ad116660ffc7", "value": "768:ZkRdVMqfF6yk6e83nlcZXAiKFLZBphBf5+sqy2uaNXrJgGlzDpxYs/:276qfF6oe8OwjLzphBf5+sgxVrYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632658, "uuid": "553dc3a6-b528-45f8-b1ad-dacdd5dcf04f", "value": 39308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632658, "uuid": "50dbf432-727a-4cc0-b033-4f5fd9f32c4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632658, "uuid": "38259d82-31ae-49e1-929d-d2f6bdd6f568", "value": "b12ee1cc1fdeb60b6a1f4bbc4d9257a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe1d4ef-d596-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624612927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612927, "uuid": "7ccde274-ff05-45b1-b565-d33efdef0e0c", "comment": "Malware payload", "value": "71dcb617ee49141e7baec40a4f3f52d9", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612927, "uuid": "135c0831-92b3-4ae2-b6a0-331d005c2454", "comment": "Malware payload", "value": "b2ed59169f13ce72fd84dd49f35a9212a824dd9a094fcdbc7db2bdaec9ecd555", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612927, "uuid": "eea76a99-b9b7-4045-947d-8e62c69f7ff0", "comment": "Malware payload", "value": "ebff9f2e75b9ec12af11170b7bfd322852672f83", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624612927, "uuid": "dc58c4d7-1202-470c-8087-fbd1476475af", "comment": "Malware payload", "value": "aa5bc40aeb617cf4348e59a3641e6d09b4de7f2b258408b0a0e18b872db6b4ba2d76620b122cefd0e7cff70589b36d96", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612927, "uuid": "e9b2edf1-5af4-48f7-9a52-2d354b11beae", "value": "3E45125BEDE4BA69F88336723103F164982F8C4B794059DD815333FB30B69ABD5860AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612927, "uuid": "02f78b00-f7c6-489c-927d-ce2890e29a15", "value": "24576:CJctPt0eHqcw6rMkzxlT6xRwzeJcCDTNc6CK8Mdruq:CmtV0eHqsrMkzxlmxGCZD5hCbM4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624612927, "uuid": "840c3291-844b-46b6-9f51-a05400c89eeb", "value": 1183080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624612927, "uuid": "393d62c2-a7be-41de-9e83-b59dd565fb50", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624612927, "uuid": "57db1638-cd15-4cae-8d63-51a4e9c14d5f", "value": "RMS MARINE & OFFSHORE Spare Part List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a960257-d5f0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624651439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651439, "uuid": "430f3a20-17f2-4e16-bebe-96f3aa37ce28", "comment": "Malware payload", "value": "0bf3011a4d9c876bc306f869c30f8d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651439, "uuid": "135a9001-c20f-45d1-9e05-471045632db1", "comment": "Malware payload", "value": "b31c01bcbef95d88bd6fc5dd89cee4360decd2176bb18960f149cdd04254e005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651439, "uuid": "04bc7bb8-a5ac-470d-b231-1c32edc61cc1", "comment": "Malware payload", "value": "1eea66201f2f06f9a5a648eff83a550885dcdaa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651439, "uuid": "16b9be8c-52d6-4d0a-8b4f-ccf5bdadd06a", "comment": "Malware payload", "value": "e003e6ef213209fffeb4c33bc948a763b17f46ab4182319eca68fc0fba945ab4e3e4576a2f8097a3c644d847c649be2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651439, "uuid": "95a9d802-4c44-47f1-a0c6-e70b3d4d2d71", "value": "9AA44C54B541FDF9DCCA8B7804E3131693F9F0818729EB2F6910FE38091AD84E976A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651439, "uuid": "30594f8d-6df8-4863-9de2-3ae2db2c3bd7", "value": "c1af9ddeef1d5a5f39bff9aeabbda9e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651439, "uuid": "67f77f92-d938-42e6-ad4e-c0df4b47a258", "value": "12288:NJrHadEXY+Q97637Xz0NCTflVFTvXwaobN:NJrHadiY+Q97g/0NCTflDvWbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651439, "uuid": "b1b039ab-bfbe-48bb-9595-637823285e54", "value": 458822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651439, "uuid": "bb98ca76-98b6-4471-a311-297a93384d81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651439, "uuid": "cc79138b-0516-4e21-b6a3-be7b38ca9585", "value": "b31c01bcbef95d88bd6fc5dd89cee4360decd2176bb18960f149cdd04254e005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cc0efd-d5d1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624638247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638247, "uuid": "95cbd22f-ba79-45ad-834c-b0eeb98e660d", "comment": "Malware payload", "value": "bff78ca6421651b824c41ff73cd63a4d", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638247, "uuid": "10d376ff-eb92-4dc5-92ad-e8e398264e9a", "comment": "Malware payload", "value": "b4c8a880fae666add98f9a871210d75f7addd4a00a334fb758c791c5ad1d3711", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638247, "uuid": "831c25f1-2587-4d4c-824b-42e360699153", "comment": "Malware payload", "value": "8a439fe82292dfb61092daa32af6f0152400f002", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624638247, "uuid": "24b66b33-28e6-4a16-95c9-65790294ceb3", "comment": "Malware payload", "value": "6cef0aa3454b262be6cb457de37e14c0e108b33959f69bf1fe77662ba4cba97464b1dd6704dff33c904d17c01d61e39f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624638247, "uuid": "352eeeee-ae47-4832-9710-2212926f0d6a", "value": "A4E38D352A24F2A3D57282381DE84E7CF53A2B06B16FBB65B8CF95BD5762E43044B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624638247, "uuid": "dd159771-78f5-4eef-b8eb-d4123c927313", "value": "3072:ymKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOYJ:J4P4346PgZw9gQaVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624638247, "uuid": "83b72d23-fc57-4aeb-97f5-ad11428d640c", "value": 153750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624638247, "uuid": "67db3d64-2aa4-46f1-a9a5-df4d2a44907c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624638247, "uuid": "d9c8d224-540b-4053-87b6-c355356c7212", "value": "Permission-1532161794-06252021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2629fcbe-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624642277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642277, "uuid": "c7d87d06-0d93-4744-994a-9f83950cfd74", "comment": "Malware payload", "value": "2f8962c3a6eaf2ca9bbcab63800fa7eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642277, "uuid": "10c91112-f47e-4e13-8670-63e26ab89b54", "comment": "Malware payload", "value": "b58c6aa8f18079d84a9140de7ca5a4d88b6d392aef20de424924121ff25c218b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642277, "uuid": "24b5c489-5192-46e5-aad9-70fa7019699a", "comment": "Malware payload", "value": "0b6ef6bedd2fb2d98b58896483636d5212cd2305", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642277, "uuid": "71cdfa98-d95b-4d57-ba9b-c59f735d1fef", "comment": "Malware payload", "value": "2ff236fec9b2a902e396bccbb0162b7ba50bf137d2a4846e28e5bc7e869274187858b29110af4ad00c882ae6164c6b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642277, "uuid": "5d3eea8f-3efb-4201-b73f-e31cd785313c", "value": "25B2D140F1455D1AC1EE51710CBF3EA91C29A24A9A8CB1A37FDC6B3765FCA263A1D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642277, "uuid": "deb9e841-cedc-4ce1-b23c-ee3b36d6353d", "value": "768:idCWPSxjThIS/dCUFHY81Dco3IbnbcuyD7Uryqv:4Co0s+Rco3gnouy8mqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642277, "uuid": "f6635c37-1c67-495f-bdd0-51b0a8a705ef", "value": 25312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642277, "uuid": "99938e42-c12d-4762-bf62-f52b69856b1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642277, "uuid": "a1f5fe18-8d91-4a23-9341-19b8f6d6221b", "value": "2f8962c3a6eaf2ca9bbcab63800fa7eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec8d22f-d5dd-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624643151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643151, "uuid": "d5bce5ae-c81b-4241-ae13-ecc85c76c0ec", "comment": "Malware payload (DCRat)", "value": "25b5efae58e4d0423c8ff6cb3be7daec", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643151, "uuid": "b4f6611c-73c6-4870-8292-c22c2e08665a", "comment": "Malware payload (DCRat)", "value": "b6b82f21f381e709565665311591f125d4b810e64008fdf0fc55dd624f3a4cdb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643151, "uuid": "76658196-cdd9-43be-b409-0ceba271649b", "comment": "Malware payload (DCRat)", "value": "e3ce440a548d623f438b17d9ac7bcf4c4725ef22", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624643151, "uuid": "6bab802f-908a-4b3d-b4d2-ecb94e3132d3", "comment": "Malware payload (DCRat)", "value": "c26accd44cf9d1ef5669ba2efd84d210b0cdb052f9b1bbf85393692cd3f6b4d5aa60100966a97493cde0fe7d4d7476c8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643151, "uuid": "b31499ec-3ce5-4e20-9ab7-e747fa54413b", "value": "816533059207BF1BD976E4787A339C405255CA56FB3ACA7C5EE8DE9C0D7028EC9A1BC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643151, "uuid": "5174e2e7-cc3e-4e68-ae32-6e4a81ee5415", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643151, "uuid": "cf98fad8-6ee5-4a30-9a64-e64298b00314", "value": "24576:swXmp9m0tWub+bAjZO1hDhEiQoe23c7Cvd9nK3AslHhrXoGVyFu1pK1Rhg2tNYuJ:jWH3tjb+KE/CoM7Cvd9n3sb3Xo1MEV8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624643151, "uuid": "dc46622b-400e-40c3-b23a-6a9df5c38554", "value": 1526272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624643151, "uuid": "969f8905-e33b-42ba-bbac-9e6d02b99204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624643151, "uuid": "79452df3-fc73-4e9c-b00e-613602e8e915", "value": "25B5EFAE58E4D0423C8FF6CB3BE7DAEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc873fd-d584-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624605001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605001, "uuid": "5eecf086-0af8-4b90-81c9-5602dcf692de", "comment": "Malware payload (AgentTesla)", "value": "66587368e39228edf1f6034794f17579", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605001, "uuid": "9b2be9d8-b24d-4928-b340-51e4fde1c822", "comment": "Malware payload (AgentTesla)", "value": "b6b8326fd527390a435242178b6a45a973c4516d831669ce7527c5d97e90ab10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605001, "uuid": "ba70cd65-d1f9-4696-bad9-4bb304afcbc3", "comment": "Malware payload (AgentTesla)", "value": "31268b1ac9bb83c698eadf5e74f65d58b12d2a50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624605001, "uuid": "fb2afdac-0d75-4b21-b231-e3c9e544c5bb", "comment": "Malware payload (AgentTesla)", "value": "5b055c4d753b9b6c5b77e489aa068fb31313cba565546d4567fadff543395abf0bee1ec19354f73104bb0ea4167be384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605001, "uuid": "c9ac6a3a-b8fa-495a-9367-dae640eab0df", "value": "9794F11532F95729F1BBABF95AE071A14BFA71772612E44D0C8220CF1A63F40CD91AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605001, "uuid": "8356d031-a625-4a25-83bb-66bcbca6d9cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605001, "uuid": "9bb2e0c8-a72d-4d80-b779-866dc86a382a", "value": "12288:C9Qh8CLJVPyw+dMkQcUPTps0sEhb5Zl/m9a:eQ6CLzyweeC0swb5eM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624605001, "uuid": "a160fad0-a49d-4cbf-8b11-8ebc16d60c1b", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624605001, "uuid": "0709e5b2-1596-4e31-8263-2af9ed7fc3c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624605001, "uuid": "481d580a-a11b-4b82-89a0-30315ffd91c6", "value": "66587368e39228edf1f6034794f17579.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c98e675-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642261, "uuid": "b8eef1a5-7ee3-4ef8-bb77-6d7e1d7c0e0a", "comment": "Malware payload (Mirai)", "value": "271e4570cf724a94a61b6dd06ae3f8ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642261, "uuid": "f19743a9-5623-4cf6-b2cb-560ebdbf9cf5", "comment": "Malware payload (Mirai)", "value": "b79f6cb7524f6acea3e842d605cd1e5a464f41decf8c5ac31dc8520eea095569", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642261, "uuid": "fe633614-ff39-4f54-8b2d-4db445e554ef", "comment": "Malware payload (Mirai)", "value": "a147362d4739be45c1faaba66e389b10bb759a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642261, "uuid": "55068495-8ec4-4f00-a9d6-60eadd0652de", "comment": "Malware payload (Mirai)", "value": "930441cd42c7b003f2292d8d70dcfc6fdc3fce2a273a6bf0e05bdf41b311caa2a770acedcbbc16a3fb871cebf2b9482b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642261, "uuid": "2c01810a-b999-4ced-aaa2-79b7c4e12a04", "value": "4AB2E195E6FB27C3C352D332E07C5A4DD2761BC1075A491A210D728EA29760E87FB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642261, "uuid": "eba4057c-3fdb-42ac-b737-a084bd5b7253", "value": "768:R/QOC0Yhn6ROHWF09cwNPFCnNBxcXoyqcG:R/nihneF1wKNBaYy9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642261, "uuid": "004bd181-8a0b-43e2-978d-c77adf587b82", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642261, "uuid": "b3b49a98-a979-4121-a559-3f63e907a6dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642261, "uuid": "c6661136-6970-4748-b7b2-d6a26a4500fd", "value": "271e4570cf724a94a61b6dd06ae3f8ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed17bf01-d565-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624591931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624591931, "uuid": "cf560945-c87c-42d2-9def-3fed65cf0743", "comment": "Malware payload (Smoke Loader)", "value": "bfaf1ced61ea80dc10b8ac87c18f355b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624591931, "uuid": "13b2eab0-4956-4069-a23d-5235da91c435", "comment": "Malware payload (Smoke Loader)", "value": "b8a8a6c3fe21172b98f35850739be0f78e44a30d0adb844e9f9ce7f05ce1751a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624591931, "uuid": "1368058e-5ef8-4b5d-8bed-c2a6d2d6a1f4", "comment": "Malware payload (Smoke Loader)", "value": "20895b5e62f36ef101bcbe5c5f81038570a897f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624591931, "uuid": "fcb32af3-50d3-4dcf-8dad-9c353af67efb", "comment": "Malware payload (Smoke Loader)", "value": "b0538f337f070c902e92291a8aaa893a4d169d736876781dfd611aebd8de72a642a2295330a42a15f0d5e88fe65d9b4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624591931, "uuid": "cae7a681-5e1e-4ec1-b14c-8554963527f2", "value": "7A748D00BAA1C035F6F312F88976A36C993E7EB15B6040CB52D5EAEE56346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624591931, "uuid": "0c79c56d-ccc5-46e5-b2d3-1f4e36386a71", "value": "3696836e697e34abe8d01359a9095212", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624591931, "uuid": "d0d07ede-6da8-4219-b323-8c2d72c995e9", "value": "6144:RRK8eF4AG+ULJHUUb5iqG0Kb1Wo+GgKkpljxKmIOqsZSNTpk:m8eF4AG+ULJHUUBPKbV+/ljxKq/4Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624591931, "uuid": "c055aff2-5966-4e6c-906f-25076ba46fe3", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624591931, "uuid": "3dcd46de-ff54-4d2a-9e2b-a16f710a9ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624591931, "uuid": "89052400-b65c-46be-a619-5fbcfeffcbaf", "value": "bfaf1ced61ea80dc10b8ac87c18f355b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438e7b54-d58a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624607538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607538, "uuid": "17289c11-1370-4e53-ad94-a790c1113968", "comment": "Malware payload (AgentTesla)", "value": "b66ca215f99ff024b616dc9d77bcd32a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607538, "uuid": "282217c0-79d9-43d6-bc54-887274d1e8d6", "comment": "Malware payload (AgentTesla)", "value": "b9f5715850467f603a65dbe92286c70c51d6ba0200b02ae441eb3448449fe538", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607538, "uuid": "90795bc6-bba9-4172-ad80-37ec765f536e", "comment": "Malware payload (AgentTesla)", "value": "33200b3b632c889097645f7a9a50146435a5a2d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607538, "uuid": "f16542a9-96f5-430e-9eef-feb54901c6b5", "comment": "Malware payload (AgentTesla)", "value": "09ba6ffb5eebc2eff4ecd715a80aa211d247519d2c60e25fbc6c0fc68ecadd5099693b880b3759dab8df48a66b59dc6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607538, "uuid": "070a697a-8369-46f2-801a-e6bc90d38e63", "value": "AB05D0343AEA9815F277AF39CFD96044CBFEBA633203D81A68D113864603B41DD9297D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607538, "uuid": "70a84cc3-92ff-4172-b130-079346c03691", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607538, "uuid": "506a7788-87b5-487c-9486-5c0fb45eccd7", "value": "24576:fHB/LhEp1hcsRHlA3A0chvw+kahhAInWUqXC:fHlLj8w+zCUqXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624607538, "uuid": "65d309ff-c413-4f6d-96da-4d6ade8abcd1", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624607538, "uuid": "e41faee2-7dc4-4c47-b6d2-7e4c40b2cec8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607538, "uuid": "6d1ac886-c0a9-4d0f-9286-3e08cf9dc67a", "value": "Owlo11zVXg2DC4N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e083e9-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601181, "uuid": "073748bc-f9b3-4d84-8386-5b2f0c686254", "comment": "Malware payload (AgentTesla)", "value": "de2ce7e06988660db54016ae88c28a27", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601181, "uuid": "50e8fb0b-cdb9-4d6b-aa50-f29084b2ed4a", "comment": "Malware payload (AgentTesla)", "value": "bb387215df225f84e14d39997c0462486b51cfd8a32d89abbbf46720dc106514", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601181, "uuid": "4eacdcb9-3010-4d50-b280-0260d5076b4f", "comment": "Malware payload (AgentTesla)", "value": "24f01d422bd0f1800ab114f531256d82f8840fb5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601181, "uuid": "101e28a7-b14a-4fd9-83b1-95c1c4cd0807", "comment": "Malware payload (AgentTesla)", "value": "58a0d40cfcfe38b3fcac42536a35403d78247903ee886c6ea287266957fb955f2b94b8362664aa13c0b69b159eb04d18", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601181, "uuid": "6bca764c-ea33-4e29-b48a-d39201b600e3", "value": "D1F423DC886F997A76C968F1F8BF6E7B070985BE60071D11AEB257AC32005F3501B52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601181, "uuid": "1febab4c-7d7f-4db1-81a2-0c2649476fda", "value": "12288:wPGtsV4B2DlE2+iD55BPJldVAQ/opxP517gT/4AC8nRW1PpopctfzH+2wb3FiB/x:WG04B2Dr+iDhRNAQ/uP56/jMRtU243A3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601181, "uuid": "69eab969-a691-45a3-890e-a1575b362b50", "value": 785721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601181, "uuid": "6bd8ec7a-9ee1-4f05-942b-6cc5eb37c6f1", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601181, "uuid": "464bce21-ccae-4bda-9308-d674a8ba54fc", "value": "Bank Slip and our New P.O.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce5ef94-d606-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660891, "uuid": "12d89fbe-b168-4a80-9693-c708431da6c4", "comment": "Malware payload (Mirai)", "value": "b877dfc7fe059f1b79df607dfc0dfb1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660891, "uuid": "37f1ab8e-0b7b-4dfd-b86a-3d2d215fcb7d", "comment": "Malware payload (Mirai)", "value": "bca017dfab2e0f6c2ece532fd986209b337f3e93dbb3cb613894abb5aaa6657a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660891, "uuid": "60f8b504-0dc1-450e-ae59-fa6c6f96ec52", "comment": "Malware payload (Mirai)", "value": "25240d9518504dd7ccfda2081697bf1a46781817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660891, "uuid": "cfd740f7-a1e0-4503-93da-0f626946f813", "comment": "Malware payload (Mirai)", "value": "301befbbf6bff2b253f585668be5837fe45dbbe03d26341b4dae1ba593df9c9b06af6c7a5c911303075e895b455f5f95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660891, "uuid": "b10a76af-9192-46f6-91f0-58cb6e155896", "value": "B713F1F67ACF8AB0C0BB163D4854831780ABE6F4D4EF72A626248368EC1117723751CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660891, "uuid": "a5f16d88-358f-40d8-9ef8-9f7230feb2df", "value": "768:dcweZu8hdwrBqITaY/d/snE9eWlZoXNd3f48VpsoVJ5oPOoVB21bs3UoztM:+ZZYrBcQknATodd3A8zsoVJaPDB21GzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660891, "uuid": "9ef053ac-573b-4acb-bb5b-44935d893e84", "value": 43920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660891, "uuid": "a5f8113f-1651-467d-b11e-0740f7a40edb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660891, "uuid": "369c95d0-3065-4e63-a39f-206e9b5728e4", "value": "b877dfc7fe059f1b79df607dfc0dfb1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f085bc30-d5be-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624630162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630162, "uuid": "edf5069c-c5f1-4869-b1c0-59adeee30dca", "comment": "Malware payload (NanoCore)", "value": "6b7c1ba632c8d3e23cb31da63e7759f9", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630162, "uuid": "f06e1ec8-ae9c-4879-aaa3-8c80651d7b80", "comment": "Malware payload (NanoCore)", "value": "bcad1996d35bd5169988cc280102f8f7c9e4774a5673b0ec49d0cde43411d833", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630162, "uuid": "3d1a3e94-395f-4e9f-9227-af7adf91e81d", "comment": "Malware payload (NanoCore)", "value": "620359743914a561cd3bb4e320f280d891d1cc91", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624630162, "uuid": "89d25b4d-2ab0-4f1b-83b6-4a44e839e452", "comment": "Malware payload (NanoCore)", "value": "f7ed214ab99b5cc53fbc6cde9b7611c0683618ba3f1a15a27bffad8157b12f5d6d3c369e6acf279822cf029834d333a3", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630162, "uuid": "c26b43a4-ec52-44d4-9e2c-158468f3e173", "value": "2F94233980E80175F1D505F8D08357F43A6181E6AEB56E837DE0A2CE808656FF5AACFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630162, "uuid": "a7cd88bf-e732-4a82-8b96-2c174dc840c1", "value": "12288:MqHA3BTl5NQWukW0uunXwMwk2Q2/cLeDcVQio:MqgB7uunXhdn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624630162, "uuid": "406916b8-205b-456f-b7aa-e37c6e97796e", "value": 442032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624630162, "uuid": "99a158a5-d764-4fda-ba3a-513795d3d365", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624630162, "uuid": "8a9023dd-ba5c-4413-8efb-be2d810af183", "value": "Mwasiti Mnindy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5052eb4b-d558-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624586084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624586084, "uuid": "f10ea004-14fc-428b-ba42-a2b39ead79be", "comment": "Malware payload", "value": "51707a312ec0701a9d63f87259ab6657", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624586084, "uuid": "8cbd314f-a90f-4293-89a5-41f8b4c3678b", "comment": "Malware payload", "value": "be5abd65ddbe919fb56b35427c73544aed9b37082a169a162b00bfb8b07ef943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624586084, "uuid": "725b0fa6-ab3c-4ae3-ac69-f4117b6f4207", "comment": "Malware payload", "value": "9fc39b6140b76cd1c239240c7ffdaa308044439a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624586084, "uuid": "544e2b93-6a05-4326-b6d6-31ff5db3ceec", "comment": "Malware payload", "value": "80d9dbb7448a9155c0c3e825b05e31c53b55eee37c9e1e6c9cd29e1b7b18d336e489d924b8b804f7f9040a7a740ccf32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624586084, "uuid": "0dfc3c4c-96a1-4f4f-a0a6-31d8784e6b4c", "value": "8C86237C0E4677A0F7A8B73EB405F71C870E678B786A4DAA6768C5D1810709930FD0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624586084, "uuid": "79c92e8e-c91f-483c-af1d-64484e08ec3a", "value": "6aaaa79487c6ff1a64326922c92a172d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624586084, "uuid": "e0704974-4aae-425d-af0a-dcefdce483bf", "value": "196608:PlvV4N05bH2UBGKJ3jBb5Nvj/mAiIdEsXKvyjoZU:PlvV4NfO939TvLmsEOKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624586084, "uuid": "75c3f69d-db77-4bac-aa8a-fdbe2dd020b5", "value": 7968768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624586084, "uuid": "8e070877-1dae-4ac6-a92d-afd45cb45c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624586084, "uuid": "bc532f00-6688-4a1e-ba87-070a22df9672", "value": "51707a312ec0701a9d63f87259ab6657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df25c32b-d5f1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624652037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652037, "uuid": "f2b5807c-8a0c-4df7-a5ce-2abafc434200", "comment": "Malware payload (Mirai)", "value": "593efb740926b45f5a2066c73ae9bb34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652037, "uuid": "6b0e5463-2bdd-4bb3-bbf0-7329ae49d5f7", "comment": "Malware payload (Mirai)", "value": "bef16489c9c2f0fa42d4829f5c3cde5340dc7a3ed9cf75ef6779b8e831280e0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652037, "uuid": "f99e18e5-00d7-436d-b8ad-15f3a4cc1022", "comment": "Malware payload (Mirai)", "value": "ce7f6b714a7ae6f1ae058d50409f40cdab55cbcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652037, "uuid": "2a6138bd-7de9-49e5-8419-5d5e757dc40e", "comment": "Malware payload (Mirai)", "value": "e80be41bb9972a8feaf9df0fec1a2209e8940c5f2d27260e4c42126ba54068b07c77bfa29f93fa7bf0c60b4c0eb22d02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652037, "uuid": "389a0aad-836a-4c0f-8299-8221349920db", "value": "4D639209BF611FF7EC6FDC374AE92B4525DD641A21A83B397930D818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652037, "uuid": "b6bb609c-66b6-4b57-a27b-ba4fb86d1748", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15Id45fTemle5Re5brvuX5XiANe1j9NE:CDSC5G9afb249FKI4pfl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624652037, "uuid": "ca8f76e5-e187-43ce-aaf3-fcdf789a1ae1", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624652037, "uuid": "97dea907-c383-4d9c-9951-f9e058f0292f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652037, "uuid": "4224483b-c716-44bc-88b3-a1b5052b99a7", "value": "593efb740926b45f5a2066c73ae9bb34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb412e1-d5f2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624652304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652304, "uuid": "5e14b156-2349-44be-aee2-040679fc8989", "comment": "Malware payload", "value": "2e8645a0644b7e7a55b4fd55a83942d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652304, "uuid": "a419e13c-43b9-4c6e-a740-55123268f404", "comment": "Malware payload", "value": "c0493b2725b38545cd7b51015335c87e842096b635e2055b6cc30c038d69336f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652304, "uuid": "9b7b6fe4-371f-491a-8ce5-4fb566ed9744", "comment": "Malware payload", "value": "c7bd8449b648f4eb2c295b6b591e90f0933ecefb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624652304, "uuid": "5be2691a-b014-40ac-9128-d6facea979b6", "comment": "Malware payload", "value": "04514ffe1c2878f87b4936f7734ca33141c58522e010d7a5e42237f23c9162e81ddcdda672e112ec248519f7d1b1961f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652304, "uuid": "a0ee63b9-cb2a-4fe5-bf5e-aaf7957f5937", "value": "5A450110A2A1D035F1B311F899B893AC653A7DF29B7510CB52D9FAFE16282E1ED31713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652304, "uuid": "5414f66c-4e17-4e7c-86b8-f9168c308906", "value": "15b3a9347f4ff2346891602b4cdf58c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652304, "uuid": "0c4b94f7-5b0a-4035-86cd-f6a402262d12", "value": "24576:c0C8ZPPongTMNXnMvXmJh6RnBF4sXqb8dgihbPM0tdm:XIKMNXnKmh6RnNXqAdtPZtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624652304, "uuid": "e608bbc6-1797-4a9c-b9e9-2fb08223eda7", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624652304, "uuid": "e8890f3a-d3f3-4d69-aacb-f297770ebd1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624652304, "uuid": "e8fb3fc2-6fd3-42cc-9cbe-7890304f0ebd", "value": "2e8645a0644b7e7a55b4fd55a83942d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c484ee6-d5be-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624629859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629859, "uuid": "e37ffe3d-e9a2-4a99-94de-8f499ed0de00", "comment": "Malware payload (RemcosRAT)", "value": "ca82aa0a2a1d283b608495ffa883b7b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629859, "uuid": "f8933a7b-15f2-4760-8fba-e9c7667e7afd", "comment": "Malware payload (RemcosRAT)", "value": "c0503b9a911b674579a25005f552760d37b15e9246a8ccdae53d1e6001413611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629859, "uuid": "86689fbb-d689-4e3c-9d9e-ff324e8c8339", "comment": "Malware payload (RemcosRAT)", "value": "32091f44b116bfb7599e921ab21276810f22da5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629859, "uuid": "1ce326ee-62bc-4f41-b2e6-1f4c283ab47b", "comment": "Malware payload (RemcosRAT)", "value": "8708b3b527fbcc6b4d96778b5ac3e142f0f9db816e38eb9b031a53618e1e882162d5029dec8b5838375404a8134f0a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629859, "uuid": "558c4148-f654-458f-88ed-8672083a40f0", "value": "8445DF42EFF144FBD479073045B71B306EB6AF201AB6861B6BA075796D323436E23B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629859, "uuid": "d1052d2f-b520-4f01-8ac7-12aa695cb9af", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629859, "uuid": "eacbb623-7df4-4607-b5b4-34410a8d66c1", "value": "24576:WAOcZwlfFL3YgQVQknFPNPDJgqEkdbiG2K2fp/k:cv3SVQkFVDdbcHfp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624629859, "uuid": "9690c486-fc8e-42d1-8635-347380d7fa1d", "value": 1255292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624629859, "uuid": "415c3109-e554-4650-aeb3-3570cc7fa372", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629859, "uuid": "5320fbfa-710a-4d94-be56-d21535a839c7", "value": "IM_EX0003561772_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70636a4e-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624617921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617921, "uuid": "1e259038-977b-4b65-b323-c132aadeb678", "comment": "Malware payload (RedLineStealer)", "value": "39ff4a46010cd4a2c20c95e8ace094f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617921, "uuid": "9933abf8-b3d1-490d-8f78-15a5d4a534c5", "comment": "Malware payload (RedLineStealer)", "value": "c0a3383b2bbc00b00bd99bb23833f573d0ee1c6ec78ae9548716a801bf01cace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617921, "uuid": "0c76a4a5-e3d3-4a6e-a90c-650670cfd900", "comment": "Malware payload (RedLineStealer)", "value": "358aa27515a77d8163136a5c6a00262393586dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617921, "uuid": "dd07ecf0-c35c-4b76-b91e-d36f9d446daa", "comment": "Malware payload (RedLineStealer)", "value": "c388fb99e1243f4212adafa49f8d5406604b7a3437a5fbe80b09e85b19ecb8c5ff7a74a3af706813d1d8159d5520b6a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617921, "uuid": "9d57f507-0574-4d49-80de-e18d257dfbca", "value": "CCF391263397C472C0C82231E461CB3B2768CD2703B5B35671C6AE67BD6B69C59BC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617921, "uuid": "a7c4119c-cae5-457f-a5a8-6409bdefa654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617921, "uuid": "b400a92f-d4e7-41fc-9d6b-d6d471c13416", "value": "1536:658AYxbGu6nz3K+LjW9nfVFjMZBMSWXCY9N8cd+k4v/fFrBou3faav4040404V:65KlPKa+LjEfTsM8Yjn4H4040404V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624617921, "uuid": "58a8ca26-bec1-4afd-a393-449eb2cbc527", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624617921, "uuid": "2ecb5185-81f0-49b0-93a7-155759567e4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617921, "uuid": "21acb123-164c-42e9-ae26-be88e209f99c", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.2038.22800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6f72c4-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601863, "uuid": "9bc16b2b-c13c-4a89-9602-1b9a230d3570", "comment": "Malware payload (AgentTesla)", "value": "22544ebe898f321f22b65f15722441b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601863, "uuid": "464f4663-df60-4727-b7d6-2129899afe5f", "comment": "Malware payload (AgentTesla)", "value": "c2049006a9c61fa57309a7c651ca0e48b6b16dbbb8f545d4d879ecb19ef95efe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601863, "uuid": "01600fb4-7ead-40a8-9f6b-25fc5d5abd79", "comment": "Malware payload (AgentTesla)", "value": "1c5dccc7ee8cc04e609a951164a37c1a56e1f1c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601863, "uuid": "83c61589-5311-4024-b730-78d10f9291c2", "comment": "Malware payload (AgentTesla)", "value": "885f33fd9e1fe935249d1237e0724dea4ad1e21383a24bd4cb9cf446cca6052d9c53a5e1414e7059c86ea35c71bb7b26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601863, "uuid": "79a8bd2c-cb90-417c-9e38-1a2c1e132c01", "value": "D4E4D29964D0279EC42E917AE8AC3CF556DDB82E2206DDCF40F2A389953B74FCB07461", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601863, "uuid": "02ae34ea-e3ef-4f5b-9d8a-99684f7e7834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601863, "uuid": "73d0e0a6-1cce-4c1d-9d38-df4225853929", "value": "12288:bVNk5/1d+iTcLLE13v5osamxLWGhJcRbjv5MgW89:bVu1+iTcL413v5Xamxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601863, "uuid": "ed9f0035-2666-4453-b92e-3576da8390d4", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601863, "uuid": "f1f65926-866d-4db2-b160-a34758eb665f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601863, "uuid": "2991f765-a9fd-4165-ae2c-e3d75fbdd154", "value": "QTN TECHN 80654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e270c71-d57f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602750, "uuid": "01e6d1f1-1c38-41af-80eb-645769a3c771", "comment": "Malware payload (AgentTesla)", "value": "3ad8b5b41e827b371f8701ae395dee04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602750, "uuid": "71479757-7d29-4aa6-b238-22b76bd53d6c", "comment": "Malware payload (AgentTesla)", "value": "c2118ba67fc99b45ae42f97faf841651ecefce3775483bfffc2ddd1c32e03dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602750, "uuid": "3487cd04-670e-42b4-9e88-785bf50d699b", "comment": "Malware payload (AgentTesla)", "value": "d5338ff80988dac9172685e7e36b102086560d56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602750, "uuid": "dd45c448-560a-44c2-9408-9ea7b65f299f", "comment": "Malware payload (AgentTesla)", "value": "30c55738f0780acec9963f4e334b338a1a3a87f4f3f7c308dc574b4882a26f7a9bc45679ce4ac400411f9fa7a904bf62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602750, "uuid": "e1b2e68c-1986-4364-b223-0fcea0ef7d9f", "value": "65E4CF2436EA5669E377EFBD19F0719657EFF6233703D40E2C9012CA4A13A41CE91A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602750, "uuid": "b1f85328-8ed5-474b-a2cb-6aed028b4b6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602750, "uuid": "a0459872-2c96-4fb2-9feb-a3e8c903431b", "value": "12288:m3gAEb8dfJZaF9GF2u2+70pKXQlf8wtQzju+WPp69Hd+v9EUgw5LUqYWA+FKjnKs:nZjuAptT1WK9xTvqjhnUi4JT4noW0Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602750, "uuid": "988991d6-1a88-418c-97ed-11f0668adc43", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602750, "uuid": "9a611a59-6f41-423d-95ab-54a85f28838e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602750, "uuid": "fc1b4735-5a6b-410b-8219-40e289c78847", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fe9c18-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651154, "uuid": "8b67dc22-b0e1-4d3b-b595-c799151aa33a", "comment": "Malware payload (Mirai)", "value": "cd3d493a2912cf7f4ea3c99ce00b6f50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651154, "uuid": "464f4dde-99ca-496e-8655-12f4736d0ccc", "comment": "Malware payload (Mirai)", "value": "c217d4fb3e48cb2334fb2678d5952b649a56187c3bee0b679dd0d3ee6d5b2a6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651154, "uuid": "d0eab309-a3c6-44b7-8cb6-f180e56fad58", "comment": "Malware payload (Mirai)", "value": "a7e2c9aa4a5e0a623506f5680f5e5d13ec0fa158", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651154, "uuid": "39452780-b30e-42dc-be0a-76ddc923e6d9", "comment": "Malware payload (Mirai)", "value": "e08ebe6bfd9827c1a4ed46193c78f80627479fce3a0047402fef4d7f19750238db2bbf7b867f8031db21927b02820fbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651154, "uuid": "796fafef-e40c-4cf4-ba2c-988a13d266b0", "value": "DAD2F1026640FEF1C5B00631E8668A9B72263DB8C1D135FA963C0DFCA6E961D47F9D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651154, "uuid": "b50e39f7-972c-4b5e-97ed-d566ec9604da", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgYX9q3UEL7I:WRwynNIOQQ1KMwYmL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651154, "uuid": "09f5bc21-9d31-4fc6-a131-cb6a5419ce47", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651154, "uuid": "f4d8bd44-455e-4ad1-86c4-01322e5b644c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651154, "uuid": "920d99cf-40dc-4730-8aea-e618c30844d4", "value": "cd3d493a2912cf7f4ea3c99ce00b6f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d3bbb6-d5dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642841, "uuid": "92b71afb-2f05-4240-86b9-8ac3b154f3f1", "comment": "Malware payload (Mirai)", "value": "f3cdfac66c27fda39604afa40a54ff68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642841, "uuid": "6ecee37d-b55d-4b07-9c62-f8e2ff17e7ce", "comment": "Malware payload (Mirai)", "value": "c33ae7b290af96b7dbe96ce54e5b4abe8cffd282273d8870189d39e77a56bb70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642841, "uuid": "6d19e493-819b-4408-bd81-a20ef45fda26", "comment": "Malware payload (Mirai)", "value": "a421bdf517a8caac43f65700af64140f79ebb9c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642841, "uuid": "261bdf24-e199-4432-bbde-46a922cec83f", "comment": "Malware payload (Mirai)", "value": "c4a98bf19a6c98fe7dc482d3e90db0940a76ff1c43210ade004a0b5eb59aa035904b9d4f0c3bec966e4ceadac02ff9ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642841, "uuid": "213ad195-f3ef-4a98-8f5e-c2c7f344c7b5", "value": "81339EA5C5B9ADE8D2148E747D248E388763E100C6933EFEEA4486599047EFCF2583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642841, "uuid": "a342f2a2-aa65-41ed-ac32-693c00d5a873", "value": "768:ra4w6wt+ZMppnx3oepHPEGftnjrgfAPs3gyMVlOCpESCPoYqdCC:raX6wtI9+RhPJPs3TMVlJpESfrdCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642841, "uuid": "c1b90a3f-2c98-46a4-bad3-70af614819dd", "value": 51088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642841, "uuid": "fdda5f81-de50-4c60-9a32-9ce1e851030b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642841, "uuid": "b36e8a9d-2b53-4d88-b983-d0728e0394bf", "value": "f3cdfac66c27fda39604afa40a54ff68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8d0b83-d5b7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624627065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627065, "uuid": "323a195a-2841-4b91-a99f-7d16fa2d86d8", "comment": "Malware payload (Loki)", "value": "cf6136b33398eb0cd7307dae63dceb69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627065, "uuid": "838fbe47-27f7-4ff2-b419-714073458843", "comment": "Malware payload (Loki)", "value": "c419db928f7e3be31d20d2153ba913bc6b7825b68c386d674b182ae28378d28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627065, "uuid": "3bb0b497-917a-41d9-af0d-53f3462e5f3b", "comment": "Malware payload (Loki)", "value": "25e5d27c94aa576430b58b309cf41159dbdd24eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627065, "uuid": "ac221d0a-957c-420a-b17b-b0b2321af239", "comment": "Malware payload (Loki)", "value": "9f8396c60d76244b7b81a0f0e2aac63f1635ffc449d298d51461c746d20e8999c86621e9ccb94c2136995fdc5664ed71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627065, "uuid": "3785bb73-2361-404e-a31f-5a6e225d8b12", "value": "1CF47C20699C4319F076EBBCC9B06E454EA9BD21D611C4DB2AD33E8FF733940CD5662A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627065, "uuid": "47c9c740-d81e-4318-a154-72f0e67d4114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627065, "uuid": "8ffb9dff-ec2d-4ab3-a3f9-f516a4ede9b7", "value": "12288:9YAtcbJZaF75GF2Sb6WT1gnqvGRopCj+Y991C6tg9RpVbF0NlJnMrgVNM0:CAjbS+WMqvGmpqti9lB0NPMrgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624627065, "uuid": "5a512700-a26c-4946-a2eb-449e1adf34b9", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624627065, "uuid": "4de7cdc5-9e50-45ae-b249-ae808967b84e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627065, "uuid": "0436a02e-e3b2-4220-8d0e-53133996f1fb", "value": "Purchase Order_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f606cc-d58f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624609820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609820, "uuid": "b73e4322-f609-4191-b672-c9b792bdeb69", "comment": "Malware payload (RedLineStealer)", "value": "fab01169c3376e3e043a63197d180aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609820, "uuid": "778a1fdc-35fc-482b-bda4-40f5af65c5e4", "comment": "Malware payload (RedLineStealer)", "value": "c42172b4cef51a701d613ec6b932b6196ce557f4568360a3cb6a1a365161852b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609820, "uuid": "699f37ca-ea37-4463-b609-452100c405a0", "comment": "Malware payload (RedLineStealer)", "value": "c2a0399b832d53861b8a75aa87d44a784dbf4922", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609820, "uuid": "f777bbfe-1516-40f4-a3df-f26bb856c459", "comment": "Malware payload (RedLineStealer)", "value": "d0b65d9ed488c3eddbd21687e7652c67b2861e32371885e097c5605e77b382f18f84b5753f20057df09faaf29ac285d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609820, "uuid": "230be925-da54-4090-b57e-0f1a14f9f7ef", "value": "0304B06723A7C572C5C42230E4A2CB3B2664CD2703707657B4CAAE57BE6B15C5EBC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609820, "uuid": "65ea292e-5b09-4b14-9299-fc3ea0c6d265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609820, "uuid": "08b4e9e6-34bf-4390-bf1e-1836b4e6e5ba", "value": "1536:bQ9GyUg4PeQ6JhfbD5Qx2WwB2KdmF2/gXFFhGLMVqWSd5du2F/SY:b0UehJhT3rUUs2/gxGLMhSdjZlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624609820, "uuid": "f46797dc-65e1-4b8d-9c82-127d2c9033ee", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624609820, "uuid": "cbb111a4-0c96-4770-9a11-4aa88fbe5e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609820, "uuid": "f36ccc60-8e45-4ece-987d-966719dcb930", "value": "fab01169c3376e3e043a63197d180aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0e0043-d5d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641215, "uuid": "d1ec32e3-5034-4ff5-945d-c4c0c4e14a44", "comment": "Malware payload (Mirai)", "value": "55c6e8491cf01727baa2dae98ed2d668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641215, "uuid": "6a889b98-e365-4d7a-b9bc-e2539e0b61b5", "comment": "Malware payload (Mirai)", "value": "c4b42352eb3fa107b450a9cab944929f1a6546b23442f8d791834b7315af86ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641215, "uuid": "bc11e619-6ce0-45c1-89dd-2f10211b7aa0", "comment": "Malware payload (Mirai)", "value": "809c6a5281e068ecb32988016844293ad7586618", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641215, "uuid": "17ffc410-c144-405b-aac1-c49e5a8132a0", "comment": "Malware payload (Mirai)", "value": "f0a0ba6700ee9228b8c7c02fa0ecb5f8c5717f6480743eb31b2051f5af09714800339900745e4f1bdb4a9a58479cd514", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641215, "uuid": "368251f2-b19d-4d1c-9aee-5ed0a21c9785", "value": "AF535BC9A593E9F4EC111A71317AAF338A73E13E3015EA83D3A8A573FD51642E10729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641215, "uuid": "284d8b14-9bc9-498b-8442-3f569adf0c67", "value": "1536:Qa2gpfCCeK74vc1KOm5lgMnxiKze8eN0vfyv6DVsS/4Qj5hYoLz5xqOE5tS7m6:mgpfCCeK74vcI5lgMnxiKze8eN0vfyv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641215, "uuid": "3a7ce326-9448-4101-8329-5e6081309e4b", "value": 66448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641215, "uuid": "ebba6ea0-d28a-4229-bca4-54139573303e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641215, "uuid": "d2604d07-a3f3-46c0-ad55-11f9e9c64331", "value": "55c6e8491cf01727baa2dae98ed2d668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff4eeca-d589-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624607183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607183, "uuid": "f4ae602a-c6c7-46a8-b63b-901a1e96019a", "comment": "Malware payload (CryptBot)", "value": "18f0fb2d8d2e6ca3f95a606c39ec4209", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607183, "uuid": "78aa01b3-8a61-4898-a549-6d21e71c89ed", "comment": "Malware payload (CryptBot)", "value": "c535beeb0725464e7e46f79e47612a0fb4acc25551d0b417615fbf4dbbef26e1", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607183, "uuid": "395842e1-99d0-4add-aee4-ad4ab1968eac", "comment": "Malware payload (CryptBot)", "value": "531b01e0074ad2f6a2c95c376e63e89603a5721d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607183, "uuid": "ec15758e-4ff1-4f3b-8db7-fa523c1d6baf", "comment": "Malware payload (CryptBot)", "value": "685b912336d6941287ed4890b14a867e7217a2f16dd458772156a9f4fec1b0a08ab99b1321db2024e5548c134aebad6f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607183, "uuid": "f0ca9ccb-5f85-4e36-895b-ab760a5be4a6", "value": "5005E010A691C035F1F342F89A75D368993E3AB15B2444CF52D5EBEE1A746E2EC31B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607183, "uuid": "bb544e1f-e108-497d-b97b-20c5c326d788", "value": "762eb19010c0700eaa21fe941afb9920", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607183, "uuid": "67d23619-285e-48cc-81ba-3573f3289618", "value": "24576:5mYNRUMwwCw0OFLoJlx1B5Whq+ue3y7I:jSQhLoxrm3yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624607183, "uuid": "9d4e2ba4-5ce9-46f9-a189-13163f43b737", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624607183, "uuid": "ecce5f9c-d6d0-4c76-ac08-ce70dd7be793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607183, "uuid": "3d1cecfd-6113-493e-b979-1c13cd022079", "value": "c535beeb0725464e7e46f79e47612a0fb4acc25551d0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f15cbbc-d55c-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624587907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587907, "uuid": "8c1da2eb-1835-4b71-b3cf-fc6f1be15ace", "comment": "Malware payload (Gafgyt)", "value": "7e0ff1e7b9aab89c27445fabe6c8b4b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587907, "uuid": "70fe7e57-46c5-4748-bdaf-ab0dbeb2a646", "comment": "Malware payload (Gafgyt)", "value": "c53fc1044b2dbac02d3ad65b77ce7d48e507826d6f17772bf471dc38d88b5b1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587907, "uuid": "16eb9268-499d-410b-af57-7c824932c4ce", "comment": "Malware payload (Gafgyt)", "value": "352ab6a15f4099b780afe189a6e3509652dfcd36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624587907, "uuid": "9a539ec5-6678-408b-8463-0e0a3627dd78", "comment": "Malware payload (Gafgyt)", "value": "aa7986ebfae2ae3484c58852ceffb05004b2f4adf4123c53edb243a5aedf52e021756aa7f7ad3b91e23084a754652f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587907, "uuid": "82fae1d9-e3dd-4409-8cb1-54f44589687f", "value": "152302382A30C466DAD01A399F5540D13F244AF5D1DBA93213D842F85668BC7EDFA7C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587907, "uuid": "93927bec-a3df-4e57-b8b6-057a490a5906", "value": "768:gDJ8KryuurEHARA+wobDleHbaU0qIgPZCJhQHwO+++AhYG/GrXdD9q3UEL10RZxu:+J84f+woAHpPZfHw9++vdXQL10FyjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624587907, "uuid": "263eb6b2-3790-4a03-aa96-1d68d616621f", "value": 48476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624587907, "uuid": "f53fecfa-c026-43b2-82ff-dd425fc50b85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624587907, "uuid": "4756434b-d302-4542-91b8-0c67232c7284", "value": "7e0ff1e7b9aab89c27445fabe6c8b4b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ab47ba-d5e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624646458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646458, "uuid": "eeab41ea-faa7-4caa-a697-e062ec4a5e98", "comment": "Malware payload (Mirai)", "value": "96440296684451636956cd551446556f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646458, "uuid": "6dc20c4c-8014-4360-b437-d1f014a9c42a", "comment": "Malware payload (Mirai)", "value": "c58cd95e8db8ba65e48f3699e3dbd1153965fc4fa9b475003f27c13f4859eb74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646458, "uuid": "995edaf5-609f-4842-ab96-027d84cf67dd", "comment": "Malware payload (Mirai)", "value": "cc685304302a0d2ca18728ddbf936b51df19fbf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646458, "uuid": "c5f92d4a-61b8-440e-94e5-8c82732ac0e0", "comment": "Malware payload (Mirai)", "value": "13b6d4ba1bdf4114042e01c6d18a01c2fb7c8d15213ef2aeac7ff89ad132d73e77f814553dbdd3abbd3485a7ffc186ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646458, "uuid": "b9f4eae4-ea2d-47d6-897a-1fb38b65102a", "value": "C2630996B8918A11C5D413BAFE2E018E3313676CE3DF72139D106F246BCA92F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646458, "uuid": "1d8cfe5b-9685-4b34-bf54-4d2765ef26b1", "value": "1536:J0nw6TEZpxyBRiv5y9pjOSy5yabD1Z6eMl7XccIKiuw9vGWDW0t:4wZneRwUbjogUDbuw9vGWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624646458, "uuid": "40446949-55b5-4713-ad28-0e950f8649eb", "value": 71172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624646458, "uuid": "585df005-5270-4caa-b6d3-a810248ec330", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646458, "uuid": "6466f0de-a7a1-462a-825c-735ee72ee328", "value": "96440296684451636956cd551446556f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f809d200-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588513, "uuid": "b61b219a-d792-4d5a-b7d1-d3e6569007e3", "comment": "Malware payload (Gafgyt)", "value": "03d6eb240715b3095720c836806186b2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588513, "uuid": "3d7bb625-7acf-4de9-92f1-cc9ac1183d72", "comment": "Malware payload (Gafgyt)", "value": "c5ea3aa9643bc0b6d0f866738ea2aefd564d7edf1d9548b1c7fbe309aa9753e1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588513, "uuid": "b4730b43-4294-4b15-afe5-f47c95e8de7a", "comment": "Malware payload (Gafgyt)", "value": "050030d35b01adc4220f2252bcdd528a213ff37a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588513, "uuid": "471922b8-1f6d-440f-a962-3253785b3e56", "comment": "Malware payload (Gafgyt)", "value": "ef69b5e43052fee15967cadf5f6c5444947bb4b66a89d96b2a4b267d5197ee5cd3cb9befd292dd058472a96c9e9abee0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588513, "uuid": "30bc51b4-b0d9-4018-86b5-a714c4dc0673", "value": "E713F15B720859F8E077687530AFB286FD327C553028C62E1E05A37F9DAAA3597E1331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588513, "uuid": "12881d18-6a70-4c90-8e56-fa8fc1d40085", "value": "768:w+m5Zv3w4kVKUapWR1xXtYLJcX+VOy7ayaJ4/bR12Sx0JrQp8j:w+mzvQVKUawNCLX4tulD8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588513, "uuid": "5c7c1390-e706-4fd4-86d1-f5ca9988ca22", "value": 42264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588513, "uuid": "23997a5d-9d74-4360-910a-6bcffddf91b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588513, "uuid": "52d955bb-33af-4f1d-914b-db6bce271a08", "value": "03d6eb240715b3095720c836806186b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6a2fc1-d58a-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624607769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607769, "uuid": "18c79662-5a96-46a3-9056-ae0df0903f54", "comment": "Malware payload (DCRat)", "value": "a0a78d8f7c310cafa124260fd04c4294", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607769, "uuid": "7e1cf6d2-aebc-4a55-bb15-b5a67b1afb19", "comment": "Malware payload (DCRat)", "value": "c73fd1810d771974cff5f436a14f76cb3cbeb442baf97f3553ba99cf118bc337", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607769, "uuid": "c989a5b0-f458-444c-ba7c-2fd3dbef8723", "comment": "Malware payload (DCRat)", "value": "8ad40dc4cbe758c5d3460f541ab535e57b0eff2f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607769, "uuid": "e738a981-8e27-49d7-bd9c-7113953b3755", "comment": "Malware payload (DCRat)", "value": "8ce7e3bcba691701d83d0af9dcff1ce76412b0671c425eaed89fed67ff97025da0ced2b16edc3d7c40389b962b786684", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607769, "uuid": "685671a2-7ccb-438b-89bf-f109180b3d01", "value": "49350822BE46DE02C029263BC9DF487407A8EE417A66D75A3EEF335D65113A70D0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607769, "uuid": "5cbe4096-ead3-495a-b38c-3e165580c35b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607769, "uuid": "5e771812-9fb1-4821-a0d1-0b40e5fcede8", "value": "24576:l00D1URL8PMRojwW7RvwW7RQNbfwW0RWNBwW4RsOp2WywW7RsEyjam/J6DAFZfQa:+s1URL8PMRojwW7RvwW7RQNbfwW0RWN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624607769, "uuid": "2c686453-1a44-4814-af48-c853198a4eb9", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624607769, "uuid": "c5c9264b-7e61-460d-afde-b1ebd62004cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607769, "uuid": "d7cdabe7-30b8-4f1d-aa4b-84118497dd0e", "value": "a0a78d8f7c310cafa124260fd04c4294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54a0f9b-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624618036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618036, "uuid": "4774aa3f-b236-4397-b31b-268a49453a8e", "comment": "Malware payload (Formbook)", "value": "eded69923410a35211acdf7ead546176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618036, "uuid": "c9508d4c-f6f4-4232-a5cc-a7bedf1ca1dc", "comment": "Malware payload (Formbook)", "value": "c75c953e098f6999fd4a1674f4fd325d538502aead639872dec4cb89ca3ffee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618036, "uuid": "f29a2ff7-2bf4-4731-ab7d-11852f4cd3b9", "comment": "Malware payload (Formbook)", "value": "7d7d21811770a91faf312b3d45d07a38586c6a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618036, "uuid": "73f79367-07f2-45ab-9f5d-0effb592e20a", "comment": "Malware payload (Formbook)", "value": "88effb3d07b8f3105c4e2a4bdb9bdcda55d81a0e8c162b283816d05455df56f345b5bf94a9cbdd25af48ad468dedd8f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618036, "uuid": "aef02b60-0dff-464f-96e2-d19a548305e1", "value": "D224120226C141FBDEB2ABB185B5B77CFFB5891152B2220B57B40F3A2E11206DB1A567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618036, "uuid": "2d6e91f2-64c9-4d76-9f6d-93d5ead91bed", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618036, "uuid": "6c3b6e0c-a978-4c79-ba0b-bb2e373d6dbd", "value": "3072:s3jqjLX1DLPcIMC0hrrwxJf61LUZPexcF065ocY1GNwZgKfUL5HFzk2L1xUq/ULY:sTqjFoDr8xqifSc/dQeVXL1uqeNU9Nx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624618036, "uuid": "c2ab7558-3680-419f-b345-e888161dbd7f", "value": 229562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624618036, "uuid": "876c9dfa-3b85-4443-a223-676c95b1b234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618036, "uuid": "b020c965-cea2-4ad1-bb19-79c2b70c80d7", "value": "AKG Upgrade Project HP Flare Tip 2018-08311SP-01 R1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27a9133-d5fb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624656310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656310, "uuid": "94aa3d0a-82b9-422e-b9dd-e4a0aa1e609f", "comment": "Malware payload", "value": "37de3c7fecc6bd379fe1f5530d9db078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656310, "uuid": "71bc76be-88c2-4fe5-9fe6-e1bb1d2a0520", "comment": "Malware payload", "value": "c7dc8c5606612dcc0ef1dc8079c23971d4af7b6e047fcabeb5432b4253dc034d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656310, "uuid": "40305e91-da20-43ef-b10c-998eb2f9927a", "comment": "Malware payload", "value": "43082b982b6ddc8d0b063529c6e6e63d9bf84cc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624656310, "uuid": "14ee7714-529b-47ba-a9a9-56b8aa673306", "comment": "Malware payload", "value": "3118b8681c494ff08d7f7d61a394c323ccb98484d59b64ccae54756359602e52ad8c12ae30b30d7e8b00994a1abc5509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656310, "uuid": "011f6ca1-c20a-4f8c-aba2-731a70e19f0d", "value": "EE45F1413EE59016F976FF3C4AE8AA558A2F7FB27B13D00E249131474B73B818D5263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656310, "uuid": "9ebc8779-ed5c-40f7-922f-09be020a200c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656310, "uuid": "a9ac3385-dbc6-4354-a628-d66edd0fc76a", "value": "24576:Jmjn+bAaMd3REebAaMd32v/U2hAPFlQR3LgeWVXxee1T1n:QqAaMVRE2AaMV2v/QtOMeWVXnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624656310, "uuid": "683e4278-accd-49b3-b213-b478a5db6f44", "value": 1183744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624656310, "uuid": "8affbc8c-0390-43a5-9faa-be9f82753cb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624656310, "uuid": "ba607287-8e18-46a0-9307-9afb704f5fd3", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b3837f-d580-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624603219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603219, "uuid": "efa82ab8-a5cc-4f9b-9882-25c9be97b54f", "comment": "Malware payload (AgentTesla)", "value": "294c3f89c950e64788546c13b466c8d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603219, "uuid": "c4c43cc5-628e-4b4e-a1d1-f636c5c775f0", "comment": "Malware payload (AgentTesla)", "value": "c7de31a272c9011e4174cdebfbef70b6af97363aea74da09ad2c184ada4327a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603219, "uuid": "94b4248d-04bf-4f8e-aa6d-7bb4cb35ff18", "comment": "Malware payload (AgentTesla)", "value": "4cbd172246778045a2dd3a239565188e5e5c1f98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603219, "uuid": "a3265336-c275-43a1-925e-1d7be680398a", "comment": "Malware payload (AgentTesla)", "value": "5b076f7b5d8c48b0f9cbeb60d3dcdee0bb3c5dd01dbb390f35d2878bf8cdcc23f3fa66deb124f3291a8087d82a9aa7b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603219, "uuid": "8f4f275f-bcae-4f57-b859-e21c30ecf0b0", "value": "E705D0313AEAD415F277AF3ACED93058CBFEFA633603D56D28A1128A4613B41DD4186D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603219, "uuid": "a9c240bf-00b1-4a06-b46d-1e5fc4acb5a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603219, "uuid": "2ad2bdd4-f10f-44b0-9620-0f3162673ffb", "value": "12288:VJofZ2xeCUaF/5mFuxtH6zGWSE5D1kIpNQvtdJ5fWTPNYNJCmqQsUrr2T4pYwusB:zTlR9hEp1Yvj+jNP8+4ugoZNN1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603219, "uuid": "56021cf9-6e95-4eec-a680-4080056a118b", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603219, "uuid": "e14471a4-349b-4c33-9457-67db5b287b6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603219, "uuid": "3f7faff3-415d-4e17-bfb7-663198f05527", "value": "WaybillDoc_3227610761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fceb78-d58f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624609823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609823, "uuid": "5d28dcd5-2be5-4811-b57a-9e63a751fbdf", "comment": "Malware payload", "value": "7b36f7400889db463c541a8295082fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609823, "uuid": "5153d839-3f52-46f0-8158-33e7e3faf46e", "comment": "Malware payload", "value": "c8316290f86ab619e67d1196b39b88fa21e2534830357f455cc4ed7e9cec4e20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609823, "uuid": "9f04fe8b-b79b-4703-9f03-d976b18df171", "comment": "Malware payload", "value": "a0e70f0141ce4c192ed0fcec7f868067463f868c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609823, "uuid": "4c6600b2-2181-4b77-9f73-fd34b83d3194", "comment": "Malware payload", "value": "4644bbfa9dcbb23763e331a25d7cc3ec1b74382df26cd826fc5c94eaee57c830ed16e813bb9ff6a8653c8740643df624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609823, "uuid": "45df209f-c2ed-462e-aa38-2afcd6aabbc7", "value": "B9F3902633A7C431C1D42230E0A1CB3B2768CD2707B4775A75CA6EA7BD6B25D59BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609823, "uuid": "431ee7f1-044e-4a39-bad1-dab6d339427d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609823, "uuid": "369e349a-e20b-4f19-a2fd-54dc70c7b556", "value": "1536:ED46yExUvOSHvjYK6cQQvRfKjSnEFV2L+EiW24/0ORLg94040404B:p/mUvvkiyOfpiD4/7Li4040404B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624609823, "uuid": "74929b87-e4c8-43df-bc14-41e5cd9e4c35", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624609823, "uuid": "6275ebce-1aae-4df7-92e7-fa0ddbe0cd44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609823, "uuid": "2d801088-7af8-4b44-b30e-2bae5729c90b", "value": "7b36f7400889db463c541a8295082fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0f8819-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624617965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617965, "uuid": "25a4ce8a-bd87-42cb-b2b0-db2ab72106b9", "comment": "Malware payload (Loki)", "value": "c93242e49da5472c96ab4d38da2db2c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617965, "uuid": "d3bf859c-dbab-4437-a0cf-c0f17790fc55", "comment": "Malware payload (Loki)", "value": "c92185a29b6f3ee3654ad05d1fc0f692a078080f4fd0140ce46f5cd200e4565a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617965, "uuid": "fbfa86b2-a5a7-4e9e-98bc-b639b027a18d", "comment": "Malware payload (Loki)", "value": "48c58e3b067ce0c2a855095897cb040d8e4b7627", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617965, "uuid": "86241603-f8c3-42b9-bb13-7ed8e8a333e7", "comment": "Malware payload (Loki)", "value": "3eda7cd7e08ec7a5ac830885b12d56e8434b702322674b8f6cbb4acdd2b696c1f26c05f2e4e2972d83c92401817eb680", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617965, "uuid": "42e13172-4610-4819-ba4f-1f9af19377a6", "value": "52F48C206A9C4319F076DBBCC5B06E504EA9BE12D611D4DB2AD33E8FF733901CD5662A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617965, "uuid": "788da25e-bf93-42db-907f-c18085a7837e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617965, "uuid": "843469db-b614-44d3-8b0e-01223bd8a336", "value": "12288:klABJZaF75GF2AOcpiX5nyfsNsEGMRH2/icsezycp+yIv3TtTPbd1flyKBJ:WAobAYX5yfsN0aW/h2v3TBzdfbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624617965, "uuid": "12f95302-d8e8-48cd-9445-4c2703a68547", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624617965, "uuid": "55406c0f-13c9-4e45-8d96-9bbd614d8f5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617965, "uuid": "428ea95f-c32f-4945-b488-1bdd8ea1c4e1", "value": "c93242e49da5472c96ab4d38da2db2c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e09e97-d582-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624604129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604129, "uuid": "b40a87e4-700c-4e9e-981b-247bffc08cd3", "comment": "Malware payload", "value": "e9b8d84ce322f9af6d003042bf9a35b9", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604129, "uuid": "3e67e158-b077-4783-8892-9245615ec153", "comment": "Malware payload", "value": "c96c062a7e0be759cba1e3aa0e35f6bfd5863ba4ecfdfefc4809d5eabd6f9c01", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604129, "uuid": "1fc37b85-3da4-4f3d-a901-0c7645f40469", "comment": "Malware payload", "value": "814c2dec69b1c5bdfdd0d4125b49affeda341c2c", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604129, "uuid": "4024383f-5034-433f-a680-dc355f8d141e", "comment": "Malware payload", "value": "dd2aa5d4f6ccf060c383e1ddfa8d2e4baab5b7c38da25d77d9078a0fe21a18b8c2489ab927f2c5ba253b75838bc4b6f3", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604129, "uuid": "02381091-04ae-4604-ad91-b4ae90ac43ca", "value": "DAF17D06F445A609E7322933C350F5352ADAD88EED62C60A7D06F9750FC5CC20E5B6DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604129, "uuid": "e5b77862-b718-4b7e-a5ce-60e5206df48f", "value": "192:ZMAyHxrWDsKffoUHnMypKhdfGgA72vuJe/44:sHpWwmAUHMypkdffATT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604129, "uuid": "67d0f60d-1b11-47b7-a7ad-791f7acffa19", "value": 8011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604129, "uuid": "1dd08344-7fe2-468d-b057-03f620bc5c3f", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604129, "uuid": "d9ad5886-2253-4189-b8f6-0ba1397e4e74", "value": "REQUEST FOR OFFER 24-6-2021\u00b7pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6003b031-d58e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624609303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609303, "uuid": "bf791374-89bc-47f8-b0ee-027d08852c4d", "comment": "Malware payload (Loki)", "value": "d2a706b30fe5c7b29118ca368c7192af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609303, "uuid": "7422bba6-6297-491f-9f86-688177e5b2fe", "comment": "Malware payload (Loki)", "value": "c98f7393639b690d4b1b4a1e9af7ba01ce943ee361a9b230dd1181a3f947a6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609303, "uuid": "6198db0f-bf20-4f12-9194-b62f5261e3e5", "comment": "Malware payload (Loki)", "value": "d7c4525ce452d9cc4619cb5142460a67358218e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624609303, "uuid": "41ae0970-ff0c-4a8e-93aa-abf73c5ba2db", "comment": "Malware payload (Loki)", "value": "3c2b1bca786b59fb7d4ebf8bf013398f29788ab966e88dc8ed400381834f0047390e12806fa33c2ec0b4832509fda618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609303, "uuid": "4868d4bd-0185-4ea2-bff6-8e6dc4f80788", "value": "18B4195986F06AFDE5CBDDB693814C003DA09D1969AFFC2A776EEC500F235F1B902582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609303, "uuid": "c68ea71c-a910-43cb-9b89-0478d7050700", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609303, "uuid": "cff42046-adfc-49a3-8f1b-f6a373784e72", "value": "6144:kukZU2xiVROB3lWWDpqtqeFL88rD+Qjcla5frXomV0hNckm1y9:+zX3l3pqtqkrD+AcYfrBJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624609303, "uuid": "e84e69f5-500a-48da-bd11-2f1f640610fd", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624609303, "uuid": "04f7ef5a-7ecc-4942-b734-605d9b034653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624609303, "uuid": "478ae266-e255-4a4e-8e6a-ae3e01d90fc2", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e084471-d5ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624635070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635070, "uuid": "c453f3c9-f641-4850-bd7b-dd8363a45880", "comment": "Malware payload (Loki)", "value": "267f2ab99bcd59f8d933f0db08006dee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635070, "uuid": "4118807a-08ec-40bd-9242-f06a01916a42", "comment": "Malware payload (Loki)", "value": "ca471f5b9cc2a2ea2e2d8b250f550e2a98c93cf322f7d7497dcd4cc1736f5448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635070, "uuid": "21b5a362-6c0f-4bb6-9273-5e8148dc1b59", "comment": "Malware payload (Loki)", "value": "2883f2c99e89909ce40774076538335d0bba7363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624635070, "uuid": "aafffcff-d880-48a6-b867-1d1d0202847b", "comment": "Malware payload (Loki)", "value": "5262d2a69851a12685b6f3766c3c20645553ef366df8e41354531e3adafb30093e4d9f4a23c4e4f991476ed40b2d852f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635070, "uuid": "69f805ce-756e-4912-ae10-813f2348a1bf", "value": "5B64E11AB2E2D463C6C1B5302FA1D67893B9EE1C5C10820B63F4BFEF39BC2979505651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635070, "uuid": "3c2a2b40-2ac2-4901-a411-d327b7023a2e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635070, "uuid": "1a4e4f1f-369e-4077-bf33-a05b1c615648", "value": "3072:PBynOpL12riocHhbmpRMgNhVJo1tOrfZm7KCGTRk/7yi8+Vk+JuWE:PBlL/rhbmp+gNq18rfZXnR47yi8OkSuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624635070, "uuid": "a9c6ebcb-a8bb-45ce-a813-c895128be462", "value": 308129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624635070, "uuid": "dcda232d-8ac1-4c26-8d1f-a1cc85d9c0fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624635070, "uuid": "2e86fbbd-481c-4f7c-8ffb-8c97ca03a64c", "value": "2883f2c99e89909ce40774076538335d0bba7363.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e237376-d5c5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632949, "uuid": "70d39ede-bd86-4abc-8791-2bbacaf74cf9", "comment": "Malware payload (Mirai)", "value": "9929f18cbe2d542c85f8fd54925dd042", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632949, "uuid": "8f7666e9-add6-4d83-a9c0-53049b19f869", "comment": "Malware payload (Mirai)", "value": "cac4e5cf25b3d9287ca3cd8715e4f5ec4a9787cd8b3c5386e5620b3d0a647b4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632949, "uuid": "d43c5120-9deb-40a9-90c2-007d4db06150", "comment": "Malware payload (Mirai)", "value": "294f8c3e5aafd1ddda7c0e2edee31fc95aaaf458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632949, "uuid": "6770742c-08b1-44e6-b704-c6342184d293", "comment": "Malware payload (Mirai)", "value": "5a335264bf8ebce78c2dea69b7e40c75a3dc29855dd77277c09ae2431de7ea3c48390cee91c881e92afc71f41e38867e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632949, "uuid": "fb1bf664-c253-41e8-b85d-da8e4cefef0d", "value": "2D533BC9E5C3D4F5EC160A71217BEF33D776E57E2068DE97E3986532AA02602E10639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632949, "uuid": "36d1751e-5899-41db-9ecd-8b6cd86b70d6", "value": "1536:Iwzlfpi4iXwqOd5axRfbcnisi5flK94S+a:fxInXwqVx94nSZw9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632949, "uuid": "13526114-eabd-4bb0-9572-dfe9dab257da", "value": 63856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632949, "uuid": "fb26f243-8427-4646-86cc-6fb7ca317854", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632949, "uuid": "b45bd65d-da42-4a32-9702-3f7c7e087329", "value": "9929f18cbe2d542c85f8fd54925dd042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b760015-d587-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624606155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606155, "uuid": "28d5ca66-f960-4b19-b29a-49199673696e", "comment": "Malware payload", "value": "eab3e3f5cf5b04dbb74c7ba2bcdfe146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606155, "uuid": "ad7ba2a9-673a-47a5-ad08-4963b3364084", "comment": "Malware payload", "value": "cb16d6a37ef4b749b6413ec08795cf73edc163899c99c41d430518c244016c1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606155, "uuid": "40797a7f-8fd7-4d22-a4d3-433c66690d65", "comment": "Malware payload", "value": "1904adcfe38dae73cc6a166ae1f31695179a50ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606155, "uuid": "1ef7fbd3-a762-49df-8683-f33d591784fc", "comment": "Malware payload", "value": "4e59164638e191c463a888c5e91091b5ae66d5f3924ccb34269977ce73eb79ea1cdd3753737b43dbca209f6b3b549bb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606155, "uuid": "61100dfa-cb94-43c6-b7b6-c00a077eca61", "value": "9F04B22723A7C476C5C42230E1A1CB3B2768CD171774B646B4CA6E97BD6B28D4DBC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606155, "uuid": "31d7bea4-11e0-4685-998e-5b83c2a196ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606155, "uuid": "1d429b6f-d1d7-4559-9f60-9d892102aadb", "value": "3072:13hHSvTA1LyPl8SaylPZ99f9H8MkSUph:jyLsOd8b+991cZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606155, "uuid": "059857a2-eef9-490b-a999-6e57618386da", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606155, "uuid": "b6390ecb-3778-4e71-8b4a-eb44f940af06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606155, "uuid": "c99f1863-b6df-4e0f-b146-fa681c9031fe", "value": "eab3e3f5cf5b04dbb74c7ba2bcdfe146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962f1b19-d5c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624632157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632157, "uuid": "f227bed0-77a4-4867-a081-28761c1ca7bd", "comment": "Malware payload (Mirai)", "value": "81a7ff08950a20f22014d04040269ba3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632157, "uuid": "52185b96-bec9-4a6b-9686-d993e6f72a97", "comment": "Malware payload (Mirai)", "value": "cba1e083a6845a977d7410565d6f50b28ec362c8b2594f084a31b8bde517df24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632157, "uuid": "a8ff9272-d9c7-45d1-b1af-7a2465c1e5bd", "comment": "Malware payload (Mirai)", "value": "e30090bfe957466201f1e1111961a0bd1090a86e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624632157, "uuid": "c86a73ef-ed00-47e4-ba23-b0c814fa58e4", "comment": "Malware payload (Mirai)", "value": "8294383cea6011b40c451a83388732951c5055b17ee0fbbb17c6938c151a75d72b7517c09ce94c292727dd884f9c9948", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632157, "uuid": "62efeecf-8830-458d-bea3-f0f58fa608d9", "value": "C763964D3E319FACFBA8463457F39E10A35823D526E1CA85E19CDA011F7034E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632157, "uuid": "4c871f1e-43de-448e-a2c5-dc8170becf11", "value": "768:RzZWyvL5MsRXxPx2pqV2UFz9HX8iJ3GecFgoSERFImpPxs6vvSp+ozXeyt42egHO:OKzPxkqV2UPGecFgoSWlHs6t0egwsnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624632157, "uuid": "65ef896a-492b-40b8-b39d-4898416f56e0", "value": 71856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624632157, "uuid": "1b08ed7a-4144-4a1a-948e-c213a5d1b96f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624632157, "uuid": "56c9be9f-d5ae-4c8c-aac1-47f91ddda7da", "value": "81a7ff08950a20f22014d04040269ba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e82304e-d5dc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642828, "uuid": "10cb32bb-33d0-44b5-96ad-6c612a36b654", "comment": "Malware payload (Mirai)", "value": "f4023b275542d4a8ab0b14457ccd1d45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642828, "uuid": "da3c17fb-423f-4ab0-9e33-7d6eb722b853", "comment": "Malware payload (Mirai)", "value": "cbd53a1a67472a0944fbec5ea2e5533de91195210dba17f9f6e148038bb4ca23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642828, "uuid": "2b0dc879-bdc9-47e7-9124-63369adaf00d", "comment": "Malware payload (Mirai)", "value": "067692f37dc1f53a13b835efa0f1b44f5be2007d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642828, "uuid": "1c23994b-df49-4c74-b089-c3f1799cf8b7", "comment": "Malware payload (Mirai)", "value": "f35ad76677f8d7f6086705b88e98cebdc902809640f639a39c45966c989c4e79fc394e4e34ac97cf75541d1831defdf2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642828, "uuid": "41c7e46e-d373-4097-a8d3-78134c113cba", "value": "7A337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642828, "uuid": "c91b33de-a3ce-4d9e-9482-8c75e59d8c21", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvP:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642828, "uuid": "05c002aa-b213-4b90-96ca-143bd3c1b257", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642828, "uuid": "33005d3b-f50b-4f02-aba7-fe4d9fdaaf2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642828, "uuid": "29a7ddd5-f03d-4904-bc5c-b8fd6928dcfa", "value": "f4023b275542d4a8ab0b14457ccd1d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4b7a66-d5fa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624655897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655897, "uuid": "cce36f3e-9c10-4d49-8932-9bb66594bd53", "comment": "Malware payload", "value": "a2db9c0470adb20543dc047736866303", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655897, "uuid": "62cb1bd7-4b08-4407-87a0-93847de05114", "comment": "Malware payload", "value": "cdaaf567527bf325385e725307694e047297a2f8ae01288cf11eb6e7c8a48cbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655897, "uuid": "add2cdee-afba-47d8-a21c-d27580527f56", "comment": "Malware payload", "value": "b5c6fab21496a055b25cda928330a0949ec293c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624655897, "uuid": "80aab946-b096-4b87-b407-f525f166b1e3", "comment": "Malware payload", "value": "2b4131f9a50ce7517fdeea8ed1deb553f05633f580fbd7a62e13af8a2336bb78cdaf69b36da27106303eecdf2147e3bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655897, "uuid": "593a6f8a-123e-4556-aa01-0147e4296725", "value": "E1A53374E605302ADF09F974D4CDAE03F85825A96215D7839A2780EAD6C9F0397F6CA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655897, "uuid": "10417159-fcec-44b5-b857-3caa75fc3027", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655897, "uuid": "bd2094a0-1a97-46bd-a993-2c0445b3d853", "value": "49152:/XVybZNsmt6n1izErJuJjteaZTorVAlEzEoaorPibDWXBJ5j:voZNn6n14eOwaVdlEbaUPQax3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624655897, "uuid": "398be5a5-9300-46f5-b720-cb4875842629", "value": 2169424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624655897, "uuid": "917d3c91-6e25-45c5-80de-1b57ba93a5c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624655897, "uuid": "bfdbfd32-ea50-43b3-a362-997317221b43", "value": "a2db9c0470adb20543dc047736866303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cf29bd-d5f0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651410, "uuid": "fd8dd94e-5710-4d32-9b07-2ed5cac0d25b", "comment": "Malware payload (Mirai)", "value": "31804296866d8396a093c814feb710af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651410, "uuid": "599e1b12-5741-4b8c-9955-aa35862c04e6", "comment": "Malware payload (Mirai)", "value": "ce887601723aa483bd196ec4f32167040dffddc19e16187382b021ebf3df0f53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651410, "uuid": "bf88b90d-23ad-43eb-bb7d-28427e42f23d", "comment": "Malware payload (Mirai)", "value": "8211332526d234f7d7a3b675f782134b6ebf8682", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651410, "uuid": "47c7f75c-3b83-475b-8aa8-17be31c2ca64", "comment": "Malware payload (Mirai)", "value": "d8c679ffd4c0de022650ac984b87d9d338c9430f8c6d1a2d0ca83e941e03316cd6c6f9be0d5e65e9f7deae1f14d72396", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651410, "uuid": "6e0970d3-acd8-4f05-96f4-9984682a8646", "value": "1A63954E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651410, "uuid": "5be4bde8-4712-48fc-b458-c89c2707d64c", "value": "1536:u8aCKglaDrIjtb3stmjpYpt13dyvba7dY6UQ+eE:9H+0Jb3vyptryza7dY6RHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651410, "uuid": "ffc588b9-036a-4d04-98a0-6248b762ad44", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651410, "uuid": "18289547-aaa9-404a-bedd-3b6658f685ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651410, "uuid": "a3e1b62f-0709-43ca-84cd-789eaac6b105", "value": "31804296866d8396a093c814feb710af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33769bec-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588183, "uuid": "48281fe0-1ccd-4500-a2e9-a0ed34e55d22", "comment": "Malware payload (Gafgyt)", "value": "f2e5a92ec8ea52c0da46c0854b002ed2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588183, "uuid": "7e6ef33d-ce8c-463a-badf-6e09d3caa8b5", "comment": "Malware payload (Gafgyt)", "value": "cec7341d03a07284b8443385e017e5825ad3bdaca63a70ebd4e5362a06da6745", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588183, "uuid": "dad1f6cf-6b45-47a6-b9fb-41fb796a0dd7", "comment": "Malware payload (Gafgyt)", "value": "5ddd8a1b85828dc0ea55e5a1bc739887952ec4b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588183, "uuid": "538f6f43-5b76-4eb5-ad30-eed1971e2701", "comment": "Malware payload (Gafgyt)", "value": "77e1518c73d384de6d90f7ff3b2da59929b8a04469f29e13126cd19caed48c97d8086ec9fa5077c36d451558847afb94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588183, "uuid": "87ec187b-bff2-433f-81c2-09889ba4fe6c", "value": "F603E1B5C51F3DF4F7B799B60E9682C053B84F892B58CC8130A45ED18A57B3A72A41D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588183, "uuid": "27ec3c5d-c4ee-4e3b-9b7d-f31a2f683a70", "value": "768:sZ6C28GqjQ4SvtjeR/8XBP+1QpiA4uVcqgw0zFqA1O0uI2:Ya1tCR/8RlF4u+qgw0zFJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588183, "uuid": "a84fb0b3-9784-4ddc-b0dc-0c8c7cc03dc2", "value": 38776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588183, "uuid": "aad571b3-3f93-4d21-a0ab-d20712ecbc72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588183, "uuid": "73eb94b7-dc78-4f91-b305-22209bc3948b", "value": "f2e5a92ec8ea52c0da46c0854b002ed2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea758b94-d577-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624599657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599657, "uuid": "54bb12a7-a080-4f14-a2e8-6ac25596cc4c", "comment": "Malware payload", "value": "18dcff9c32b13136969ceed3ff62ca9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599657, "uuid": "b607639d-7d79-4f49-b23e-12989f8740c2", "comment": "Malware payload", "value": "d0517c2348fcdb575bb3a64bbf6378c794ace1bdff953d94202c7aebb62ba667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599657, "uuid": "d1e57783-fccf-42fc-9c4e-0b4d66d43583", "comment": "Malware payload", "value": "4266c67a0089067e255bb8643b30153d6bf5dd3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624599657, "uuid": "d8ad5d55-59b0-40d8-b888-d08148baf798", "comment": "Malware payload", "value": "216db29e0b98896fdb075a4ecb2bd5f13288d69c8cd6a233b355bcd45890dd01fc4130b22370fc21bc37aef6b41ee1b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599657, "uuid": "70410c01-244a-4e77-8213-73229266f2d5", "value": "2F567C13F8A214B6C6BEE13086619362BA717C6443313BD35FD4A66A6A76FD47E3D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599657, "uuid": "6719817e-9893-4281-9362-8e53563125cb", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599657, "uuid": "06d062a8-ce0a-4490-8181-20603821d57d", "value": "98304:Fx/97f+5Ot0vooSxX74T+cLxPXH1Ec6+nW3KnVp:Fx/ZfoOt0goSxX74TpPXHec6CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624599657, "uuid": "0bfad7bd-91e5-4469-91fe-0f7175ea8644", "value": 6264320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624599657, "uuid": "f91af40d-ef86-4c14-8cc5-14779da388aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624599657, "uuid": "affc79db-facc-4172-8c7d-0b7e45f4baaf", "value": "bqxcu - \ubcf5\uc0ac\ubcf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4fd9d8-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641481, "uuid": "87f2b7a7-046b-4f79-8262-b100523b8657", "comment": "Malware payload (Mirai)", "value": "9ac7cbead9f22f82504e394730bebfc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641481, "uuid": "bc084988-4862-4340-b2b5-1d08e0b41045", "comment": "Malware payload (Mirai)", "value": "d137388f8de290d13bab876897593fbbd3202f642b94abb9616073e8792d97c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641481, "uuid": "6e3cf077-7d20-4760-8a48-f194315c9d4a", "comment": "Malware payload (Mirai)", "value": "498923d616a009aeee1591467a718c4fbf3aa0a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641481, "uuid": "7598218a-8853-4abe-9a6f-c0935040f44b", "comment": "Malware payload (Mirai)", "value": "050cd4d679da0854c93511d85b446e4144d2b31c2f0b68bbf1275453f77dd110683e5b10c9b8a814c1cbe74fd2cda6dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641481, "uuid": "6cfd1e76-0090-4eb1-b9fe-901aa369623b", "value": "6BE34C46EA818B07C0D6277AFAAF424933239764D3D773068D18AFB43F8679E0E63545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641481, "uuid": "f02c7f9e-5ffa-4510-b9b3-526ad956c681", "value": "3072:ES5T+cN5QKyKXvdM8gECKiE6/RaPNIMQwHKZB5XzGLokm2LSM/9EYzd:ES9+cN5QKyKXvdM8gce/RaPNIMQwqZjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641481, "uuid": "b49e977e-6576-40a1-8b04-4acd4c098390", "value": 155700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641481, "uuid": "c176677a-0715-414d-a7fe-bc3d70676805", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641481, "uuid": "8ebcb353-8364-43e6-a4d3-d8b1a1adc372", "value": "9ac7cbead9f22f82504e394730bebfc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8bf97d-d56d-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1624594995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594995, "uuid": "c375abc1-8f35-4d44-ab20-3549110f0140", "comment": "Malware payload (Hancitor)", "value": "0e0a061ea39005090dbcf4c3eb481d43", "object_relation": "md5", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594995, "uuid": "cbb3bc6a-7b82-46dc-9492-628783e5b2d4", "comment": "Malware payload (Hancitor)", "value": "d1fc5bb2d76d2746b182a082bdaec7154f8d0a9d6de15ec4f659a31913a5bc1c", "object_relation": "sha256", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594995, "uuid": "b415152f-a0d3-4562-b95f-44190995c26e", "comment": "Malware payload (Hancitor)", "value": "b3765ae926eac74451d843f74433e5175c563a52", "object_relation": "sha1", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624594995, "uuid": "69827293-9ad9-4275-954d-e1693c37b4da", "comment": "Malware payload (Hancitor)", "value": "e59addef34585dfe4b45ae789a5b20371378c6b6db47bddd91011c039c90c5af8b2030689e5f0b38d9836beb7a2332cd", "object_relation": "sha3-384", "Tag": [ { "name": "application/x-dosexec", "colour": "#8027D4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594995, "uuid": "b825cca8-0830-490d-9457-3e16dbcaedaf", "value": "F8947B0079D1D432EAB219310F65D696537CBC540F309AEF73D83A2E9F781D2AA31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594995, "uuid": "05231641-e8a4-4b42-9cc9-c7ccf3a99b51", "value": "543ad4119209f0813a5ba22168135c76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594995, "uuid": "19c69a77-1961-403c-b3e2-493c30afe4c8", "value": "6144:f4A8eyBxGOvnKwOCd2gya6tglz2XD98v6OZrfdAOJ7BsFcKt:fl9y/OCd2yVlQSvlFOuKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624594995, "uuid": "7012ac09-7d58-496b-9e43-2b1a509cf56e", "value": 424847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624594995, "uuid": "f20d1a42-ffc7-4219-9050-d855502a83b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624594995, "uuid": "c03f496e-0453-4523-a9dc-06438317f47f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159ffa4c-d5cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624637096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637096, "uuid": "007305a6-db5f-49b0-b712-17c13a01ece9", "comment": "Malware payload", "value": "df8c0ae70c93c86d36fa7a2aa827c4ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637096, "uuid": "8dcee026-03dc-45ce-9020-458ba381f9fa", "comment": "Malware payload", "value": "d2a1375e9e0c3c8fbc3496cb6c1690e2c47d167a5cac476b528ad2c051f85a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637096, "uuid": "806ed26d-b288-4a3b-aea8-43250611f120", "comment": "Malware payload", "value": "afe39baab2ab2ce0a7f9487103c0238f139802a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637096, "uuid": "17d164fc-d0d8-4d50-9bb0-b7717ef1cbc3", "comment": "Malware payload", "value": "857624b4346e1373e2e5b0ffa43cfbcedd3733882915329112dae8c4bab76587170c05ef8c59a63b2cf023a61637a233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637096, "uuid": "1a8a2cae-dc34-4bde-ba5e-4defe19ee7f9", "value": "77D33B13FA86D0B2E42551F549026B31CEBC7C323A192173D39FC945DD79892E81AEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637096, "uuid": "c34d194a-bfa3-41e8-9f4f-d38834a8b357", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637096, "uuid": "d2ebce80-2130-42f8-aa39-ab30caf7f1a6", "value": "3072:sr85CQpsF1TbPzuMsIFSHNThy+JP/P6arkhzYTGWVvJ8f2F:k9Q2F13jsIFSHNT7P/P6CkhzOv2fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637096, "uuid": "b20cc60b-7e74-4575-a0d1-f7b1bf9af2b9", "value": 135680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637096, "uuid": "36298d0e-fcdd-4fcb-94a7-00c9bc2c5c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637096, "uuid": "7405a71b-f665-4e45-8143-a6950961c53d", "value": "df8c0ae70c93c86d36fa7a2aa827c4ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4519c5-d561-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624589840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589840, "uuid": "d74a32ca-b729-442d-b945-fbb5dc77b277", "comment": "Malware payload", "value": "cf21c0f026098a439efc5e0c130b48cd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589840, "uuid": "a0e1b760-f7f8-4a1b-84f1-96c6275e2e68", "comment": "Malware payload", "value": "d31b77ca2c6a47a09b93b89ac0bd64263ba6f33a0811befc9eda6c26d295d970", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589840, "uuid": "a138ff4b-1aed-4071-9923-ac3707c167e4", "comment": "Malware payload", "value": "341e486735f10022bd846f78b0d643e92c48a900", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624589840, "uuid": "115f48fd-25cf-47b9-ae01-169110c678c3", "comment": "Malware payload", "value": "8b831b02e04d19df47c0f394ac5d5356b0d3796ece586b6e5f5b5924d457b3a915361b7f54ef1aff927ec15d89b73072", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589840, "uuid": "fa11fda3-d40b-426f-aaba-2a7b45548f16", "value": "B366332FD86BCE46E88991A83DD8E2887A09F54F794D1B1081D0669C98834B7DC77DB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589840, "uuid": "9f75aebc-6994-404c-b534-7179bce0c358", "value": "196608:y7gp4fdwruaJCQpphCj8mgMjCR+OB4jYVD3ZiG:6LCzDPY4I0yi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624589840, "uuid": "51678497-85d8-4caf-ad2c-e0cb9659c6a4", "value": 6718636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624589840, "uuid": "2c682198-1203-45cf-a80a-58df3803f14e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624589840, "uuid": "88dfa496-e66a-446e-a603-4f3baeecf4bf", "value": "cf21c0f026098a439efc5e0c130b48cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffed81a1-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624631905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631905, "uuid": "c51188d9-3cf8-4346-9727-7f15a083f3df", "comment": "Malware payload (Mirai)", "value": "b91a9bf8bb9e3f21097f646d578b3ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631905, "uuid": "1df08eda-c9ee-4794-832d-ddff226e2886", "comment": "Malware payload (Mirai)", "value": "d36257f076fafb88e42565f8d584a5d5f5e33ca3df0aea99b6f447bd1b8967b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631905, "uuid": "3bae7fe0-a913-4abc-a08c-95482739c764", "comment": "Malware payload (Mirai)", "value": "ee4d5be1ba6ef8349cd7bdc4dd5efb9de9fd6c95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631905, "uuid": "9988f0f8-ce98-4895-9e08-a148a124a7ae", "comment": "Malware payload (Mirai)", "value": "a869a56525214207a4820f0843db9eb2d6c912bf9c5195e9a689654855125d7f36ce25606bb23a19c55fb132ec079b91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631905, "uuid": "d102b9ad-c2bc-4f1b-9ba4-06aaf722093b", "value": "9F734CD9F800EEBDF44BDABB8113090BF531A3508A930F376667FD936C620A99917D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631905, "uuid": "d0c5ccb1-c590-44ed-959e-a6fa17c55345", "value": "1536:jd41vHjKrUFbd5NNKuzekJ6zuLfOL8VWLjy4MHFrvOKGygId21N:jMnKuzeZgfOBxMHdvBk1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631905, "uuid": "f557c379-37a2-4de1-b4bc-7dd33594dc04", "value": 74516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631905, "uuid": "04d148da-d641-4d62-9142-2c1c0b82619a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631905, "uuid": "03a2b8f2-707c-461d-ba4f-89a01bf94a7a", "value": "b91a9bf8bb9e3f21097f646d578b3ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d137bb-d579-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624600426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600426, "uuid": "23129702-cbe3-47a3-b70c-665c757fdf61", "comment": "Malware payload (AgentTesla)", "value": "aea2eadadb70915541432e00bac80524", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600426, "uuid": "81187d0f-83a6-4ffe-8551-6f10ad7472e3", "comment": "Malware payload (AgentTesla)", "value": "d47c2994ff6af8149005280d46cedf1503442efd11d7bbd76c876f438e721ade", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600426, "uuid": "fdc283a6-fa65-434f-8731-501f390e70dd", "comment": "Malware payload (AgentTesla)", "value": "8681b536f5ab339bc5bc972071d93fe84e809bc9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600426, "uuid": "d79686ab-41e1-40e8-a14e-fe475633a4f6", "comment": "Malware payload (AgentTesla)", "value": "e3fc49c26836fa84b1891bffe197b0c2dde9d2a36567f5c3d2e91137b8fc5811ea94f3577c581c2c525d375827fc7330", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600426, "uuid": "31178262-dec3-4223-a99b-5b88df6a92a7", "value": "B2C423DF1A3DB102BB5B94DA6F8EC957B6D8E3DBC0DC5996CC29C4443A68C1683BD048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600426, "uuid": "d7902337-61b2-448b-933b-ce838dcdf35f", "value": "12288:JrlckZNc5ZrciRE/yRhaJKZAMe1cIMyGh6:J3c55cryRhVe1cPy66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600426, "uuid": "94de0672-6e0d-4600-b05d-55f338335ee2", "value": 587433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600426, "uuid": "e4848a4d-4811-4edf-866e-177dbad43be2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600426, "uuid": "782518a8-da66-4bd4-b980-47f89e16e8f5", "value": "Bank Slip.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92d4277-d605-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660644, "uuid": "8862555a-fca0-4f6f-a574-3a7eebe2200c", "comment": "Malware payload (Mirai)", "value": "40618c217a7ee24a7287e32859c41083", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660644, "uuid": "478a0aad-f9ad-4ae3-b539-510d3fd2726f", "comment": "Malware payload (Mirai)", "value": "d5262e8f600f8c2d9bc66fb8002451f5eae3e1b4f6b370eed79cfcf79bf06221", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660644, "uuid": "1354a369-d707-42e8-a34e-3cb5a63a555b", "comment": "Malware payload (Mirai)", "value": "18c4196d2df5a0480e942583cd7ad331748cf209", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660644, "uuid": "ced70a4a-2212-460f-8a86-836270fbc17a", "comment": "Malware payload (Mirai)", "value": "ff94a23884455b3e1c7a43c084c8fce3509e6cf2754ce9143f949f52649d6f617be8e4d59e378d96052a48e63acf13d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660644, "uuid": "20009b43-9f89-4fa3-8293-3c3d4c55a000", "value": "78B39E71D068ADD8C1625634BDB88D394B51E08442533EF7AAE5CAE650C7DE8F40EFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660644, "uuid": "4b7bc4a4-00b5-4f26-bde2-c54c636d04ec", "value": "3072:FIwOXtAGrXwCup72jVFfi9ZRi7KSEcFhWcwiq05q0Z:FIjtA0XwNaFEZRVURwv0M0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660644, "uuid": "2f6524f7-a3f2-4b64-9f1a-ecf0f64c12ea", "value": 112588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660644, "uuid": "e404a877-1fab-4b8c-ad47-0e4dd277a609", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660644, "uuid": "7f6f54d8-10ca-4f50-a2a8-d19a594a511e", "value": "40618c217a7ee24a7287e32859c41083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c9c301-d57d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602196, "uuid": "fb5acdd6-4e36-4eaa-8702-298c26a1da9d", "comment": "Malware payload (AgentTesla)", "value": "18443f5ddb7d7efcfa2ef9afacdbf6c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602196, "uuid": "97488f2c-2ea9-46fa-b032-65741795a391", "comment": "Malware payload (AgentTesla)", "value": "d71dcb4033372c29718b4946805429deca50ecedde74e761784917d771dc6e87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602196, "uuid": "daa22be2-4252-4123-9f08-666edc43f721", "comment": "Malware payload (AgentTesla)", "value": "432bb99a03bc157b2a423eaf639ecb18a34a1693", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602196, "uuid": "ef769078-7560-4e77-88e7-0b49e57ef874", "comment": "Malware payload (AgentTesla)", "value": "652f1c9bd0ee99b07605feea2336eeacd8501c7b092f5d1cf3663e32d01c37f4e3c16d516eb9d4f45cae6269c3e9c3b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602196, "uuid": "4159481d-7c0e-4adf-92e0-9aff3bec3206", "value": "9194E01867F96325E5BF5FF81A6031554BFEB1271612E44D0CE211CB16A2F40CE92EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602196, "uuid": "ba3f7646-6d65-4bb0-9cdf-cb7be548200a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602196, "uuid": "04408e3b-7df2-4829-a9a9-9d4728429d29", "value": "12288:49+fTDRDXQqBfICbC0KH63VPjHjXDxd58aS:A+f5zrfVbCvHcVPvvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602196, "uuid": "d9eec0bf-d9c1-4afc-a140-234ac41e66d3", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602196, "uuid": "cf1c4348-f7a7-4c1c-bd98-566e74525663", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602196, "uuid": "72992db2-6595-4368-b344-1fcbb9ab269f", "value": "PO-240621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd47590-d56f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624596062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596062, "uuid": "79344c0d-d602-4c25-9792-d704a57ac567", "comment": "Malware payload (Formbook)", "value": "8ce260c824c48ac230fdc6ff9ff371d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596062, "uuid": "a06371f2-a22c-4f40-b115-f134303d5603", "comment": "Malware payload (Formbook)", "value": "d871dbfcb91b7ae2e96e229dbe989a635a4a62e40c0a236e5d322169ee2e35ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596062, "uuid": "8ebd975e-64af-442a-b0ba-072999debd41", "comment": "Malware payload (Formbook)", "value": "e369687b17ec94557f3e4b7112b4525c453e978e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596062, "uuid": "29ec7c7b-8a8e-4711-815a-308a3ff10543", "comment": "Malware payload (Formbook)", "value": "0690db30d8a2be316839754beb94af3eb3f39913c7ad6e3cf19073a400c3edd6504e05b3c0fc5ab008cbd010683a8e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596062, "uuid": "e05d5121-ab7a-4524-8042-b46a35ef6f5e", "value": "6E65BF593F80378ED883DE36B8240D08EFE9B6264707D347A5A769D9DB4E466EF001E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596062, "uuid": "07a7b03a-d388-4118-b743-7684a62f2499", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596062, "uuid": "e41043c2-e2f6-4ef1-aa7d-ab8f186fd4e4", "value": "24576:BsuzLzWonnC3zl1J7t3Jh/IecwToPRJ5NYgHAcYhCuf/z6QeN1h8:d/zWonC3zB7PhwPH5NYgkCF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624596062, "uuid": "8cdada10-d114-49ec-aea1-bda5ddfb35ed", "value": 1417728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624596062, "uuid": "2f721ae5-a38a-46fa-ac3b-fe3503fa9cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596062, "uuid": "13a324c7-fc60-47f5-be05-ef228a45e952", "value": "5mal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8928ab8b-d5cd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624636431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636431, "uuid": "c2d9aabb-d9bd-47dc-a4ba-5b3c7b245751", "comment": "Malware payload", "value": "71375aa4ad00f0fb209c8f22e0090715", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636431, "uuid": "d7a79c34-a04c-42c0-834c-b37413d4ce94", "comment": "Malware payload", "value": "d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636431, "uuid": "347549bb-04e0-4cbd-bd3d-aee7646aa976", "comment": "Malware payload", "value": "d7b0255d7d98c33a30fe71543ec98d802c2a2dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636431, "uuid": "8ab9750c-2cef-4089-8e90-98a2acc17137", "comment": "Malware payload", "value": "111c9d3d81804ca0f9efd3273eacb86f3d2a9900fd8659d316eeb2103170ab1eea9b4bf1f76493ca7b6e1cc80161d29f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Erebus", "colour": "#254EC9", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636431, "uuid": "e43b5fd2-4f8b-45f3-8055-de69b92ba460", "value": "E4948C07EB43C8B3EC5300721207EFBF4972A2339826CA57E6985D28DEB59D5661D327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636431, "uuid": "91d7c075-9052-4df4-8f9b-f707dab95939", "value": "6144:hUACNIqeT/ibcxeejQB/VlTpMf5wh4rNJPAyPmzwl+jJJxV0N9XN/:h/CyToGgjEwh+DPAKBgCNhN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624636431, "uuid": "27b34190-3fb0-4c48-b9b3-762f009bafb7", "value": 429144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624636431, "uuid": "19d1fb3c-0a40-4f86-88a5-693108792a32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636431, "uuid": "4f575a34-573e-4905-bd38-ef463e5cee4a", "value": "d889734783273b7158deeae6cf804a6be99c3a5353d94225a4dbe92caf3a3d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a3b199-d571-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624596716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596716, "uuid": "7b89ae42-3b02-428a-9734-5dbe65a185c1", "comment": "Malware payload (Glupteba)", "value": "8b5d5ba784f008bb9fe0149500beb5e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596716, "uuid": "10462d87-505a-42e7-9c5a-da2e65c0ad3c", "comment": "Malware payload (Glupteba)", "value": "d8a5f706531b7ce2e2416e05269537bcd5380384d8adabe13809412e74412e61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596716, "uuid": "21f8ccc5-6f91-4bed-9101-49583307cbc8", "comment": "Malware payload (Glupteba)", "value": "1786685085a1c5370e9ebeed1ee529673765acda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624596716, "uuid": "3982a647-e051-44dc-87d5-c1496097cf8a", "comment": "Malware payload (Glupteba)", "value": "1a64d5a263b7f9aaf3ef8505e288bec97137793cfef2d7c80ba49bee6615905f27866d0c9968d64bff7ee3da7a5e57c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596716, "uuid": "64065be7-ffb4-4223-843b-5fc41a33e9ab", "value": "A0263320B660D035E47641F85DB88258963EBBF05B2240CB23EAD6F9E7356D2DD313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596716, "uuid": "d9cc2fec-37fe-47f8-87b1-e9c34a49d352", "value": "4a891687ee9846e9d6ffccd45a4930df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596716, "uuid": "18ca3709-c42c-4fae-9c99-886ab7d528f0", "value": "98304:Rc03sglfI0VowE66JqOfOKM9JIXibf+vS9MUMwAnbsT:tFlftiLfOKoJIXiKvSkwAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624596716, "uuid": "be6bb56f-40b2-46e7-baf5-adf312f37256", "value": 4743680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624596716, "uuid": "c1cec08c-2496-43ea-bbbb-97bda1716ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624596716, "uuid": "01787e94-2344-4ddd-a371-bf7ed9bd5174", "value": "8b5d5ba784f008bb9fe0149500beb5e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36acdd07-d582-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624604080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604080, "uuid": "5454a745-18bb-42b9-ac10-aa625b3b3074", "comment": "Malware payload", "value": "c98ccb6bd69e8b5a9071007e89768ae6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604080, "uuid": "78011f76-deef-42ce-bd50-65726df7ba8a", "comment": "Malware payload", "value": "d9e43e58ed63a34ad14f6c654d3d23294f5585f94777985abc5d1b8a223a1935", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604080, "uuid": "20915279-4b35-4257-9982-8a5894de7f5f", "comment": "Malware payload", "value": "6bccf3e2d0d2b1be30e63baa789c359c1852cdbe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604080, "uuid": "eb037c8a-32fb-4f6b-97a1-ab0ab8f9d456", "comment": "Malware payload", "value": "7b1d4090627044d1707ed5886e6101ff3d309c2f05e5d8492cdd40ea839506f337ef5c158f63a18e8bb7c7f7b4238a03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604080, "uuid": "4c9214bb-cdef-4e46-8b6d-6800c3639628", "value": "D8D423262D7DE127E3B2E81BCA059B094869FD543F8392F7AA943F85C179CD042DAD70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604080, "uuid": "2032893c-2ea0-4191-8a73-141fe55ae888", "value": "12288:MCaNgLbHowvzeziGz5iOIy0byIDMUO7jyQvRO5aOzVvs0chcpZlsRYUXuQxbcKso:h6LRzaxVUyMRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604080, "uuid": "8f676eab-bedd-42dc-86e5-008d0ece5303", "value": 651138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604080, "uuid": "7377e210-ebc4-4824-bbc4-24bd2c3e8b2d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604080, "uuid": "af44844e-0e3c-4b05-b35a-4e496e8a8f64", "value": "FACTURA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bad5a89-d5b8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624627254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627254, "uuid": "6c71687d-415a-4025-96cf-add130080c96", "comment": "Malware payload (RaccoonStealer)", "value": "c3f33773c998627ba7f2869e2905840e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627254, "uuid": "443705e6-6ef5-4298-b7d7-7a3e957077eb", "comment": "Malware payload (RaccoonStealer)", "value": "d9e7255ce5340bd66977f3ed25d3dbe54c275c37e79f2d87f6222ecefb710cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627254, "uuid": "d64a70be-3423-4c81-8b3c-fa81c051a604", "comment": "Malware payload (RaccoonStealer)", "value": "448ee9e9868331aa5144ad320ab0662629a520c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624627254, "uuid": "a550be6e-3f27-43b4-a1c2-190f9949bbdb", "comment": "Malware payload (RaccoonStealer)", "value": "ec1b71471e8042064f18575981965091714571dc4e0e63a17d816f21d35bf1993727bd208b0e1d689ff4ab6457615910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627254, "uuid": "be787607-532b-4a8f-90e6-74d766849050", "value": "B5C416BBF06517B3CC786D3742952E0429296E7FEB1279A7704639E5039F24E25832CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627254, "uuid": "036fb5f1-f2d3-4e5c-87d0-d249a225da38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627254, "uuid": "d05564d5-4dc3-456d-addb-0f7571524c5a", "value": "12288:KkwMwI/Sop5gPSR3I8LYWhOcdn6oroBTciuP1hHHN:KRMlqocPSR3TYwOV/ivHHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624627254, "uuid": "15bf74b9-a013-4fc8-8a31-340e9d483ee4", "value": 594080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624627254, "uuid": "434cfb9b-fa8a-4bb2-86a2-dda521beaa15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624627254, "uuid": "fe62c465-6c3e-4749-b2b0-fb874864aad8", "value": "C3F33773C998627BA7F2869E2905840E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4eb424-d5d9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641727, "uuid": "434ea733-92c1-4f52-8928-bb6c6398a8f4", "comment": "Malware payload (Mirai)", "value": "cf8d3785764e5e3fb896b305de17e7e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641727, "uuid": "247eef48-9552-4b3b-a4ca-854ba4e3ac87", "comment": "Malware payload (Mirai)", "value": "db1dcaea2b81e61895bcb47d11cc1da827bd1723bf467e4108c6bca0f7864396", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641727, "uuid": "19ab90a9-053d-4939-8ef1-96c22f9cbd52", "comment": "Malware payload (Mirai)", "value": "92a6dc70ac9a4d533c9896c5e93bf994460ea2c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641727, "uuid": "54cbb7c9-721e-4b1d-bfae-6995de6b194f", "comment": "Malware payload (Mirai)", "value": "5518249a218937684f7316eb00439225315b752041e165b7938eb045ff69fca30f4fc85d0a98d27dc23934f58f8cd0b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641727, "uuid": "fbf0ebd3-4bff-4f0a-9927-1110715e042f", "value": "0ED2E1017680FEE1C5B00232E8678A9B72257DB9D1D130FB8A3D0DF8A6E9A1D47F5D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641727, "uuid": "290b2302-2aa5-46da-8efd-32a7431a2349", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgtu9q3UEL7A:WRwynNIOQQ1KMwFLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641727, "uuid": "e7481a41-008f-405b-b246-f8c6c984f54f", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641727, "uuid": "7c5927a7-03ad-483d-a6a0-54bc4fecd567", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641727, "uuid": "952612cf-fdaf-4128-99da-81bb58043539", "value": "cf8d3785764e5e3fb896b305de17e7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e54dc2-d55d-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624588189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588189, "uuid": "5642177e-8e07-4392-b748-60229103a198", "comment": "Malware payload (Gafgyt)", "value": "bfd5c762d41bb67d74e101226a878242", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588189, "uuid": "034612d3-6d65-4fbe-ad0d-ed2cb601aea3", "comment": "Malware payload (Gafgyt)", "value": "db7c4d75bb0ab397826bddb9cf7b788a43cbcc57daa70a31ebd74499c50556c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588189, "uuid": "4215b804-3cd8-4c65-b7af-5bb327db0ec1", "comment": "Malware payload (Gafgyt)", "value": "25add8ce7ae92ea2c462679680aaceb2f70a77a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624588189, "uuid": "f1c32b89-6881-473b-bcc7-5120a914cdd1", "comment": "Malware payload (Gafgyt)", "value": "cfc8ce0270cc9e5732f727674098cdb4bae72a63515796a88d5b434b1bbb0f82f9556a3342ce84aa509580fefc5bc7ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588189, "uuid": "055040ba-fb11-4052-adf4-3b66e2b54ff8", "value": "7C030151C14BCC72CC116A34D69E1EE0B2AA3D5FE72782C1BE46C8E2A1D375D807DEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588189, "uuid": "506814a2-12de-420e-b3a4-51607e3a6b80", "value": "768:XGrvmFeadH2at5hgmrFWg6LX4UQCatdhqQ4+9rr7aNMI42tpr9OytBcTqS:X5d2at7RWtDFu7qQ9iNMj2LTOqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624588189, "uuid": "66a3ef30-384c-44c3-a11f-4a781e399509", "value": 40776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624588189, "uuid": "a38ea9fd-2d68-4f47-b928-fad6ae6956fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624588189, "uuid": "9761478a-14cd-4b71-8d6f-f0898b18c0e4", "value": "bfd5c762d41bb67d74e101226a878242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3fad19-d606-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660887, "uuid": "1571cb36-2b7c-4f1f-a275-3c2cf8dbed6c", "comment": "Malware payload (Mirai)", "value": "b2229f66af1e5e3ba269b915f2e7099b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660887, "uuid": "eb51f1ec-bd9c-4e99-9746-9626714c0a7d", "comment": "Malware payload (Mirai)", "value": "dc72a154c7508012f8a0f3b756abd805994eb4c31f44b51e0503e5f59a547f56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660887, "uuid": "dc543ee9-fbc5-49fc-890c-fa7227c72715", "comment": "Malware payload (Mirai)", "value": "47ffda2ab5b439c32aaacb5a2db93f11884f79a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660887, "uuid": "c2be1489-9ee5-49fe-a3e7-ff5c12816688", "comment": "Malware payload (Mirai)", "value": "12251999801a890a5b9992d8ce921a083456540278231708cdb5c8534e1ae31d60f46bdbaa754b19550f29cc10f69264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660887, "uuid": "43f37cdc-914b-4fb0-bde8-d4c101045ba1", "value": "DD23F29EAD4139A5C74CDC7BA96D0AA8D88472D1ABC18FA55304DC41FBDF01AF8441BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660887, "uuid": "c03c4885-306f-4c6a-a859-dd3d50476e8c", "value": "768:5BIdC4qZyM3qEE98Yac4kIPI2VLXjrjmZbty5chMrjYol1cWM:MU40yM4oI2NXjKyqmr3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660887, "uuid": "59158036-b75a-4195-a968-43c1e432866f", "value": 46340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660887, "uuid": "492324c5-5109-4489-ba17-c081086e328a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660887, "uuid": "37937629-5f9d-49d6-9a01-35ea7621db43", "value": "b2229f66af1e5e3ba269b915f2e7099b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e544b916-d5bd-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1624629713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629713, "uuid": "7ee0b142-c258-4460-9ef2-c871014d188f", "comment": "Malware payload (NetWire)", "value": "3c920fab166f834f4c0bdd7c68023103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629713, "uuid": "c693270b-f49e-4af8-b708-b791aeaf88f9", "comment": "Malware payload (NetWire)", "value": "dd10bbb6a4a85ae9ac6cf5ee9657e466ede164d19b3f40eb7c62e9083cec35d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629713, "uuid": "cb00f208-e25f-4cd5-9559-a4e4b98ef616", "comment": "Malware payload (NetWire)", "value": "3118437d4fd826916e53f67319be19f65083696d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624629713, "uuid": "c9978ce5-2ee9-49d2-aec9-a1a2a554ce93", "comment": "Malware payload (NetWire)", "value": "46f9cee89859feec9a15ca5b9dc870a8b60c96901f501414f6b28c32394a9d42def8ba093fc4edadc407c4b1711081db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629713, "uuid": "6e362ea8-dbe8-4fb6-9aee-c4a21fff6c97", "value": "62A43C2E1AF1EF7DF90AC1BB20D65D002FA0ED66A9C9E90EB77E29911F10515ED03943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629713, "uuid": "541615a8-046d-4f76-ae24-9b5919a5f32f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629713, "uuid": "ba4d45ff-22ce-4d98-aa9f-1fbe6b4861a3", "value": "12288:MLH+GTdB0ZJ49vw6Kn4VH6HejCQSbdbhR+:C+kdK49vw6F6+j2phR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624629713, "uuid": "5f77a777-23ba-43c2-aa3b-fe5a9620eba7", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624629713, "uuid": "6b1b8037-1495-45ea-9c38-0c925188a43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624629713, "uuid": "588fc58f-f0e2-4099-aa5d-e1fca16522df", "value": "Quotation Price - Double R Trading b.v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2edb3f-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624601490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601490, "uuid": "3e3d995d-f606-4d7e-a363-6d2aaefe9905", "comment": "Malware payload (Smoke Loader)", "value": "61b1be7f98dda2c776b1690824443d3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601490, "uuid": "5546d50e-aa50-4d1d-a23e-66718456b0a6", "comment": "Malware payload (Smoke Loader)", "value": "e0134766b0d0356293950129b461ae375001bd250fe3628b7f7347e1311e324d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601490, "uuid": "4615ee4f-72e7-4153-8ef4-92aa842a2381", "comment": "Malware payload (Smoke Loader)", "value": "5b2d2e9dd63ab48ace661d41c973fe79b0a979cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601490, "uuid": "8d5269ed-8338-4cdb-bf48-9fe1606a6266", "comment": "Malware payload (Smoke Loader)", "value": "3f904d3a8601818946903b830dd0932b4a35b716ade85537aaf6f2b0c06e78de27e160dad0b70e1a2a0997ed323a6fce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601490, "uuid": "efa53703-6c27-45c6-808d-fcf9e25c035b", "value": "43748D00BAA1C035F6F612F88976A36CA93E7DB05B7040CB52D5EAEE56346E1EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601490, "uuid": "3375b1b0-408e-4a5d-a69e-fb9a18677c04", "value": "a8fd13cfcead7aa4bc2d91debc97c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601490, "uuid": "e4def602-15c5-4108-bf3e-ff8f304486e0", "value": "6144:f9fWFMAG+ULJHUUThiDG0LbfqiV11+HgDG/Pp3F+qBZd/kYk:RWFMAG+ULJHUUQPLbff/4HZPpYmNkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601490, "uuid": "eac6505a-f461-4022-a23f-58666eba3938", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601490, "uuid": "f3b4f821-ed98-414e-964e-2bdd36dfa02a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601490, "uuid": "b0ca583d-5506-4205-a91d-7596a304e3b5", "value": "61b1be7f98dda2c776b1690824443d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aaeba4f-d579-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624600248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600248, "uuid": "3c2b8912-f63c-4683-aef3-e0ae87814844", "comment": "Malware payload (AgentTesla)", "value": "c28fd7faa068e454a2b8563ae997d71c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600248, "uuid": "9e513807-53da-424d-8728-302e7ccc7a48", "comment": "Malware payload (AgentTesla)", "value": "e0abd936209ec4ae37b7a286fa37d0649e849e86095824fe6fb9a57da7f17ab8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600248, "uuid": "58232774-8467-449d-989a-f82cd6fdfc33", "comment": "Malware payload (AgentTesla)", "value": "f2f1bca88de9819bf54119f786057b3cefc6b7bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624600248, "uuid": "f83ab357-1e5a-4da3-a7b7-4d52ac73b569", "comment": "Malware payload (AgentTesla)", "value": "dce8c7d7102743a8ff4d19b1ff27eb4422a89aa450187f3b40f7bc2eff4b5c8c2b2eaf96ef83fadbc4bc00dd08d32913", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600248, "uuid": "e30246f2-266c-4856-88d3-4a75d3cb5c1b", "value": "C0E4120237968721DACC0132C4E7611007F6FBC7B2B3D69E7994569A1F433EA4E9ABC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600248, "uuid": "dc04bd42-b182-409e-b3e3-68373ae3df5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600248, "uuid": "6cd4e0fc-34b7-4723-944b-2cac833b19c1", "value": "12288:iS0rXJOL+VHGiUyZ+oUc0HlphAgSvN6F4RFqJ+Miq6gK1u2vaqvfNpc64oqqB:WXglyZ+oU7p23N66S+Mi5YB+fPcV1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624600248, "uuid": "4a53e95c-e3bb-48e6-9659-f474954130b9", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624600248, "uuid": "0171493d-fd05-47b6-a3c0-efaa0a666413", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624600248, "uuid": "cdd47c82-f080-4f3c-981c-dd036dd63cac", "value": "c28fd7faa068e454a2b8563ae997d71c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfaeb80-d57c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624601646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601646, "uuid": "0eacf950-0777-430f-90a4-c6abb4b5cf94", "comment": "Malware payload (Formbook)", "value": "e872f25c7d39e0e3c5ec46a4f09ba32e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601646, "uuid": "080190b7-b2b0-45bd-9a23-6d79a7f02d71", "comment": "Malware payload (Formbook)", "value": "e197309f79a43cdeccdc0b69344a36abc6c23fb8eef66063e4eb5cc443ee9d4d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601646, "uuid": "983aec4f-c8fb-4379-bff3-2eb8fd50cdc1", "comment": "Malware payload (Formbook)", "value": "fc82f997a6c16d0e4b43808506b40372dd22f844", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601646, "uuid": "f834261f-d234-4665-8011-631421725691", "comment": "Malware payload (Formbook)", "value": "69a9721df90d195a911ab0725bc1fa4e33f4d1e488c3faf307a6dde677d4c538b9ad010b5babbb3e1892d32adea8979b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601646, "uuid": "43d63129-6d9e-4860-ac07-2e1586586364", "value": "E0B36A138D58DF93D0A887F47E034EAC7B07271DA98939EE15221ECFBE681525EC914E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601646, "uuid": "6474fb53-bbc4-489b-b8a5-54c876370cc5", "value": "3072:3LqQHoUNnZFeHru5Y6+C4lvrKKUfC7q7Q7X9gv13y3h:3uQpn7YTdCmofC7q7Q7XCv1Cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601646, "uuid": "a57e781b-c05b-4c2b-b16a-49a2a646d6e8", "value": 107684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601646, "uuid": "fc18a916-0f0b-4a5a-9b65-b24dec187a38", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601646, "uuid": "64d22f25-6daf-4f2f-bbb1-f8a8b825cfc2", "value": "P0. 556117090.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552131d6-d5cd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624636343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636343, "uuid": "e91ccb31-daa8-4d56-99c8-19410b0d7bbd", "comment": "Malware payload", "value": "8056386d591171d7b1f0a5a5e8d59c5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636343, "uuid": "acc2f372-a57b-43bf-9c2a-db0e28ef4228", "comment": "Malware payload", "value": "e2c0e25768a1b24398536bf921e5e86f9137ecc08e9eba2101fd5213b3ec0fcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636343, "uuid": "f62cf964-21b1-4573-8607-0c96d69dc2f6", "comment": "Malware payload", "value": "b5da38bf32306430f51aa45d9ae87e0f9152eddf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624636343, "uuid": "3452b5d5-2cb1-4e8b-8c9c-ea70ad001e92", "comment": "Malware payload", "value": "a1eaa9fee907198f25e23979cf129b5e398c47ea647e48778345eb903aeafb1bd01e56910a5af5587cfac6f96aa9d8a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636343, "uuid": "7530689c-0385-42ff-b493-15deaa9386b4", "value": "52C49C773104C97FE333D87D8809D2A579936D1618E5A51D66DA33AE04B232222FEB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636343, "uuid": "d60db31b-13c9-4df8-bb05-e92da77be7f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636343, "uuid": "89da947c-68ed-4e09-8a6b-1812188b11fe", "value": "12288:6lJJc2kt7Tu5IZDFAasCKKvt/BhY8egz9hfjLOEP:cJJc2MXYIZRRjtzbz911P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624636343, "uuid": "954ae6c7-f67f-4b43-951b-973e4aa44ca9", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624636343, "uuid": "65a2a44c-7618-4a1a-864e-b516c318369b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624636343, "uuid": "072da807-e599-4f2c-b55f-dbd666389e2a", "value": "8056386d591171d7b1f0a5a5e8d59c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107c70a7-d587-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624606163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606163, "uuid": "a19a193e-46f0-41ac-b212-e81fa84a63d2", "comment": "Malware payload (RedLineStealer)", "value": "6ec8c0c3fc584cfaabd7199a6c08d894", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606163, "uuid": "3ddf127c-b080-45a3-9977-24ae40123230", "comment": "Malware payload (RedLineStealer)", "value": "e31ed8b5fd12df4a533535dbb28736a90d8b2788fcbf80e0d28e771016718d9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606163, "uuid": "977c14d5-12ea-402e-b1cb-9251d92cb6ee", "comment": "Malware payload (RedLineStealer)", "value": "17ab3f5dd2c10bab6d25ef201c235c831937c65c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606163, "uuid": "85a6f0b1-d508-487c-85dd-b02694c8852d", "comment": "Malware payload (RedLineStealer)", "value": "37ac086bc8b8eff9e59b4d075c1aca815e7b8d33683013066b7bacee0fd7df7c58c12ce2d915b2b1fff69fbf9f1fd885", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606163, "uuid": "1804899d-7014-43b5-9a8e-0ab6245c50a4", "value": "3004B26663A7D472C1C42230E465CB3B2268CD270770765BB0C6BE97BD6B69C5CBC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606163, "uuid": "053fa7ce-f904-4d1d-bf88-7b67c56badb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606163, "uuid": "26aaab64-c93a-40e1-ad9b-0f49cfc47a33", "value": "1536:n+Qv7R2+x5V1msowMxTyJoHc8mxBMeG4ADUdkX3dN3FdxSm/r6qh5l41T3U:+QDb1msnYctGejzsUmOqhCTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606163, "uuid": "79613ffc-8b86-4a31-8294-1837e5fd4582", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606163, "uuid": "372cb1ed-a2de-46fc-8af9-dc55130603a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606163, "uuid": "2cf02a4e-57d7-49e9-99ab-6cae29b23710", "value": "6ec8c0c3fc584cfaabd7199a6c08d894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86c8edb-d5ed-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624650361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650361, "uuid": "0fc12412-d345-45c4-9541-97887f54d0e5", "comment": "Malware payload", "value": "61d76696223dde226e313710e7daf366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650361, "uuid": "31e43596-de0a-4ccb-9a1a-cd15b9d33146", "comment": "Malware payload", "value": "e329ef9c18dd28b50a607d6386fcee5874fe05eb3d32a603d6a751bd78e295c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650361, "uuid": "3b9e4245-7479-4167-9c9a-2fb8c4fc4d68", "comment": "Malware payload", "value": "3bee80a6e72d33a22d50ca02131df0319815694e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624650361, "uuid": "2274c37e-1431-439e-8084-1f9001ad21db", "comment": "Malware payload", "value": "04c3a625419b5aad4682b0d7da3fcfe537b54525d37ff2c510867151056c4a1f3cd4dc4699c4536b69bc476cbdd54318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650361, "uuid": "092bc377-50a5-49c7-a832-e9e5c0b88f45", "value": "1D958E223AC0807BC2333635494EE379F69EE9314EB5564762911F392E74583AA7C72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650361, "uuid": "483fc4c6-9881-4b4d-b2e6-f983592fa6f9", "value": "8c16c795b57934183422be5f6df7d891", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650361, "uuid": "ea1997f9-b684-44d2-ab1f-bded2d7d4dd8", "value": "49152:tb7F5x4FnDlfPV8a0yPwE16AviK3LRKt1hQZ4Edp:J54RRPV8a0yPt1pviiMt1hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624650361, "uuid": "4965d43e-797f-411f-aafd-ede28bce0c9a", "value": 1979902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624650361, "uuid": "087f0720-d4f2-4cce-be52-fbad09d55cba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624650361, "uuid": "cb2c5886-c754-43dd-ab24-5e642ace70a9", "value": "61d76696223dde226e313710e7daf366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb2dc72-d598-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624613839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613839, "uuid": "77ec53dd-28e6-4687-8efc-096c32f8c079", "comment": "Malware payload (Glupteba)", "value": "c72e817bb005c81eb4785954be021f15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613839, "uuid": "ce08a873-05ea-4b16-8b5e-de1fa01efb94", "comment": "Malware payload (Glupteba)", "value": "e4094dbcaad2b2a1b0d0abdaa5c937d0fdb721284242f2afb95a5e618d49c8ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613839, "uuid": "5dc3600d-4d67-4524-a269-89f98903c1bf", "comment": "Malware payload (Glupteba)", "value": "1051faa055f5291548c7a01bfad561c5de5b2bdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613839, "uuid": "cc1bfa8c-8151-41ad-9f90-942cb34f4d2d", "comment": "Malware payload (Glupteba)", "value": "c523362c7f5f5e44547cc07ee19da24cf2529e4dc723942e00153504d03fbc376a68b06f723eacc1d0063da07c4513b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613839, "uuid": "db16fa87-1abf-4c03-96e9-f2adb864548d", "value": "8A263302BAA2C076E4B742F4993297A8897A3EF14B6410CB57D2D6DD5674BF2EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613839, "uuid": "88230725-1917-4a7e-9ca3-47a257773992", "value": "bf720d2682cb81fe4c5a725cf3097898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613839, "uuid": "113b42a8-84b1-4317-a97d-e6f6a64f0ab0", "value": "98304:Qss4xhvNeHT0V9XYXkIXWPJrg/Ne4Pll2Xx6ElkvnNZwNSY3F+6fnvQw4pULCF:04nvNem9IXkZK/EKwXAEGnfwN51+6fns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624613839, "uuid": "c53995a4-9030-4b8f-8ddc-e51072a3c4da", "value": 4744192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624613839, "uuid": "f14877c4-6aac-411f-a478-bd3f0f9c0b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613839, "uuid": "4419a086-ce63-4fc4-ab63-679223bc18ba", "value": "c72e817bb005c81eb4785954be021f15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af5c0fd-d5fe-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624657372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657372, "uuid": "007cfb26-ac3e-4f13-b6b9-ebb6931e0af3", "comment": "Malware payload (AgentTesla)", "value": "8cf105975ce2827bd9679235a7207196", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657372, "uuid": "a3dbada1-2d5c-4551-892f-e87386a3458f", "comment": "Malware payload (AgentTesla)", "value": "e53c231cb72575620271a444386c8ae5df675a3da816d649ff01bfd355cec633", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657372, "uuid": "c2a02bf9-b9b0-4b4c-9637-e87cf31f51e8", "comment": "Malware payload (AgentTesla)", "value": "fdffc01b94386487428ac17b8404e4e533839350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624657372, "uuid": "2d78af9d-9a40-490f-bc43-562e8123e61c", "comment": "Malware payload (AgentTesla)", "value": "4974dfdd2263903df935ab3f1de21147b4024c84c45889ad9659cd888555ddc997217ba6e932edb10dbaef3327477316", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657372, "uuid": "6087a6fd-1e1d-4cff-8c50-01e6c32a5cf5", "value": "7DA48CAC35A435EEC42BD6BA9EA82CA4EA657477571B910A801305DD9F4CEC3CF118F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657372, "uuid": "273a50dd-86f0-44d8-84f4-58b89e0b9fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657372, "uuid": "5c918512-112e-42f9-817d-1c1de5de7e89", "value": "12288:NiVacMN1NRu7szXq5eipwKtDRIKnCasO1BdqN3g9r9:8V41W7EXq5H2oCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624657372, "uuid": "419d8779-1da7-4289-b989-5a4e2036aded", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624657372, "uuid": "73a3620a-27bc-49d0-b95b-60cad965712a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624657372, "uuid": "80e9813d-4f3e-45f9-b016-c7ee1b6b4f20", "value": "SALES ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78511167-d606-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624660884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660884, "uuid": "0b8d269c-e055-4d37-bf39-79a4ff110ba7", "comment": "Malware payload (Mirai)", "value": "194bdbe18b1ea8d7bcc143021aca8f72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660884, "uuid": "fee41118-9989-402f-bc36-89134059232f", "comment": "Malware payload (Mirai)", "value": "e5741be6eacda1b5aa9fd7f22cf439bbc38cbeb8b05686e2e8fc73c54b4720a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660884, "uuid": "f78c928c-b03c-423f-8bde-37e276004a8e", "comment": "Malware payload (Mirai)", "value": "d83e692b8edb3f30533da5ffad6fbe2b9b9f534f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624660884, "uuid": "d2938220-bdce-4494-b956-8a5ae1f88aab", "comment": "Malware payload (Mirai)", "value": "fa01a80386737fa57eeb75347a79686a43aa949f1fa36b50e6af63c31c902ff1c2eda68f14a747173e3fd5acdfe55fe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660884, "uuid": "65a4dbc4-5807-422d-b210-ef82c46b6a59", "value": "50E2E11083DE6CE0D590463AFFF8C487F347C2B8D0E961913A7D81BCE96315996AA09B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660884, "uuid": "f0277ffe-a5e9-4b10-91d2-e444e33c414e", "value": "768:MvkEPP9VSmQ2QESGktGmzXdmfREIA9qxNwz+PVQs3UozdeT:qP9VGI8Xd4wq4z+PzET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624660884, "uuid": "cf0dd755-c187-4d01-8bd5-a10f6158d6ca", "value": 32360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624660884, "uuid": "6baf9753-6bfa-42f0-ba08-0db7c81630aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624660884, "uuid": "0370baa4-2814-4ab4-8e3e-80aa60b45cff", "value": "194bdbe18b1ea8d7bcc143021aca8f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83251f1c-d5e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624646728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646728, "uuid": "b031dc39-2f3e-489b-bd20-6a060741916c", "comment": "Malware payload (Mirai)", "value": "231c45889d063ad34e862f564d9f7d0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646728, "uuid": "079136cb-43e5-4e27-962d-842d5ba21e21", "comment": "Malware payload (Mirai)", "value": "e704447ebb53b395fb42f2751e465bfa53e154b00a41702862220375469a3bc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646728, "uuid": "e7d2361f-7289-40ab-96e1-87fd6c87840b", "comment": "Malware payload (Mirai)", "value": "0b1bed8c1bceb63b097ba4868fb217e314c75235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646728, "uuid": "5f1070c0-452d-4f89-bc77-c117e4cbefe3", "comment": "Malware payload (Mirai)", "value": "545ce12f3aad84fc6dd5cfc41a86f4267d516edd7287e395e2ee8d1eac4bba640d4d0fb1b1b0fd6605ccfad2c17f2e70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646728, "uuid": "46553dda-a9c8-4287-afbe-bb969415beb5", "value": "9073C40ABF610FB7E8AFCC3749E9170525CC551A21A97B39BE30C918F64B25F16E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646728, "uuid": "fbee13f9-3e5b-44fc-b64c-ee74bf765842", "value": "1536:eqZcXQkzoyLkL4LIvhPgI7ZXq7+1v/+sZsHClWTt:eqZ6DZL+4LehPg8/+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624646728, "uuid": "5195ea7c-9d77-4ca4-a839-eb0d466b07bf", "value": 80052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624646728, "uuid": "d1b4a97a-664e-4be7-9d0f-2869bcb1da6e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646728, "uuid": "23809fb2-9c80-4de5-b255-a0f99350909a", "value": "231c45889d063ad34e862f564d9f7d0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88aeff28-d567-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624592621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592621, "uuid": "c9f814dc-99f3-41ba-85e8-15e8a56f1db6", "comment": "Malware payload", "value": "f13bd3531cb1df535a18030779af48c2", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592621, "uuid": "9243136e-bfa9-4d12-a34d-793b6ec27280", "comment": "Malware payload", "value": "e792d542a6651404bc25bcac1d64d7b2257a82fcefe047cd1bda93d284c3e407", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592621, "uuid": "745f2052-c7d3-4945-9699-8179362d3c2d", "comment": "Malware payload", "value": "9503c03d11fff1592ba7a4a22979ddd07769ba7c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624592621, "uuid": "5a648845-80a8-46f3-a2de-1fa76ba31711", "comment": "Malware payload", "value": "62289bf7876662a8e5665aa8b0cec243e1dd2a83a474e76050ac486d8b81872a2ac8d51fe7c49a76c5680062992cb2a1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592621, "uuid": "a187988e-878e-45b5-8cb9-18deca18a1eb", "value": "E1F4235DCF94B8A4D90C4930A323B5F5DCD1E11B00A6BC6F5F2181396D238EAEB3AD56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592621, "uuid": "046ca4f7-82dc-43aa-a0d4-77091db2dd1f", "value": "12288:hJE81YZHseORst0xnE/LjXU80Kzglqr78H6qdcllGx7RKzApFPQWDQhpmTCALwYC:hFfRsAE88olqrwDdcl4zKs7QWQMCcDOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624592621, "uuid": "33d6c4d5-f60d-48d6-b9db-3c012e252d70", "value": 781411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624592621, "uuid": "60448921-81a1-4c14-91cc-aeb175407948", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624592621, "uuid": "1c693c8f-4bd4-4604-bc60-4530c241b69a", "value": "dridexxx.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26000a4f-d587-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624606199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606199, "uuid": "6116bc06-6169-4600-9d2a-344c8fbaf65c", "comment": "Malware payload", "value": "de7ffc232f5bfd309e31b600ba3d7712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606199, "uuid": "b982f348-ff97-4f90-966a-98c043af772b", "comment": "Malware payload", "value": "e7fb961a557cb74e9f7f3353e0e41e7e4bf09b18bf162f927e564f125b455ebb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606199, "uuid": "610bb8ec-1779-46bb-b2ba-8a7da91d1165", "comment": "Malware payload", "value": "11cb9aad1231152d09a72cf025e58bb4b1701cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606199, "uuid": "5acb4a6b-370b-42e3-99ad-312c284b4148", "comment": "Malware payload", "value": "91c7177500a0d67a3e7976df01367a1571de019d28bd4e41b7992d0fd3fdfab4ef7851842b5d84257db819e3daec2c92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606199, "uuid": "a57b1c92-ab9e-4d84-a855-be88e0f31d48", "value": "3004B16733A7C475C1C42230E061CB3B6264CD271771B25AB0CAAE97BD6B29D4DBD2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606199, "uuid": "4ae6f6dc-30cb-4f89-ba6b-84c2cf44d1f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606199, "uuid": "d2f6c2ef-7e63-477e-a2ec-8a3cb05079e4", "value": "3072:6hDzj+IvHkjvOwimpadz/69RZN6lcJ8ie1Lhz4040404B:ynj+IvHkjvFimcR/aMY8j1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606199, "uuid": "137608eb-30ee-4c80-b3e0-6f1243de1ec1", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606199, "uuid": "dc06cd10-8be5-4f50-93bb-b6215ef17b73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606199, "uuid": "60cd6703-65b5-4700-8786-d168d2828943", "value": "de7ffc232f5bfd309e31b600ba3d7712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d270a33-d5b0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624623901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623901, "uuid": "2ed8122c-ea19-447b-8be3-a08b7b6c727e", "comment": "Malware payload (Formbook)", "value": "6d2a20bbba8a76534f7f4fc4b280368d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623901, "uuid": "fbe027c0-df1d-4851-a0b8-02674e76c550", "comment": "Malware payload (Formbook)", "value": "e84e1c4e51716ee4ae664c936d1d410586fc47f5e03876db7e6254e3e2c3b715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623901, "uuid": "d76779bf-87a1-4b03-99af-2e84013ea147", "comment": "Malware payload (Formbook)", "value": "2d173019dce8fc40b4674580abd6ca204ce106a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623901, "uuid": "20468484-55f3-4787-916a-78a263272e60", "comment": "Malware payload (Formbook)", "value": "0d6cd57370304d2a6b3476707d04677fd30223e2e1ddd4f348ed1cd57c38fd46071dcf2bc45e60ddaac661ff2cbc06d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623901, "uuid": "f766cfde-1e2a-453f-b420-cccb309cf10e", "value": "E605E0343AEA9415F277AF3DCED86055CAFEF6633703DA2A68A1038A4613B41DD4187D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623901, "uuid": "a074a3d2-0f47-4d83-b9cd-42ff63ee9c86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623901, "uuid": "e087c6e2-1b32-4a5f-ba1d-21f247053db2", "value": "12288:d51VmDTIFtUOaMrwWvzGWSE5D1kIpN7ONnkzvTNirNOVcoWU+LoreDqrOSdj8YYE:sI6hEp1TOiTNHb+LorQqrOSt8Yp88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624623901, "uuid": "bd6db900-f43c-457c-8fde-75a957d1c786", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624623901, "uuid": "cd436f6e-cdbe-4666-96c4-eab6bad16987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623901, "uuid": "75050646-bb1b-4cf0-92e9-52fae889bc93", "value": "DHL_document11022020680908911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d1d17b-d5a4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624618889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618889, "uuid": "a2c65340-dc8f-4e58-9e07-8c48a9b21a15", "comment": "Malware payload (SnakeKeylogger)", "value": "c27af507e13d7149caf01c1c51ee19de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618889, "uuid": "7465b1de-62fa-4bfd-8c28-f2dd525f9f25", "comment": "Malware payload (SnakeKeylogger)", "value": "e8d7b23035877f317d41a96871a6da2dcd0e51f245ba610e014e8a33d68252a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618889, "uuid": "366615a4-3dd3-4e74-bfa3-ad24504be616", "comment": "Malware payload (SnakeKeylogger)", "value": "9b6fdcea9b994c08c4616b8fa2222b4648c3e69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624618889, "uuid": "ecbab974-e0c1-4cc0-8e42-293371a4027a", "comment": "Malware payload (SnakeKeylogger)", "value": "58881be7b75cf13c4d4da89097f5c102f29f5df7bbb026d2e595359bc46f1e407e581bf40e90f5d761b11276fdb8fa12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618889, "uuid": "822bca02-da0e-4382-bf6e-ddd53730e26c", "value": "59059D206D9C4319F076EBBCC5B06E504EA9BE22D611C4DB26D33E8FF732941CD5622A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618889, "uuid": "0ca51805-3178-4fc4-9316-92eaa378a7d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618889, "uuid": "d884a448-2ba3-498e-9594-fe3f6da0e400", "value": "24576:zQARbNgnKxatmk1MR5IuJLm8yJ7hXh3JU:H5UhIkyPIuJLm8yXX5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624618889, "uuid": "95cad244-c5bf-46f4-8965-dc438cf3a468", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624618889, "uuid": "209f7f14-9533-4789-9647-afe03e75ff40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624618889, "uuid": "563baeb9-05a3-402e-bd22-5276981e097e", "value": "PO_001427,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2d28cb-d5ec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624649911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649911, "uuid": "5f8f83e8-574f-43b9-bffd-6f3e283f0842", "comment": "Malware payload", "value": "65bf2744a91a88f14f8d517165d94078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649911, "uuid": "40f74a10-8cfa-4169-90ab-249f6cd5a008", "comment": "Malware payload", "value": "ea38d0401d19ab6acf4fe0596ee12928a6a691d62ac11714e55360a4a894ebc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649911, "uuid": "0f08f20b-1cd5-4dfc-afd5-d8b749a7d420", "comment": "Malware payload", "value": "eb47ca7c1701e095d6d63144cc2eeec6bc44a51a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624649911, "uuid": "c734943e-58c0-4971-a446-c00daee7b236", "comment": "Malware payload", "value": "a75c8ed6b768af333003545175480e5bc650734e5052794654596555bb680233405ee53c1b06664952dfbc456cb7d557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649911, "uuid": "7a128633-17fd-481a-b946-984479102841", "value": "F8B2C05A66393901D3FF45B17256705BA92BE2192AD8702E1353EE0A5C8F2720E9FEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649911, "uuid": "a4ac96e0-d519-4128-889f-869b1b25220a", "value": "384:Gv+iD/haqPkRmdaNBtYksUQoB6l1NmKyimB6+ifMG6yAS+FXyYoXF1zh0vN8OSaR:w+iD/hUmdJM0pMiW6+i7KS+FXpUzqvNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624649911, "uuid": "4f7352b3-ebf7-478b-aba9-7de01ff05c3d", "value": 24312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624649911, "uuid": "99755900-b702-4a6c-935f-3a2b143b3421", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624649911, "uuid": "58a50274-6b48-4633-bafc-31dfbdec16d7", "value": "SecuriteInfo.com.Linux.Mirai.BGU.20951.219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ccfc45-d5c9-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624634809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634809, "uuid": "7be73b31-8486-4adc-9d3c-416a8948fdd8", "comment": "Malware payload (RemcosRAT)", "value": "87c0df5276fb6f2b4ff8583d9418de7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634809, "uuid": "a492686c-ad61-40a7-a6fd-1c58d8bd47de", "comment": "Malware payload (RemcosRAT)", "value": "ec932ebf6459a5573779cd5e579b145042897d2ad1b96c759b019df0f0486fde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634809, "uuid": "cd1800f9-ff89-49bc-be36-6cdf2363e33c", "comment": "Malware payload (RemcosRAT)", "value": "87071ddf94128c6dfe18411b8266d08678066115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624634809, "uuid": "a2d64c4c-f1e8-41d7-88a8-3100e6763efe", "comment": "Malware payload (RemcosRAT)", "value": "79c7a99a500d8cc1ac8c6049879a513c72ae0f75fd8b0fcb857bd05cf7cc22d8aaafce2fcbb1522ac3d9e29256e1d773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634809, "uuid": "53fe4af8-a3ea-45c0-b455-58cb32217f1d", "value": "B7D3E927766A81A3E85141B053647B228DFCFC76CA095D93E3C5C1811DF4EC6E06ABBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634809, "uuid": "bdff3d43-8a2e-42d1-873b-1fa9c2f3af67", "value": "fa1107e773796a494c44045d5372098c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634809, "uuid": "09ea7de3-f776-48b6-bcfe-a43b8e90a80a", "value": "3072:m4XgM0gTUJNFbnOabI/JZ7k0qvo7wvdbnrlSl26FaqmrzqhEdVA2hr5:ZXgMtwNFbOabI/qxlSl26FaFrzqhE55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624634809, "uuid": "f62e71f3-d0bb-4b31-883a-bd285963db65", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624634809, "uuid": "349c009a-22fc-4852-80a4-615ca8b781ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624634809, "uuid": "d80d3612-393b-49ea-ac7c-4af60bbe534e", "value": "ec932ebf6459a5573779cd5e579b145042897d2ad1b96c759b019df0f0486fde.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3997fea-d5c2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624631885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631885, "uuid": "d503e7b1-22fc-41f6-979b-15acc2e0ed25", "comment": "Malware payload", "value": "71099de2c757b1b6201f0cab9dd89c91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631885, "uuid": "7cdd6827-68b4-45c6-838d-a0efc29c10b9", "comment": "Malware payload", "value": "ecb0d917d89161c65bd895220f6c8d928424a2bbce325d77440934ddbe540383", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631885, "uuid": "44503d53-e770-4733-b6fd-d16a5799d391", "comment": "Malware payload", "value": "e13834df97d4208e25f384d7010d23ce0950250a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624631885, "uuid": "89659c84-7a5a-45e6-bd25-fc3a1e4cbd16", "comment": "Malware payload", "value": "1368af6114190b4ac1b143f89c522696d676598f8b4619acb388424ffd03361bbfdfe14cb99892decc5f87d579aeda29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631885, "uuid": "25131749-9ddb-4b3f-8132-df0ec024f895", "value": "7D5302899605ACB0E2329E3BE66F561EBAA94F7171DE37E25F109368F0C119F6F0101D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631885, "uuid": "7e026c32-add6-4afe-bf5f-a986566e2b14", "value": "1536:xbkdML2gpfq1emDrtZQ8oHux/lhASc3k6c:xPigvpC2Xk6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624631885, "uuid": "a15e4ead-e958-48f9-a144-ad675e31bfdf", "value": 62992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624631885, "uuid": "4dc0cf41-89cf-43e2-94b3-b5ff93aad326", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624631885, "uuid": "1cb71b80-f36e-4c36-9972-11056f41af98", "value": "71099de2c757b1b6201f0cab9dd89c91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de11e907-d5e4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624646451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646451, "uuid": "a03df257-be18-478d-863a-d946cd6f40da", "comment": "Malware payload (Mirai)", "value": "4886cf01831f1993b19c20cc8a1536c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646451, "uuid": "cca9b59e-271f-43e4-9358-ead94d5b5534", "comment": "Malware payload (Mirai)", "value": "ecff01d692a3d33b0370af5f2285dc4b744b4e21226d38923f5064deb6ef1e7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646451, "uuid": "a3ef891b-5b00-47a0-b683-5de78b2d823e", "comment": "Malware payload (Mirai)", "value": "19cbb5119ea02313fe17e660e974255bd548cade", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624646451, "uuid": "76b59c3b-3aa7-427e-8b05-59d066a01af1", "comment": "Malware payload (Mirai)", "value": "bd2683af7969343e9b9e2658cb9cfebb2217b7ac56fef0cfbff3748863ace612cb2c5c065a4b05070820541ae16cd256", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646451, "uuid": "203d5ff8-2081-4dfd-a75e-4af8020d928d", "value": "F1D34C46EA808B13C4D51776BAAF41453333A755D3DB33069918AFB83F86BAE0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646451, "uuid": "dc453510-7754-4f9f-8cbc-715c8de5f2cc", "value": "3072:Pdu7+VJz5HvqtbZnd03Yk8emYjlFYhYlXPg9M/97kwn:Fu7+Vd5iu3Yk8emYZFYqXPuM/9own", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624646451, "uuid": "9067d874-7da7-4f8e-a91c-5f796525c339", "value": 135938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624646451, "uuid": "22f6174c-c9b3-43f4-a47f-9de4b856a3aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624646451, "uuid": "b5b0b25c-35a4-4489-a563-5dad10ec1aae", "value": "4886cf01831f1993b19c20cc8a1536c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032e2ef9-d555-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624584666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584666, "uuid": "8232b4e6-e13a-46da-a448-b8e1127f17a5", "comment": "Malware payload (AZORult)", "value": "94854693853c5344cad7af0635cada3b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584666, "uuid": "cfb138b5-9c07-4915-87ce-58601fdd9dd1", "comment": "Malware payload (AZORult)", "value": "ed4d81c2e471c379a98cce49aba9fabcdbf1b56b02a8d724fb76c53bd33121db", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584666, "uuid": "1ac20c17-e404-4407-9544-241756572a15", "comment": "Malware payload (AZORult)", "value": "11be5dd9022fbd10d73c9c5297da82a6b1745fb6", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624584666, "uuid": "023a41ad-9ed3-40cd-83aa-af3c51cc2a8f", "comment": "Malware payload (AZORult)", "value": "1f5478acbf172cf80ba91adb2105ff06e0a33fa8c18759d9734570e7c56d913ecc58900ded9bf371a9c63301bc28c4df", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584666, "uuid": "077594b9-2e33-4843-8550-f2cf69c1c1aa", "value": "BC559E9713E9415BC23141B2B955BB906E76FC782B61F5173E80BCADBE303E1412A6B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584666, "uuid": "699cc7fc-60bc-498c-bbc8-686d718b3f7e", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584666, "uuid": "60bcf91e-a997-4dc4-80d3-6c8731bbd9e2", "value": "24576:mtb20pkaCqT5TBWgNQ7ayZcsLkBlWazBoSKgjfr9f16A:TVg5tQ7ayZcsLgf/Ku5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624584666, "uuid": "7b3ecc96-8d8c-45fc-9e73-4c1b20ecdb3e", "value": 1399296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624584666, "uuid": "2eb26fa2-c773-48b3-b96a-be4d2747b161", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624584666, "uuid": "3bd881ce-8b9a-4a4a-9d11-4dd9af418cdc", "value": "94854693853C5344CAD7AF0635CADA3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a75c32a-d581-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624603657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603657, "uuid": "d4a053ca-b9e9-4e90-a08b-edd0b660a9b1", "comment": "Malware payload (Glupteba)", "value": "2d50b095ae9e67d27139fcc6787365d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603657, "uuid": "7750d8a8-b623-4733-ada2-fa0a52e97df5", "comment": "Malware payload (Glupteba)", "value": "ee03c1f9d13e4a81a04a57d7d9aa6ec9bf3ed416f4e9a3dd4913eda15b1a3a1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603657, "uuid": "fabbfa3b-5aef-4646-bb88-2d2f2e2643e4", "comment": "Malware payload (Glupteba)", "value": "67e22de7fb5da170be19d28ad8c26afeb22fa527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624603657, "uuid": "c369f38f-dad9-47f7-87cd-fb8c3de67556", "comment": "Malware payload (Glupteba)", "value": "75b75fbdde9d4934a0ecbceb91784d6c2e9caf57b9cf7d30de68f48c03e0d60ed76d73475a03541e8b905539525c484b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603657, "uuid": "8b1a72aa-5a62-4703-a9b1-c838e348ce58", "value": "CA26331076B1D035F9A362F88A75A35C623D7CB15B2044CB92E1EADEC628BE1ED31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603657, "uuid": "d7e2d3d3-253e-449a-ab98-368d38a417f4", "value": "a8fd13cfcead7aa4bc2d91debc97c909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603657, "uuid": "ca9fd573-12e6-4e3c-b017-047ee086fd1b", "value": "98304:6w+Cu/9CRXpZtqJvFquJLxCeL12NVS38IMwX/Xn15h6Xayygn2K0IU:l5wCpAZ8wFXQNVkQwX/n151Rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624603657, "uuid": "3858b75e-4b12-4065-8986-fad01a17f0d5", "value": 4744704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624603657, "uuid": "a5f80f7a-bcb2-451f-a1b6-c6582230fcb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624603657, "uuid": "567eddfe-1d75-471a-be98-131563acd5e0", "value": "2d50b095ae9e67d27139fcc6787365d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c55337-d587-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624606174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606174, "uuid": "9202c21c-4398-457d-af72-5937bdaaf4c9", "comment": "Malware payload", "value": "d3d55fc7ded011f820f3e180dbeabbe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606174, "uuid": "0b1fa817-7650-4cb6-b183-e5454dd3cba4", "comment": "Malware payload", "value": "ee217c9b59c333cf854a2e6c7c8e3ecd82c36527143dfbc831ee449297e9c88a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606174, "uuid": "f10109b5-617c-4eb7-a164-aa5fcbdcc758", "comment": "Malware payload", "value": "3fb89be5465df8b27d6fa1430c3ef5bbf0770613", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606174, "uuid": "478a99d0-eece-4801-a28d-b25a09cffbd1", "comment": "Malware payload", "value": "4e5ec0bea2e431a72fbbbe8c97ab452d6d117fa2f21cef8cbdd9af04698bdf30fc8aa2d02a4061e9f3d1c8b6d1e48229", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606174, "uuid": "75d8d22d-6f2d-4301-890e-d6fad62ed7fc", "value": "EE04B32733A3C472C5C42234E461CB3B2668DD270775B646B4C9BE9BBD6B58C49BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606174, "uuid": "9a40de46-ea91-48c2-90e4-be4ba7eb231f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606174, "uuid": "e8ee48c7-04b5-42be-8210-6acc82bf4b8b", "value": "1536:JUFWYwkuAD3hvC60P8Rtr3aTt1h3Seb0Lat7O9IgGpQeS0C5xvw/fOz:aFWYjuAtvC6dDuTnh3zbyaQ9H0gxves", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606174, "uuid": "ea6640d2-ad7f-40ca-80e5-edabc96a603c", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606174, "uuid": "097934b1-b3e9-4a94-b134-ce8be5f61541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606174, "uuid": "066a079e-9922-4713-b918-ebed64e1693f", "value": "d3d55fc7ded011f820f3e180dbeabbe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e8556a-d5d6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624640445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640445, "uuid": "c2e6a11e-dd01-492a-bba6-8a62a5b0fb80", "comment": "Malware payload", "value": "7bcbb3ad8e8a0c8bdba71b620dc76697", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640445, "uuid": "d1bb98ab-c207-4044-be1c-bd685599632e", "comment": "Malware payload", "value": "eefe11c355cd75b5ccad87b33780b1039ec2fee5b9875a2f8601d6eff20e4b68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640445, "uuid": "4fed5a29-b302-46fe-80fe-5daa1efd50e1", "comment": "Malware payload", "value": "faed8cbe03064b79ccb26d6326c6828bff1ac0b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624640445, "uuid": "aaa364a9-afb9-4f06-88c0-f53d72b7b37a", "comment": "Malware payload", "value": "6575acc46dc4001bbfb5f0a1da88b8d3842ee2da121dc22aaeae7e448997c7dd3b92315e1c0959d0503cca0c866492e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640445, "uuid": "cabe5b23-a7bb-4752-9874-c0ec6bf8c454", "value": "76D2D0A3F5457A0BFE83A175036B21C3ED3FAC592EC43E0B479397A52DC2B524976481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640445, "uuid": "887d256f-e73d-47de-afac-7445ef662f6c", "value": "768:ceaM88Q/DWMGV8jj5eARHqTdqicO44D0YOK77k:cu8WdVyEpTdITK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624640445, "uuid": "9e74bb09-33ae-4b55-9724-1e481ad1bd2f", "value": 30144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624640445, "uuid": "a6899a32-aa36-4eb3-a818-3075c69e9902", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624640445, "uuid": "9432170c-6dbd-4010-8b69-d87b7ff3af55", "value": "bot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c5b81a-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624601374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601374, "uuid": "2d386738-d518-4f10-9aa0-aecb61c1e806", "comment": "Malware payload (NanoCore)", "value": "379239cddb72a22596dd8bcbffd7af56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601374, "uuid": "f097336d-7a0e-4708-986f-85f5e47c520d", "comment": "Malware payload (NanoCore)", "value": "efd200e11753ff0fdc78bcc73739ef899755f0d07a9c23fd60dbb288c91f1c34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601374, "uuid": "c19b2137-9c90-4c60-969c-1e6fe82db3fe", "comment": "Malware payload (NanoCore)", "value": "caff00bd0217c30e7a0ec15fb2784782362d8f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601374, "uuid": "ec401492-a0b9-4601-be17-fcd80bb6195f", "comment": "Malware payload (NanoCore)", "value": "1bdaa4718728906517f8ca3ec456067e721433dc60f6b66fa6da71c5d2024898cc3e27320b8251a0a787438bf9accd38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601374, "uuid": "864d720c-4828-448e-81b8-8a120272bb12", "value": "7D75B69C7610B5DFE457C972AAA45C74EA107CBA570FD203A09726DEA90EA87CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601374, "uuid": "a1d590fe-5af6-463c-bb7b-d294d49f4b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601374, "uuid": "896a4433-5d48-4b24-bda1-83e590e4ecd2", "value": "24576:YL6G+UjjKtkttWTOiY16mx3ORVRH+i+M+:y+IYktBiYlxewt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601374, "uuid": "b6f6f5db-de91-4818-8822-846f18a381d3", "value": 1617408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601374, "uuid": "0202b931-aafa-4ffa-b3b2-12017835cecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601374, "uuid": "e799077c-a823-45cc-8b67-b4bff06702f8", "value": "NEW ORDER \u00a0121120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccb26c7-d5b0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624623767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623767, "uuid": "28368213-aa58-4f11-a1d3-65f3a9538ac9", "comment": "Malware payload (AgentTesla)", "value": "88b70d0789a6ca24243a1007c1980295", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623767, "uuid": "d8ca10e5-c03d-4228-a8b7-73bb79b1801b", "comment": "Malware payload (AgentTesla)", "value": "f00512a62cf6880e69e1d3e8489ec1f84a8ed9c3aee613d0b215748729b90bb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623767, "uuid": "c0d9c90b-cf88-453c-abe3-d12d6c1ed088", "comment": "Malware payload (AgentTesla)", "value": "c795bf240f57113728d1521230195fe38419cd0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624623767, "uuid": "1a1a1ab6-36a3-4552-8f74-42702a1d25b9", "comment": "Malware payload (AgentTesla)", "value": "bed792e504aa0ab2f41c18f14e0f83fb17a4e2d3a04efbd56c2e2a4fc087cf1f3ade3a807082124e0df5e5023ac235e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623767, "uuid": "5412e694-f54e-4ef6-83dc-0ee81ef4dbeb", "value": "5D15E0302AA99566F3769F384AD0B6695BFE7F672F02C50E2890328D4733F41CDA1539", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623767, "uuid": "995ab108-3067-42df-9096-704f7ef30b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623767, "uuid": "cc5da39f-1517-4ac4-b37d-0ff0fa2f3e96", "value": "12288:RVKCJZaF75GF2ZzGWSE5D1kIpN0lCmHTwSQF5UHMzXrVuCpabjLKLS/+2FMjvLe:RSbQhEp15HUszBZiEUDUvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624623767, "uuid": "38b1efeb-568d-435b-9283-9474431a317b", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624623767, "uuid": "e0b279ef-9af3-4fe5-ba0d-f2ab62aaaba4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624623767, "uuid": "d74e1134-730f-4262-a280-1dc0b7ac9154", "value": "Payment Advice Note from 24.06.2021 to 308720.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e0c9fe-d58b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624607963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607963, "uuid": "6e67e031-1ff0-4747-91c2-8e90650d6cb6", "comment": "Malware payload", "value": "02a37e391749d5da2b3a4c8bb8e752d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607963, "uuid": "5ec702c2-0ba9-4d19-9aec-35765fc96123", "comment": "Malware payload", "value": "f24f2c5b077d2ab2160c2fb38c83949e7dd95a565eb095666f5d375a7acbdd91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607963, "uuid": "1acc8a94-3415-41a8-932f-90f7d2476a56", "comment": "Malware payload", "value": "fdb4e86182f622575fff23960d5b2904472aca61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624607963, "uuid": "3dd1830f-7bbc-45dc-be0f-68dc1be333a9", "comment": "Malware payload", "value": "803814471ba10e70359f0138a169a75bca5b79197b0375c3794f518c45d2536092881703f609461b93778a13f610ca63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607963, "uuid": "26c25944-b2ce-4d38-b6af-3a80e8b3e486", "value": "E9F3A02A23A7C432C1D42230E461CB3B3264CD1717B5B357B5C5AE6BBD6B28D59BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607963, "uuid": "90487b91-9418-47e3-a98f-9d7886130f1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607963, "uuid": "a95d9a14-cc4c-4654-848a-dc241797df1a", "value": "1536:w3FPfJu8UQa3fmgD+y9WcHMhIx3spSQn24JzggZdXiZ492KCrRJZuLDF:wZW7ugoUMi9soFwzZZdS4v0JULh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624607963, "uuid": "cc258188-3af4-4b14-b5c9-161c2327b976", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624607963, "uuid": "0a41b491-e2f8-4bc8-ad89-1d45e9021b5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624607963, "uuid": "63c74a6b-63fa-4652-931d-85c56b031e7b", "value": "02a37e391749d5da2b3a4c8bb8e752d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5928b001-d598-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624613587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613587, "uuid": "0c038f23-58f2-4328-9bb4-b12ad5483e31", "comment": "Malware payload (Formbook)", "value": "4ee86657631a3301348d222b5e8707ad", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613587, "uuid": "b061e515-6e89-404f-b331-4b29020f0913", "comment": "Malware payload (Formbook)", "value": "f4171526b06d5a9c867e81cd7d8a808fd0897209e18005fe83a969324321bacd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613587, "uuid": "cd13f2a6-5490-403b-b1e9-c10cbb564ace", "comment": "Malware payload (Formbook)", "value": "52e1421b0032ae81e5e7ac90d5ae4810029b4c30", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624613587, "uuid": "1804a02a-1c6f-4ecf-9c4f-89da87a61bf0", "comment": "Malware payload (Formbook)", "value": "c479bcce95f86ee92b0c55cc71b41b770712d52d12916746fcbc57ea0a5faf1c72579b1eb6d87eb043369c24636f39cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613587, "uuid": "b8cb7145-75b3-49af-a391-e5eb4ecb2771", "value": "8544120B77C04877E96A967208BFDB38D3AACF011A52124747D47FBD1A3235B26883D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613587, "uuid": "76afe89a-3f0c-48d4-a5d4-30f7b5881370", "value": "6144:oEtTqjFahg9Njr98mhBLW9YcXQPk10TKlvgeo2Y3hpJedCEYw:oE9f+l8mhM9fak1toXYsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624613587, "uuid": "b7a9bcef-e203-4ee1-b2f4-18ed2a97ce21", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624613587, "uuid": "4941594c-a056-4377-9b37-24ca8bd7cd5f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624613587, "uuid": "8264d90f-1a3c-41c6-8e13-eabf692510c1", "value": "4ee86657631a3301348d222b5e8707ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d8eb76-d5ba-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624628406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628406, "uuid": "b6199f93-6cd2-48a7-84ae-4efbb319cf0b", "comment": "Malware payload (Quakbot)", "value": "9d1c3e8cfdd81e91f7038f99f00e972c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628406, "uuid": "5ead561b-1ea1-44bb-94b5-9387fb9bf6bd", "comment": "Malware payload (Quakbot)", "value": "f45ed633c5efa0a43378c2414dfc19e6849971061d121bf05dd106faf619a74d", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628406, "uuid": "307a3585-2e50-4e60-921f-657f310f9515", "comment": "Malware payload (Quakbot)", "value": "51c2e65e5da781aef07817001c72a60b8e5b9d14", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628406, "uuid": "98084852-19c7-452a-a255-caa8c62e5ff9", "comment": "Malware payload (Quakbot)", "value": "e27cc0381032ae23f3e94a19a7cf69bf1132ce7f5d26c54f21ab4a605598cc9213e3157b1657b9272417e10d74946e68", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628406, "uuid": "ac8e9a28-9c02-458b-86c0-8111d75c9760", "value": "6DE38D352A24F2A3D57282381DE84E7CF53A2B06B16FBB65B8CF95BD5762E43044B341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628406, "uuid": "09453399-a09a-4a93-807b-ba45a25bf70f", "value": "3072:ImKZQmKZ3KNhPQnVbJ2O1gZMys2g4D5JhoD4ZOYJ:n4P4346PgZw9gQaVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624628406, "uuid": "d6a18176-8bc6-44fe-825f-4e1040143a1b", "value": 153750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624628406, "uuid": "4e034e7e-652b-480f-826c-d3cadf5e8fbe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628406, "uuid": "f7ec6fef-b32e-49db-a418-14cdf7032e85", "value": "Permission-105820982-06252021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e891b5-d57b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624601203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601203, "uuid": "5c3fa819-1f4c-487c-bd31-9cecc80c7b00", "comment": "Malware payload (AgentTesla)", "value": "4a90e1850fd9134416754acf4a97b93b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601203, "uuid": "8a1bce89-f28d-4824-9313-5a8072931edf", "comment": "Malware payload (AgentTesla)", "value": "f55ad48a4260c347a2f05585cbe49e675c38879ddcad77bbcf48c06d1ce909a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601203, "uuid": "02159cb8-67db-4434-a4be-9932e4a97b48", "comment": "Malware payload (AgentTesla)", "value": "f83d4d3baaecaf2ea0ec298e41d14c73d31b236e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624601203, "uuid": "d75601bb-7b09-4394-987e-8e6308225676", "comment": "Malware payload (AgentTesla)", "value": "e10d6441bbb105fc7488f6c3b12d4c61c9bbc62024acc45e2f90fa58c60aee6690442792b8e0c2735d273312bf10189d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601203, "uuid": "085d193c-1c6c-40d7-bbd3-8367b9e52e8a", "value": "FB75A59C3611B5DFE417CA72AA645C74EA107CBA470FD203A09726EEA90E697CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601203, "uuid": "bb20517d-f938-4c55-90fe-6361eef0d0d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601203, "uuid": "07f64efd-1664-4bfb-a16a-76eba2e5c3cd", "value": "24576:eURRexpz0Uns8PIwbKGaJzdW5Im8DHK8:ek+gus8Q4KGmdWmhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624601203, "uuid": "5560831a-bd2d-4d61-b247-ed90698ee0c2", "value": 1567744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624601203, "uuid": "eca9bdcd-3ab0-42a8-aeba-0f32bbb9538a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624601203, "uuid": "810bd6a7-16ca-486a-b21b-9266d5bc235b", "value": "Bank Slip and our New P.O.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020382ad-d5b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624625896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625896, "uuid": "440b304e-b74d-48e6-9b17-23b4383ef161", "comment": "Malware payload (Loki)", "value": "eb67ad4dd2500720fca510093791123e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625896, "uuid": "ca2b982e-a3fa-46dc-9c59-ae5fb153f4f7", "comment": "Malware payload (Loki)", "value": "f70c6cedc31fc0e478e038fff349e35370208d0a2ed8053646022cfc534fb65d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625896, "uuid": "73de4854-9549-4608-bea4-bdb5def71c71", "comment": "Malware payload (Loki)", "value": "415afd58beb2137529a78165f13ef473ebcc6936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624625896, "uuid": "8ef27780-e1a9-4706-b7f2-7ccae95fa00f", "comment": "Malware payload (Loki)", "value": "0a81325f2d3b1e02af428edf550903c1c9f20bb40b9491cf7391775c0626640b4fa5ea264cd859b2cfb725c23c257001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625896, "uuid": "fe1ef86b-a81f-463c-9f88-72fdd465dbb6", "value": "47A4F71986F06AFDF58BDCB652810D003DA09D2969AFFC3A776EEC510F234F5B912582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625896, "uuid": "586801ff-924b-4f40-b41a-17d6174af276", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625896, "uuid": "6047d6f0-20a5-4b15-9191-cf4be2bb9953", "value": "6144:Jdn2G8m+Y8vrFBJ8Ur+NmM7+XiA6ViAtx84PGBFXwjysqQ5tv9:b2Hm+XhBJENmM7+X7+tx84Ob8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624625896, "uuid": "ca5368dd-a27c-4dea-9fea-afbb8fe63238", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624625896, "uuid": "9f4c4e69-feb9-4f5b-8d77-011e167a3507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624625896, "uuid": "37cd010b-c996-4d7c-ba89-9bbe52d342d7", "value": "CIFL021293000424pt. sejahtera.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89950617-d57e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602501, "uuid": "c218e9cf-19ca-4adf-9852-88cb8b4513e7", "comment": "Malware payload (AgentTesla)", "value": "6c829ab9c25df17a22440c982f71c5ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602501, "uuid": "d0b0dbab-6081-49f2-9be5-bfeb15394ce7", "comment": "Malware payload (AgentTesla)", "value": "f7437bba4e59178441160b2b89e5aa94ee2afca4f07b7f1a47d5e93468de4742", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602501, "uuid": "f2e3d066-144e-47c7-b090-6aab8d575377", "comment": "Malware payload (AgentTesla)", "value": "adf6c997936b11f242086aa6d29d3b68c0c16ef4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602501, "uuid": "c6427ed2-d3e9-4b5a-a987-4cd135b8d153", "comment": "Malware payload (AgentTesla)", "value": "917f8625d86c96754d92c8ae7d67dfed90f88374d4940a49893e448a3758ac49387bd76d725413e363cee3d15429b564", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602501, "uuid": "436bdd18-c794-4073-9cc8-9165026bebd9", "value": "9A659D29A742D084F56E29B2CEE0FBF4051BBD7BDF0A5D0B11463F82707BA574A3A146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602501, "uuid": "72094b5c-3225-40ec-a455-0db2024bf68c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602501, "uuid": "d28be9e0-5dc9-4d2a-a676-676216f13f48", "value": "24576:xXjP+bAaMd3REebAaMd3Ul8X5d7hZee5tyBVSfiPU4SUT1Z:xaAaMVRE2AaMVlX5d/l58/SqkUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602501, "uuid": "698f629a-51e6-41af-999b-4e91950cf856", "value": 1461760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602501, "uuid": "29c68006-30ed-4afd-8e95-bdccf9f888b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602501, "uuid": "4a62cfb0-2c6c-4bc2-8e26-08b26c497b6a", "value": "Order_List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d4a803-d587-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624606169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606169, "uuid": "49368be0-9cdc-4583-9e72-fb0585e1f1f1", "comment": "Malware payload (RedLineStealer)", "value": "ca1a62feb27816580db61309ab443a61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606169, "uuid": "a943ec66-7c55-437d-a5d8-ccf39a17e273", "comment": "Malware payload (RedLineStealer)", "value": "f7b9325ac03957eaeadea70155fa1ab9f2df37a07af9414665b8f79c8249ee64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606169, "uuid": "550454a9-55a1-4057-848f-f5561f358a8f", "comment": "Malware payload (RedLineStealer)", "value": "81464d4f737875e4a8b7f45340d0e4a3729f92ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624606169, "uuid": "83b9bc94-4006-44b1-9290-d125b9ed7eaf", "comment": "Malware payload (RedLineStealer)", "value": "298397f82d684ab778e574de13ae047ede1f5c4bec54bb6ff17bd3baa99f2a87b5045d0ae6a733a124071309c641e06c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606169, "uuid": "c287f664-afd9-4634-8e55-a48123d7297e", "value": "328505493BD7C2EDE76430F1607B1E2A0D28DD1ED4B3A79D7A68B04FC62997138A18D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606169, "uuid": "a5745492-8157-4eb2-afde-ab290099088e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606169, "uuid": "f43637be-7b5a-4cb5-adb4-1888cd54f79e", "value": "24576:4P4O1brwerQIWONYxBqSOF7nndOLwfAyX0gV2ozVwTGhPGEd:y5rweFWONYxcSM7n5kh2VwTgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624606169, "uuid": "0a4ff4ad-2661-4a3b-a5d0-93984c9475e4", "value": 1867800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624606169, "uuid": "7cee8028-893f-488b-aae0-55eeea0b34b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624606169, "uuid": "a4a65463-c17e-482b-b930-933e12d533b4", "value": "ca1a62feb27816580db61309ab443a61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782cdc1b-d5a2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624617934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617934, "uuid": "f26ae77c-e21a-40fe-bb2e-d23ef2a13caf", "comment": "Malware payload (RedLineStealer)", "value": "e48b8c7cf59e2e6d01922e4cf90875d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617934, "uuid": "7a653ac3-7831-4f7f-b15c-cdb2851632af", "comment": "Malware payload (RedLineStealer)", "value": "f942da2bd36afd4696e8ec09663fea116fa144bb331d244f6189a700a7e82229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617934, "uuid": "8a574705-8139-4f2f-aaf1-87217b8f7f34", "comment": "Malware payload (RedLineStealer)", "value": "53334135b8c92b5c7d7bbc92510eebeb743ac124", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624617934, "uuid": "2fba1e33-bb6a-4c7d-99ea-f21d241a2a39", "comment": "Malware payload (RedLineStealer)", "value": "967e7afc558993f49c6333bf70b135fa9c66cab6758dc789dda7668e0bfab0b0243bdc6aea1440cb8979b2814334db2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617934, "uuid": "4caeb89f-d716-40d7-ae3f-91ad018786cb", "value": "9AF3A0673397D475C1C82230E461CB3B2668CD2707707656B0CABEA7BD6B29D49BC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617934, "uuid": "5a2f8095-afb6-456c-bc70-3f6a90a814c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617934, "uuid": "2afbdcf0-c9d4-48fb-83b7-9aa232c4e2e2", "value": "1536:REmb6Wd41gPKABZI/GSotyANkt3jKxjabHQaRYl1fndZDo3K:RrhC1g5ootyjjOWbHZYH0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624617934, "uuid": "8dc665d7-72ea-4d01-8b23-489830a4ef3b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624617934, "uuid": "d566a716-3fbe-44b6-8eb5-f4f5468f3104", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624617934, "uuid": "400521fd-ae3c-4823-a9cf-84b0f2bc4de6", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.5383.5799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc62cef-d584-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624604948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604948, "uuid": "46a49ac7-1235-49bc-9fe4-796f78a37cda", "comment": "Malware payload (AgentTesla)", "value": "b920b57af9c09bba72bbeea4b0a9ada9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604948, "uuid": "dda366c0-e8fc-4d5c-9fae-73fa57ef6b26", "comment": "Malware payload (AgentTesla)", "value": "fa36827395f1ca463f06226a4e8c49882454ebab18496aa47953e9f332c3f990", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604948, "uuid": "3b3c8e08-d44d-443f-9fa0-ec8ca1335265", "comment": "Malware payload (AgentTesla)", "value": "3bf24f3c2d8dd641b3cbc699220e08034a33b3b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624604948, "uuid": "bc4f238b-2975-4c81-8e8d-676b3e97c6d9", "comment": "Malware payload (AgentTesla)", "value": "2d0ad01771dad8f347f09e2c817fdcb01647cc3451191877e80da29a5953847d87d1f19d5c898b5017b9d31b55224e08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604948, "uuid": "5fb25f72-3dc8-44c3-a8a4-6683f907507f", "value": "4FD5CF0ABEC6A9E4C5B44E36C26B0AD842F5536B2372F75F56C54BF09E0121F660F0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604948, "uuid": "02abea95-05e3-4729-9ea6-c5cbd47cf7dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604948, "uuid": "700ea692-71db-4c44-8245-9ee0589b2a2a", "value": "49152:swxoCR/JHUzdsUpaf9HbF9Mfbf2Y96y22cTB:swxoCCOUs/Mfbf2q6f2cT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624604948, "uuid": "b0c5caf1-397e-4a6b-a5f2-4e80ed239c10", "value": 2893312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624604948, "uuid": "9ff2a66e-1f1a-404b-9c03-eebf08ed1e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624604948, "uuid": "a5d06209-ae14-456f-a70a-39c7aca3a1fe", "value": "b920b57af9c09bba72bbeea4b0a9ada9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7697349-d5ba-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624628321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628321, "uuid": "0d88ca4b-0273-4b2b-904c-6c555c412821", "comment": "Malware payload (AgentTesla)", "value": "43a00c2a9063e3f65aff838b8598330f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628321, "uuid": "b2d28ad7-7860-4b6d-8062-c0d2ecc9ae32", "comment": "Malware payload (AgentTesla)", "value": "fa627892abb2647ed9ed14e6d80a21caa12308d7b65ad65e9b03d7d409e9df37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628321, "uuid": "5487bc96-312f-44bb-b0dd-0e652e262609", "comment": "Malware payload (AgentTesla)", "value": "761753e8bdaa9e287877b09eb59d5f2ba73d56f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624628321, "uuid": "f7e0610a-2aec-45f9-a38a-c5d30900e25f", "comment": "Malware payload (AgentTesla)", "value": "7bc4095e7538f0d57c3d6933a893c33b08e63ac2db38dc2e81d8881d7678368297604f21af81fa85dc3859e824ae653a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628321, "uuid": "8c4b24fd-5b03-4223-b0ec-41baf56382cd", "value": "62441222E5C09CEBF282553509F94B7DFFAF9410AB12521F8B900F7FBD41586180A6EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628321, "uuid": "a7ce95d5-c51d-4269-883e-923c4b510fad", "value": "b1a57b635b23ffd553b3fd1e0960b2bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628321, "uuid": "9008c19c-3626-4a0e-acf3-d1fcac06518f", "value": "6144:sTqjF98Kpf85KCHoNPQSwHo/7YPJw1qv+ZTl02ak3Oy:sspEIKHQ8S1z0NmOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624628321, "uuid": "dd243b2b-01a7-45e4-98e3-094f5715defd", "value": 268280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624628321, "uuid": "a73df037-685b-49f1-977f-bdd6b101df23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624628321, "uuid": "43166d50-2821-4fe2-9411-0c4547c0ee71", "value": "12334,00-USD-SWIFT MESAJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c6ae2b-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624642565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642565, "uuid": "64cafb6b-4b03-4f1d-b331-513ce4ad9cbd", "comment": "Malware payload", "value": "27999726f47aca942d8c829a694e808c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642565, "uuid": "b1171129-6c38-4e3a-81f2-e66aa4ad1e1d", "comment": "Malware payload", "value": "faba45791e0e93f0898e90e7031529835466a9bacf5c65f9003b621c60d53104", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642565, "uuid": "3ac799eb-1ea9-4bdf-980b-b45f18ed1597", "comment": "Malware payload", "value": "3a56f3446020c02058ad352cd56b3155798b30ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642565, "uuid": "a58e6f4f-51c4-4448-ba16-08c8deb43558", "comment": "Malware payload", "value": "82d46800ab114ebbb6d868ebef29c7a6f1fc7b4916a975da9a36e6feabfca86362f9c056b51d2ac73f9376db48d51a46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642565, "uuid": "f464f5c1-5651-4768-a990-72b663026892", "value": "6BB2C068E59C5D54EAAFAEF65CD56E8123F03F4937E089A0705CAB609836007F91ACE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642565, "uuid": "61ed515a-6210-4cee-bdcf-71fc1aa7af48", "value": "384:sZ2w3dZZtbJaB3pM5BBW7/xCdbytymXfw/uVAfxfMOvuCJlSahWFNuGoS8M4uVcH:sxNBJadpOBBW7gyt9XQmAfxfMOvrlSaR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642565, "uuid": "ed7ed779-c398-4874-bf0b-56d8323a5678", "value": 24032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642565, "uuid": "84f83772-1222-4ebc-a09d-f820ec337e70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642565, "uuid": "d8d1406a-b444-48b0-bad3-492a89164b26", "value": "27999726f47aca942d8c829a694e808c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42bc4fc-d5ef-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624651159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651159, "uuid": "c82b5c95-3a2f-450f-be15-fa9d9514539a", "comment": "Malware payload (Mirai)", "value": "2e3ee55881f54f021a2526b763dc031f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651159, "uuid": "01bdd10f-481b-479b-bceb-69820fadd38d", "comment": "Malware payload (Mirai)", "value": "fad6d46a3e39e40268dcc94b02d263ab6261fb48dbeaa9f93a2fe8792d82cb5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651159, "uuid": "dfee1a25-f8a8-435f-a8d1-6f1c409a4742", "comment": "Malware payload (Mirai)", "value": "1831be4ebb34a20aab4185256458417b9dd6c270", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624651159, "uuid": "68a409af-0d32-4168-9abd-05456badcc60", "comment": "Malware payload (Mirai)", "value": "6ca6894a9ad6ad8db8dc63cc4d9ddffa5f383ab50e33ce7a6dbf2d09baa78d43d5ff6165e9a326deb1ccfea72c6c145d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651159, "uuid": "f643a497-a4fa-4e7c-993c-0a14ee23a1ec", "value": "1753F946FC818A01C9C513B6FA2E118E33136378E2DF73529E106F6477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651159, "uuid": "beaa71e6-f8fa-4e3d-a93e-bd23d78afe50", "value": "1536:MZntzbm91jXQAYWmEvhtqWhQczKGknVcaPUJALBIkiQ3xtZWZ:Ez6IA/mijqWOczKlVnP3xtZWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624651159, "uuid": "72619285-451f-415f-b06e-6d2ec260e8b1", "value": 63172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624651159, "uuid": "e925d3f6-777f-4aae-a77a-8a6526c282e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624651159, "uuid": "5190cf4e-3e5a-4015-b65f-79380efa049c", "value": "2e3ee55881f54f021a2526b763dc031f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fc3a72-d5db-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624642274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642274, "uuid": "895ab2cd-1a51-4713-b243-9be924f2beaa", "comment": "Malware payload (Mirai)", "value": "9fff834612eda43aa7a8ce45ed70bfff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642274, "uuid": "46284335-833b-429b-abf9-5e888c8b275b", "comment": "Malware payload (Mirai)", "value": "fda79adf9f1c9d274cd6045fdd4340e0ab150c267276a0aec9d9af0f76c2f8a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642274, "uuid": "f3baa559-8ef0-4ec2-bf53-1ffff2fb1dd3", "comment": "Malware payload (Mirai)", "value": "bced77796e7e07c4580d35c11e474a5511f08c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624642274, "uuid": "0fff0459-69f6-437a-b573-86d81811ff56", "comment": "Malware payload (Mirai)", "value": "6b5fc3ba75e6b075f0ef0604b4c13f60350941b7930fe59ba7896731718a644ee2f8b65f358cdf556d93c68ff4abf60d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642274, "uuid": "ca2c72bd-dbb1-429a-8343-03378712f38c", "value": "6BC2E1DFB49639C5CD1C5CBC209D96D116ADA3C3234B8F0837602DC8A97645EB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642274, "uuid": "802f1b13-7427-4fcb-988f-94bc44d5e1ab", "value": "768:MLCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB5Wk:oCrJgHiOJrfwmQrct3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624642274, "uuid": "41385839-f1cd-4bcd-9b77-a3a5099d4270", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624642274, "uuid": "e493ea1e-4b65-47ce-9485-60d10c5b9c33", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624642274, "uuid": "182da587-359e-478f-a276-3c7b3dfc30c9", "value": "9fff834612eda43aa7a8ce45ed70bfff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b468bf1e-d5d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624641228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641228, "uuid": "a5136770-eb42-4cf8-a72f-03048d2b605b", "comment": "Malware payload (Mirai)", "value": "dca9d67a79561d91c92b046a168a8861", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641228, "uuid": "27c5838b-9534-4c6f-96a1-97b5dc8f0f53", "comment": "Malware payload (Mirai)", "value": "fe1976ef5c13358905874c92ed7346f85bd23fe7660b102eb027b39e1fbcd294", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641228, "uuid": "38c9cc6a-013e-4b15-95a2-018f923da65b", "comment": "Malware payload (Mirai)", "value": "62366d1f69eff87e4886e823c65f237f34c839ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624641228, "uuid": "8bbfbc97-3fce-420b-98db-b80704af0d59", "comment": "Malware payload (Mirai)", "value": "ccc19d0ea01990f7b564b63cf7fe686366c13299f8b1078efaee4b9152afc76a55d63ddf061b611ad04c56033a500ec3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641228, "uuid": "86fdadf6-145f-42ea-9eaf-4fee4d158425", "value": "0E735B21B9792E27C0E0A53B22F74661B2F1574E35E48B1E3D760F4EFF2098425936B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641228, "uuid": "b2fe1554-405a-4b78-99a5-9e3f6326add6", "value": "768:DC7HyA5Zsof9ehs7n2LdKoaWMXmJbPLVGOKKFTO+75jkaDjT1tZWFBIM3:DOHySyI9ehs7n2LdKoaVchPp753tmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624641228, "uuid": "3d51ebc9-bd66-4988-8140-8e80d4333c44", "value": 75508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624641228, "uuid": "fdad9761-1447-4a5f-a058-3e28b6dcb86b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624641228, "uuid": "3a41b523-034e-4095-9d6a-0098612b88c4", "value": "dca9d67a79561d91c92b046a168a8861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096d6b74-d5b6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624626338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626338, "uuid": "4f1e83e5-9a33-402e-9d3a-801de8b33d95", "comment": "Malware payload (AgentTesla)", "value": "e8dd78af3fb601d395ff5363ad1d2940", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626338, "uuid": "8065b09e-5254-4fd5-b82f-8d64b38c13ac", "comment": "Malware payload (AgentTesla)", "value": "fed50645352598a6e0e38be14759cf2067630167b907daf307d08b66e389276d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626338, "uuid": "cd13c2bd-b9c7-48a3-b6f4-64f75c5e0aa0", "comment": "Malware payload (AgentTesla)", "value": "15209cafeec16185d73fba5b7b1747113ba4477e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624626338, "uuid": "c3acd750-705c-4e89-982d-331ee9b5abb7", "comment": "Malware payload (AgentTesla)", "value": "acfd2d3c85de788c2ca00d25bc58990673a731a47e03edb164181658651f70d8b301b000fc04863c6ee75942009f5d61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626338, "uuid": "544e482e-e0ec-4d8a-9826-b3f0b40539d9", "value": "64159D206AAC4318F176EBBCC5B06E504EA5BD12D611C4DB2AD33E8FF732941CD5662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626338, "uuid": "bddba7ed-ecf2-4f76-aedb-d5359429a0fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626338, "uuid": "98acb955-576e-4cc7-bd62-89bf0cda238e", "value": "12288:LdAlhJZaF75GF2AixZeyQ3K6KmfvAn70tUvB7xdNbP0hn9aFb1YlO/zHhZMA3E:pAebAKZeyc9FA70tUv3dNj0TcpYlO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624626338, "uuid": "77cdb456-edbd-4a7c-9af9-c68daf5e26ab", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624626338, "uuid": "3986edf3-9f77-4db8-9c2e-94818d92c0dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624626338, "uuid": "fcfda2e3-6e7d-4403-bbc7-bd7554e25680", "value": "Handy vessel spec and descriptions.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eaa500-d57e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624602550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602550, "uuid": "8430bf95-4807-4bb5-939e-a4fcb88b4646", "comment": "Malware payload (AgentTesla)", "value": "adc89609aeb710dfe945804b298ae604", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602550, "uuid": "e02aea61-c223-4ebb-8519-2c160135a2b7", "comment": "Malware payload (AgentTesla)", "value": "ff5ce51b7fea95d86a55db923686ce3be99655a3e0bba25d12dc21272edfa8f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602550, "uuid": "29e29392-46d1-4daf-9b69-17e683919e78", "comment": "Malware payload (AgentTesla)", "value": "5a4ed44cd84ee60a2c6ab12f9f10049ea06c7bb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624602550, "uuid": "08edf198-ff59-4028-9bb1-1e35025cff9f", "comment": "Malware payload (AgentTesla)", "value": "b8b06439765060d81e26ecea49bafbe816098f4aee45c3657ad53157e09596aa34f8ade84c41e265b4b17fc695f75bd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602550, "uuid": "cac8def7-9b6e-4303-b5e9-e2423d1ce9ec", "value": "4705237092A5B106FED1E021C285007B1351385227E517AD7BFEEED6FEB96011BAC4EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602550, "uuid": "bc46f860-3b9e-4718-87d0-5d7d35aa4e7e", "value": "24576:XLan42cv1gYsW5ulFlXS3hCutsjcrdHI3c2:b2pYUlFtOhuj2512", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624602550, "uuid": "bbcde4de-49b4-401c-a630-cb903a188930", "value": 835846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624602550, "uuid": "64bef970-a47c-464b-8f27-b7cd8b01da35", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624602550, "uuid": "3ff825df-42ef-4d61-98d5-7100c07a1490", "value": "COMPANY-DOCUMENTS.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e7d732-d5cf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624637103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637103, "uuid": "b265fd07-a1e0-4a28-b427-4ef7c349b43a", "comment": "Malware payload", "value": "dc92ff1b7a14d65571e1d8c26f4f6f31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637103, "uuid": "943fa57c-b145-48bb-89a0-6fe8f78931c0", "comment": "Malware payload", "value": "ff91b720363ded7601beba0c3b9f73c4cd677c79e88f9b82113073d0691df7a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637103, "uuid": "a4da67a6-8be3-466f-995e-89687674473f", "comment": "Malware payload", "value": "1c1966203f98ce9a5bdec4aeaa7d576a754d6934", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624637103, "uuid": "4aedc855-ed38-4cb7-ba98-52b4fbbfc07f", "comment": "Malware payload", "value": "740cc403b1809f2dc791592c163c336aed063275094b02af10ec3a7650432a91018af1824f3542b1d37e3bb713914750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637103, "uuid": "62d3c7de-a26b-4582-a976-5db7e051e609", "value": "28846BBC36A035EEC86BD6B99AA83CA5EA657577530B8206801301DD9E0DBC7DF105F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637103, "uuid": "815ea053-414b-41c3-b7c1-fb2a5161bc22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637103, "uuid": "2e8e87a5-d1f3-4763-af9a-26dfd26e0e60", "value": "6144:ZjFGaJft0N5x0rvgz+o58AX+BYbctjxrYm7uAFMYt9ofYwK9:vGaJljrvEsAXXbeQAFMYt9ow/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624637103, "uuid": "8f97a028-3145-4c06-82fa-9a81393d9358", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624637103, "uuid": "0c07621f-f3d2-4276-b1eb-f42f3c82d9fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624637103, "uuid": "68bce9b1-3609-49a8-b4ba-4b02ac6e0994", "value": "dc92ff1b7a14d65571e1d8c26f4f6f31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }