{ "Event": { "published": true, "date": "2021-04-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-04-12", "timestamp": 1618272181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b062e018-3268-436b-a0e0-ef3925464fab", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf8ff6e-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618236186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236186, "uuid": "e542ccde-1633-4803-b988-4cb946db32ce", "comment": "Malware payload (Dridex)", "value": "fd27ad11f1103f046760a3389a5f9fb8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236186, "uuid": "39d02489-4f3e-450d-a062-c74de78a662a", "comment": "Malware payload (Dridex)", "value": "0001c0eb535d2e40cee0fefae32cbdc84826e641337f293f312544210b0fe069", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236186, "uuid": "c6b27689-7a32-4fc4-863e-56e313cb182b", "comment": "Malware payload (Dridex)", "value": "926ac826c653efc38ecdc5b526a9be177d0e62db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236186, "uuid": "6cee19da-e82c-4782-84a1-d5d6667ec034", "comment": "Malware payload (Dridex)", "value": "ca6f996bede41096b82c0609d0429ad9aae617b78b8638e28d98cfca953a58072f528d11f646b637bb6e71525a578eb2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236186, "uuid": "02e1a7e7-087a-4567-89de-243a1ccf9e4a", "value": "D5730290636C46E4FE994732036B7B6811D5272CC7548DB5E4894F9C13BBBF0E290AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236186, "uuid": "1bd74726-d655-4bbb-8f0e-913250b39e20", "value": "1536:U1Nw92jqnt/K2XGbmX5yoxeaqz6fNiYU2JfB99nHrljQj+:282ktxXZXN5qzYiGfBfnLSj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236186, "uuid": "70dae8d5-9e08-4aef-b79c-896f08c74ebf", "value": 74346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236186, "uuid": "84bdafc9-c4a5-4dbc-81b3-efcb74963eca", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236186, "uuid": "fe4dade2-5ea4-4491-8dff-d5d13aef6c04", "value": "catalogue-98.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c52744-9b75-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1618221354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221354, "uuid": "52c58d37-1586-44da-a4c8-38a58af8249b", "comment": "Malware payload (CryptBot)", "value": "e3959205680c393688204bb538de523c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221354, "uuid": "b8dfb579-c5d2-4f72-bbbe-ecf347249086", "comment": "Malware payload (CryptBot)", "value": "01ad122315fff76fde6444be3cb0be1ffa1acc7f56c07840c1e38ad90b374732", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221354, "uuid": "c9cd258d-1d50-4789-a176-d5df7e85eccc", "comment": "Malware payload (CryptBot)", "value": "3b196eed10d3ef00d6ead56639c11650b56e83a7", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221354, "uuid": "4e0bfb4d-fce8-41d5-bc22-bdec5fb72ac9", "comment": "Malware payload (CryptBot)", "value": "e868fdbce0de8b2da5aaeab3abfe1b906eda98992a43eb06360360ec2b7cc5172b87a59201b27b58ec192e1524889270", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221354, "uuid": "a13ea9a3-9c73-48e6-a1c1-45e14a735a08", "value": "A6951240F9A18072FA65063515C3B6A2CC6CA9A1471589D78BBC2B1F3F736C09BBD4DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221354, "uuid": "ef626e79-6a92-4bf8-ae4c-81219d44ae74", "value": "2b914b6fd04316572d777593dc737715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221354, "uuid": "1bdd1d00-0254-4104-804a-735a3139b167", "value": "49152:tx4t969lXp6GjEcsE+4sMq6Kl1PoDE6H1dT+R0:t+L69lXseEcbzQXfQIA1dM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221354, "uuid": "471ccc8c-15d9-49da-9763-342cce667803", "value": 1897708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221354, "uuid": "8a007666-c839-48e2-8b49-c8a27839b8ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221354, "uuid": "12f44a87-5afe-4b4a-a104-c82b749317ce", "value": "SecuriteInfo.com.W32.AIDetect.malware2.24893.4678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9305f1fb-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207740, "uuid": "4f449cc1-a38d-457d-acb2-9180c757fe93", "comment": "Malware payload (SnakeKeylogger)", "value": "7f329a52b5932689bcdce1207abd9d43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207740, "uuid": "304ccc06-152d-41a8-a352-73c051a9b1c0", "comment": "Malware payload (SnakeKeylogger)", "value": "01fcd3d00a95ca327a2a993b44a1b2abf8a0f5f8cf0a8539ae7847ff5cc0a6b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207740, "uuid": "9dd09057-0cf7-4cc4-b0f7-97d67fd614db", "comment": "Malware payload (SnakeKeylogger)", "value": "19d1ce3c0c88acba239603e2f0ea1e71fe0cabce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207740, "uuid": "2515b917-83f3-40a7-a293-9297443738f1", "comment": "Malware payload (SnakeKeylogger)", "value": "626aaafc86f368a795c3a660aa267f80816228379c071c9d0d670e6e95f1d3872b985b6754b3ea7d1ba2b7397259eda2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207740, "uuid": "38f7590c-9b44-4ad0-8938-8ca14b1b198a", "value": "BA15F15131AC82D7E5BD4EB2696AE13013F4799DE28AE10F3E8A77AD20B3341451E73D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207740, "uuid": "dd115f3d-bc65-4d9c-909b-869c417a43cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207740, "uuid": "fc803997-c3c4-47eb-847c-75ced00eb9d5", "value": "24576:o5iUB46Q/hZiwfn4p54uZiBqO/X+MkVlWp:EJBOJZiwf4b489M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207740, "uuid": "10b0faf1-fe36-48be-86f1-e47275f4e7b5", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207740, "uuid": "cb1546a3-332e-4a5f-8bf5-608bdd32e847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207740, "uuid": "fd1c640e-0efd-42e6-ab75-72c1f5b42afa", "value": "Confirm Order for SK TRIMS & INDUSTRIES_DK4571,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eea379-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207368, "uuid": "c9bcfee3-39cc-411b-a2a6-256a0c39b636", "comment": "Malware payload (AgentTesla)", "value": "5215c34d44dd7cdb3c93788dcbb1a86e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207368, "uuid": "22f6dbe6-01f3-4207-ab72-feae5dc1f771", "comment": "Malware payload (AgentTesla)", "value": "02a881faa81fd48121fd964105ef120bf0eac5ad632e666d6f08f370eef3bb1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207368, "uuid": "a860fe80-7e10-4180-a9c2-72a67daf0bd1", "comment": "Malware payload (AgentTesla)", "value": "62f47fdc5915b3d26e2ea6c555169244070e8756", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207368, "uuid": "cba7a342-ba85-4120-a3ac-88dd2eeffafc", "comment": "Malware payload (AgentTesla)", "value": "f8e9537f0e9ee818e0315a76a7f2b538142410e623664583e287516c5de05b01fb47a909da379606b50feb39a8348428", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207368, "uuid": "34217874-1946-4d49-bfeb-2b539a2804ad", "value": "37623AC4A7E58F7EF57B1FF86DB101304330FDA59E228A4ED5D439558A02BC64A83B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207368, "uuid": "1934878c-7c2e-4037-b438-2c9cd2870090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207368, "uuid": "7987ef30-0467-4031-93ad-8e51a54ab7e1", "value": "384:O8e4NLfxuH0W4PLCUd7S+0OJOnmDfUdZmZhcXI2x7J:O8RgHKjNS+BJ9kmZhcYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207368, "uuid": "783ac71a-1518-44b6-955a-c51271b8ce12", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207368, "uuid": "4cc63d3a-bc89-47ce-8dd5-002adda6cb95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207368, "uuid": "d32b75de-8326-4474-b238-28bb3bd25008", "value": "MINUSCA P01-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbb17c3-9bcb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618258355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258355, "uuid": "d58cd3b7-b82b-4088-b489-fe13d83d45a3", "comment": "Malware payload", "value": "e39ef4085f96febf563533a194e439b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258355, "uuid": "e5682971-7c59-41a1-9bab-a7918644292d", "comment": "Malware payload", "value": "0394580715de8ed79dd36fa74a54305856a673d673bcc9f1c7e83f1504d204b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258355, "uuid": "f6f5955e-9682-4a45-beb8-f989aca9f098", "comment": "Malware payload", "value": "27a659dcad05d7ec578f863bf72613b7ea03f022", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258355, "uuid": "9b176935-78f8-4133-9c96-0d890ced5fa0", "comment": "Malware payload", "value": "bf45d5f3baab7f74bcb1efd56087ad9ca9910f7a2ce655273ea5703574a44e02f6d252e6aa6c4c02d1ba346a32d42ada", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258355, "uuid": "7b6716ae-76c0-43c8-b8dc-640d91411405", "value": "D7E4239A626F1950EBED780FD2F09C82D58DC3CA719FD282972A764035717868CCE64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258355, "uuid": "0112b22e-1418-4edb-a96c-14e2f60e40eb", "value": "12288:SwyvjEeQpoJH5H6yamxWWhdnNsdwbQTaYO0J7cvCHvcHWoFM7wdj/uI:SwyvIeQmJ5H6FmxWyrMTZ7DHzej/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618258355, "uuid": "be467608-b663-4341-8e6a-a558aad08843", "value": 684071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618258355, "uuid": "684324ae-2734-4a4c-abd4-14c6696c6504", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258355, "uuid": "3b3a89fd-f8e5-484d-bd84-e083caec2e3c", "value": "BILL-OOO566876.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96563a2d-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618209464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209464, "uuid": "fdb38762-67cc-4a4c-be1b-b25098ce577a", "comment": "Malware payload (AgentTesla)", "value": "4cc9685436e98a105b681a9ff8f55e4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209464, "uuid": "7208a29a-a6a1-4c41-aaa6-3cdae3bda9dc", "comment": "Malware payload (AgentTesla)", "value": "03a0b982c9e44d1a34162e8ed00cb7ac6e5d77481358a792b6fae8c4437424c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209464, "uuid": "96a35506-435a-435d-b756-27e1aa20e58f", "comment": "Malware payload (AgentTesla)", "value": "441ea1358bc8106c28259f06ddbc6984fc82dbe0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209464, "uuid": "7161ae8a-cd60-47cc-9717-05b2beffd7cb", "comment": "Malware payload (AgentTesla)", "value": "a77285e26cba89b2b9ff90f9ae8745c5cb9931e38c281f37c745d36de7d855d5f72a49d24ce02bbc92075ef59ef6470e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209464, "uuid": "4aeb06de-bdfa-4815-a585-7f09f849fc82", "value": "AC157CAD725076DEC867CD3289681C60EB60BC7A430BD207606735ADAE7D997DF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209464, "uuid": "20765a50-1f21-4bc3-badd-f591790ec2ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209464, "uuid": "552a9c87-ffb2-4809-9dfb-22a3fada2e6b", "value": "24576:Kwjp2qgWGf4BodSLt3jZLqlvZEXFC+52rY:K+21aeURjZk6Xw+52r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209464, "uuid": "801d7e42-3288-440d-a7d1-4c4efd0ca4d0", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209464, "uuid": "f94f09ef-fb45-4a6f-b770-954d867dbcf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209464, "uuid": "953788f1-3db8-41e1-bf78-8adf98580426", "value": "4cc9685436e98a105b681a9ff8f55e4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e89e4e-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618206508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206508, "uuid": "b3446d47-ea31-425f-83e3-c81f7b50890e", "comment": "Malware payload (AgentTesla)", "value": "92900a4f990e061479a7dc729b2e3065", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206508, "uuid": "2ac196b6-b095-4e4b-9c2a-1290e5a037cc", "comment": "Malware payload (AgentTesla)", "value": "046347a171ee5c8a69d55140709a656d8df36db8308f60ee54ae2680089d2c0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206508, "uuid": "290bf8e1-8065-4db4-9a7f-b4144bd566c8", "comment": "Malware payload (AgentTesla)", "value": "5b3c11bb508816198d3be859261229bfd96e1e68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206508, "uuid": "0b19984b-b3d0-45a1-80b6-aa3e278560a6", "comment": "Malware payload (AgentTesla)", "value": "b284a4e00a5c1c88cdba28a70acff1e37a85d35da5999b03d30868da3aa0fab39e40cc301c6889a694a0b12d20b1d6aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206508, "uuid": "392dc0cb-8e9e-4591-aad7-84b640ac57ed", "value": "6AF422291B888B1FC6BD55FA4529CD7067F9DC930B23E6906ED53C9BF2927C9030A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206508, "uuid": "9c08c6af-0144-4604-8c91-89354bd07dcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206508, "uuid": "5b381116-064a-467a-b648-75b52b6cabc3", "value": "12288:eoOwJlvVF5bA+jgyeD8Q4nIEptIIlh3+VvglQkU3qL3ZXLEbgu42DSRKU:TOwvv5bfGRgGIlhogQknXLCgD2DS0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206508, "uuid": "ef992938-798f-40f0-ba88-e6d110ec33a3", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206508, "uuid": "990c3702-5258-4280-94dd-3ea19d09a9a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206508, "uuid": "fdf276ce-2c5c-4e70-bfcb-6a928b03d233", "value": "nunu$$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd58c419-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner)", "timestamp": 1618225045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225045, "uuid": "60a969cd-b2ff-4b11-9c9b-ca8f25fb238b", "comment": "Malware payload (CoinMiner)", "value": "3dd67172b554e2e8318cca1cc2d76bea", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225045, "uuid": "220f0df4-2af5-4fa2-a807-0969eb318bed", "comment": "Malware payload (CoinMiner)", "value": "0831e816eed7c38009e527b864c94d26d506433f5b35d57b16af16b60de172dd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225045, "uuid": "c3cbef2e-0932-451c-bb4c-717851ee4821", "comment": "Malware payload (CoinMiner)", "value": "9792719af13ba00a10bfbe3cab5c3c7be403c897", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225045, "uuid": "759a47f7-144d-496e-89fe-763a03b3963e", "comment": "Malware payload (CoinMiner)", "value": "8cc68ef5230ac3e41c75b105ddff0486eb172cdffa486817013d96ab90a43f6eb8b8fb6e1523ab81f9d3890ba6e3e7a7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225045, "uuid": "1b0d731a-2e08-4949-8027-23b2cddba9b8", "value": "A895336224D8F2DDF3CA40F33CB8D177D5F3B179DA66898E370BA45258A67A10B612C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225045, "uuid": "e8a6d142-49db-4d7b-8a63-0632c3088d19", "value": "49152:EwHzqyHCgyf0/PTUcXvJYMHYRMvhCXy1pc:EwHzTH/q1ivJjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225045, "uuid": "88412b76-623d-4547-be3f-7b40b6e09adb", "value": 2039808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225045, "uuid": "723c62d4-c0bb-460d-a6a1-433e7ee6eba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225045, "uuid": "7127be6e-5944-4229-82d5-650afb37129e", "value": "SecuriteInfo.com.Trojan.MinerNET.8.21400.8741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cae2ed9-9bb8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618250062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250062, "uuid": "a5a56d00-b62c-43d4-9e56-820dc84e095b", "comment": "Malware payload", "value": "6c54e58f560f981ba8c52ba32f46c37d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250062, "uuid": "80ae3e75-7e4a-42c0-a6bd-ca024aa82463", "comment": "Malware payload", "value": "08da04343342bd62a587c5cb2b6e1b0e241dd163a317d77a297f964da2f216a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250062, "uuid": "99f345ba-299f-48cb-b4c9-63edf2bffa5d", "comment": "Malware payload", "value": "f621b7376d1572dea9fd8594d82984a9e46afda5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250062, "uuid": "e45719e0-35fd-4a1b-a825-e320fb0e183c", "comment": "Malware payload", "value": "7a11f892deb0948d04d1802e33638ecf94058c7f6d02802b087167105c4fb7cefe9a832fdebd7083e0f5aedbd5a08df3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250062, "uuid": "0420f9de-a1b7-4b05-8098-13307b763748", "value": "89F49E21B6A18837C16E1979DD1B53E8EC36FF10FA64A90A6BF41C485F387907A352D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250062, "uuid": "7762606a-86b4-4d68-9f70-9179e30710a4", "value": "23399c21b0aa604a8aa13da9702198d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250062, "uuid": "8fdb6443-bd00-46ae-a731-187e61338a82", "value": "12288:XjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c0QKRmp:XjMmMH8XEgfqFDd0QK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618250062, "uuid": "a9e4aa29-18ea-45ae-b4cf-dcb467b9105c", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618250062, "uuid": "4c2f619b-4736-4888-9184-0f7b7a25ed5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250062, "uuid": "71b1ffe3-b8c6-4a01-bb1e-883f22fc0992", "value": "Lista de orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5db65f-9b47-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618201530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201530, "uuid": "72eaf66e-948b-4efa-8b9c-9d22e49d0de3", "comment": "Malware payload (Loki)", "value": "4246f4d99013319d5b1773c0236fa959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201530, "uuid": "1cec61a8-3da2-4df3-9ae9-d139b625de92", "comment": "Malware payload (Loki)", "value": "094f75a1441b389d4a5f3858ecb3993635cb9d30576fc9543f03ce2d69186656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201530, "uuid": "1fb68948-5bbd-4f07-a66b-e3c01b3842bd", "comment": "Malware payload (Loki)", "value": "a83d56af0e50d58b67cbdc6e0ac63c48f7516ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201530, "uuid": "a1277889-910c-4ef4-a79a-533fda1560e1", "comment": "Malware payload (Loki)", "value": "0b4f992e2e7ec4645fbe123b008f6a1d4fd2bb32eb1534fe1966b3145f7a78cbd3722874a61091b14d517476fa7f0bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201530, "uuid": "462d4a0d-3b89-4e5f-80bd-89843d52f57f", "value": "DE452A69B301E0CCF95E5472CEA0BEF05516BC6BCB0B5A0711573E85B47F99B8B3A092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201530, "uuid": "41c49287-24e5-46bb-9e52-97fc80a2efed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201530, "uuid": "be472889-4323-4b61-a5bb-fd3fb828fe77", "value": "24576:ieOGg5aIEBJ/SSoquYgZFO6AWTnMhEst:id5aIEBJ/tuZZFOnW4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618201530, "uuid": "36cb18bf-1523-4f25-ae63-52b589c83dae", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618201530, "uuid": "fd3398c8-0cbc-4fec-85a6-ad4b884e634c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201530, "uuid": "8eaf7873-1d3d-4032-838a-10052abb26ca", "value": "VT-154-21-KHI ( 12-4-2021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d715af9a-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618225034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225034, "uuid": "2af5304b-459f-4269-8414-ef6de4ca5eef", "comment": "Malware payload (Loki)", "value": "8d89db5a179e4c0f56ffb5ac64843a5b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225034, "uuid": "6d131e68-179d-412f-a1ce-062a2687d729", "comment": "Malware payload (Loki)", "value": "09ec02da3de3f722d9e670a2fa7189ebce25f52ed211e5f219fd6478256d9bf7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225034, "uuid": "0e575cf8-c1f6-416c-babf-bd03f6335c29", "comment": "Malware payload (Loki)", "value": "230eb4d1971cedc71a43288c7bbe61b499d8eac6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225034, "uuid": "f22dc063-ee4b-4b64-be87-33f73915e153", "comment": "Malware payload (Loki)", "value": "03169aa1f639d1bd52e08cee1ec2ba5d4541b4d6b2dbb74fde19688be2fb31963db239e74a79a8b52c4cf790310c3b10", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225034, "uuid": "e002b43d-bdbe-4ed5-be31-48d4f1761932", "value": "8EE3024766D1AC77FB07A73209639637C3B1DB0820965A074B680F7FAD97B43CA5A0C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225034, "uuid": "94c7618c-d507-479e-a649-81e622f4c8c7", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225034, "uuid": "80f20fda-8fde-4c70-a4e0-bc410bb61b6e", "value": "3072:HyewmN4skJ6duZGKgxJNETZ+OqyoOYX4DDTtnEiG4fH:HdhuZYNETZ+nE04pXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225034, "uuid": "94bfc92c-506b-4d1b-990e-12fe50eb9bfc", "value": 148771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225034, "uuid": "aee7caea-45ff-435b-ad73-e9e31371001e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225034, "uuid": "2df28483-3b8d-447d-a91b-afdb14767ad5", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.19150.12740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44c3985-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207474, "uuid": "736815d6-b396-4a64-9151-c9f6d6bfa5ba", "comment": "Malware payload (RemcosRAT)", "value": "4a967920ce223f0c2bbf443c65029d8a", "object_relation": "md5", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207474, "uuid": "ab5649f0-c7db-4b3a-9ca9-330592884e4d", "comment": "Malware payload (RemcosRAT)", "value": "0acc8f75bc368a752c93c6f684439604b9c58772e82d769dc5c6392d8b62f605", "object_relation": "sha256", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207474, "uuid": "f9d07969-6db0-4430-8a63-15ebe6d262f7", "comment": "Malware payload (RemcosRAT)", "value": "94d5fea2af8cc36fa0f82b25fc9000acc96e3b51", "object_relation": "sha1", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207474, "uuid": "111ea09c-dc7d-4ce2-b98e-78f769f00d3e", "comment": "Malware payload (RemcosRAT)", "value": "f8a0ffbc0c493c888a99bd465aa0afa52e98cc9f644d0fa343e72b52d01723158d09e3a8502351988d62c092e3d37edc", "object_relation": "sha3-384", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207474, "uuid": "24b1e474-4ac5-4892-9a7f-346a077d113b", "value": "1E53013C5587BF66FDAEC8BD23CE194EE02C13D4A31897AEB7E2745804204F5D4191BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207474, "uuid": "1de3ef86-8fc6-4b81-b41e-0a36eccef509", "value": "768:U/GNw9gR9ON5+cvKyllBAE8vfG4iWHpXpV7l5K/4aT3nX9MTByjEeCsMYvSOsCOC:VEb+LyllK5XG4jPzK/4abbENoKONObzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207474, "uuid": "d7ebcfaf-9836-49dd-ac74-535b456b4ddf", "value": 61762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207474, "uuid": "9cd6b14e-a77e-47ba-8922-a1dfc5c95d23", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207474, "uuid": "b5ac9345-b857-45c3-bea9-10f6c89101ca", "value": "ADJUNTO_SERFINANZA_4944554994988993701304_917044026594458105225_0145056552681626972688039354_5717052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc12c2f1-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618253362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253362, "uuid": "59a20bf6-4419-4eeb-9ea1-4e05a1bc4e22", "comment": "Malware payload (ArkeiStealer)", "value": "96d7b2f6f6f13ab8b971a95a7513c547", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253362, "uuid": "dccb080a-d5f2-4162-be0f-01be0ce979aa", "comment": "Malware payload (ArkeiStealer)", "value": "0ae02edbc714dfd70bc71151c585d12d35b407c831ea5c9abf5c32376ce14a45", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253362, "uuid": "e668ebbe-8364-4e9d-aab0-3799e32dfb2b", "comment": "Malware payload (ArkeiStealer)", "value": "5cc439b858fb5fc55eff74a5e3939a5d2dcc3e36", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253362, "uuid": "46bed633-0bea-4fb8-8c86-f5056ddba986", "comment": "Malware payload (ArkeiStealer)", "value": "665123b8ba1314dd3693e83a9af474b3d4ddd08ebdc5c80e20eacd0225a1a5507a2570ee27516ab907504eb303e5b0b9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253362, "uuid": "85a543f0-98d4-461d-9308-a2c0ad66333d", "value": "DA35CF26E6A28B37D1731A3CCC5E52B89835BE5029256C573ED8DC489B393B1387D393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253362, "uuid": "aad9a48a-41df-450a-8415-cb78d5dfe60d", "value": "ad25901d54177659cc2278f51a67cf50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253362, "uuid": "ae13d6af-c339-43a0-9288-a9fef6ec645b", "value": "24576:fLZpwczYQACgOtyzrYutUgfO0/QKPccZ95i6mM6:j9ACgOAZigfgcZy7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253362, "uuid": "630b5eff-af4e-4d81-b3eb-cf5e3fdee4ee", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253362, "uuid": "dfb282c0-4330-4583-8f42-a9e4d7f8e672", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253362, "uuid": "463b2031-4b29-41cb-8e7b-b314c5074e5a", "value": "96d7b2f6f6f13ab8b971a95a7513c547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8aff0e-9bb7-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1618249852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249852, "uuid": "42574f63-063e-4a7e-a0c6-d5d467a9be3b", "comment": "Malware payload (TrickBot)", "value": "cbea511bd35f247e4b4bf7cc5a3a7cbd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob52", "colour": "#49550A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249852, "uuid": "bf7e89ae-e2b6-4ab6-8f47-c767bfee6c6f", "comment": "Malware payload (TrickBot)", "value": "0ae86e5abbc09e96f8c1155556ca6598c22aebd73acbba8d59f2ce702d3115f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob52", "colour": "#49550A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249852, "uuid": "9297e5c3-e54e-4a64-8d40-ace034163ae9", "comment": "Malware payload (TrickBot)", "value": "8c0d352934271350cfe6c00b7587e8dc8d062817", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob52", "colour": "#49550A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249852, "uuid": "b674e961-64f5-49ee-8f97-f56ddb9e07b1", "comment": "Malware payload (TrickBot)", "value": "b97ce6edd431ba50d49593b4229b51bc9037a31312614147b8867bc30c9a185020c26477f0ef26da7da0a70a960ce455", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob52", "colour": "#49550A", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249852, "uuid": "de92d69a-44db-434c-a9ef-826f3ba6b7e5", "value": "C1A41207A00A4151DDB7A9F50FAC4EAECDB0851436E0D56F38242CEDCF4EAB11ADF666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249852, "uuid": "644cbafc-8b98-4bbb-b6ae-4e4a59f1f276", "value": "8948fb754b7c37bc4119606e044f204c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249852, "uuid": "24d9be20-483e-4d9f-8fb2-92469f123ac7", "value": "6144:BqeyCMxv21VX5rHrP9HlIjlYVnvi5TnMTBs7xTUgzFxmSZ81gVRHZOXTulpwNF6c:Bq9CAvi3LlHXtiyTBITzwTCAa6dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618249852, "uuid": "a85cbdf1-92c3-42f8-985c-b3e4e9eca2af", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618249852, "uuid": "794ec06d-1bd0-49f6-bd7b-861cdc7521fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249852, "uuid": "334f7597-0e9e-4c48-8cc5-1b6fe6aeafc0", "value": "5Y7a0.perclick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c03adf-9ba3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618241274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241274, "uuid": "a04bd23c-4533-40df-b23d-a439a2c48d02", "comment": "Malware payload (AgentTesla)", "value": "2ffc22d15533f8fb70d667fe3c6f7fa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241274, "uuid": "cdf6e199-7b61-46c5-8fcc-bb7ad29b1792", "comment": "Malware payload (AgentTesla)", "value": "0b0b1eac12fb2d2c4ea6cb428799e00a259f13bce6128137e8c74acb0fc19fd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241274, "uuid": "270ef544-e4f1-4305-991e-3850b1c90b60", "comment": "Malware payload (AgentTesla)", "value": "3769bef8a6c9aa252b50c596a19a3b58f4fa3d16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241274, "uuid": "d674e491-ceed-40c1-a1f6-63c1e79cadff", "comment": "Malware payload (AgentTesla)", "value": "37c3b7de1ad5e08bb9392d92867be1c656dfd03ecc9549f3dca1a95dbddf80273752efaef3df9e536946112815f8ff4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241274, "uuid": "caebf004-b2d4-4f06-be97-8bba77d8e8cb", "value": "9AD4235BFE8D2F7EA99E429325F680342DB3C744BF0B0D943505553BDAB818D0EA984E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241274, "uuid": "9291b412-43c9-4d74-9973-0475f4f8047f", "value": "12288:yz6fz4dbA7MHHHedV6SMRcllpG/+Al8sLKgybqnucb7l6G2j:y6b4RA7MHHHedVqillpG+Ar7ybUr7lsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618241274, "uuid": "5c561e16-3ea7-4689-b50f-b2bcc5fc02b5", "value": 608605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618241274, "uuid": "8e44552b-cc3d-4848-b970-6ea1a272f900", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241274, "uuid": "6f1d4a01-0ee3-4593-8b47-d8faecd7a1cb", "value": "PO Number 09211.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f440f9-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207936, "uuid": "7905a3f2-d050-4033-bb53-dcdf256a4bdf", "comment": "Malware payload", "value": "0787e51d9048d6272a5db497cea8a92b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207936, "uuid": "b05406e8-a2e1-4988-b9ad-39a85bfc071c", "comment": "Malware payload", "value": "0b23c73a9a8a4d46b5aeb246ae1fe904dcb97676463cc3c068ba77bc7cd11b15", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207936, "uuid": "2ef10558-3d96-4cce-aac6-9e6c0e936e74", "comment": "Malware payload", "value": "bc942fd439f9999076bdc311f5ab754c2e918053", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207936, "uuid": "e6c88625-c035-4372-9b1e-699f0f6834e7", "comment": "Malware payload", "value": "6b16c2b2016da45f5d2bb8c17e3de412843910e478a3283b60068c3313c5af720cdd92fbbfa3fb21c691b2ef3c6220a9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207936, "uuid": "0232402a-0192-4b50-8985-bdd380a05193", "value": "D61533DE794A4AC68C514F9DDFCA240764EE3200B86D552BAED23DD5542FBCD00638EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207936, "uuid": "2057b4bb-69d0-40cf-8e52-99ba07343e76", "value": "24576:f2SGA+4384jK/pE9ItIagonllAhwmJB3cQ1W3ry0:f2XAipE9IiagXdUrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207936, "uuid": "2daf2a4d-6113-4ecf-b131-ea4e144ed7ff", "value": 905321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207936, "uuid": "1519adcc-6702-427e-a4f0-6b9a9558fa99", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207936, "uuid": "5649a7a6-df03-4b5e-83b6-19618f2e0908", "value": "00000998880.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8d2c7e-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618209422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209422, "uuid": "ed10ccb1-7ada-4bfe-9e71-792bb6c46066", "comment": "Malware payload (Loki)", "value": "e265249faf8dbf36a87bde74d267c6be", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209422, "uuid": "a355cf7b-c725-4477-84f5-1a860c1afecd", "comment": "Malware payload (Loki)", "value": "0b74cd4f19b653ad69092aca426c9a0b4c3c1c8955190e31b35adda745328f40", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209422, "uuid": "08ad079d-4834-475a-b94f-d249ea8c6685", "comment": "Malware payload (Loki)", "value": "2b10ae9aeda23fe69c13a0a6ecc095daa8fa256f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209422, "uuid": "2b689437-df87-4271-8b07-a6ac22e0f96b", "comment": "Malware payload (Loki)", "value": "c2e101acbb9703e5e3085cb28c3479631dc16a4f806872ffb9e3274ee4fd6d510f9b855f909407cb663aa23de8ab8e2e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209422, "uuid": "eb968c50-358b-411a-9f31-8e89d4a5b83c", "value": "E7D3124C0EB5D80C86556BDE06EC3C0AF017BD797A8DC10517E0EB5B8CD9FBA0A656E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209422, "uuid": "f22ce4cb-603b-4d2e-9e84-62716eae715c", "value": "3072:2113ReTXQegmxLTO47NqZPb/l8oY3eIFOFxKNV:2L3ReLXxLPZuPbeoY3eIcFxKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209422, "uuid": "d01bf59f-5338-4d0f-a566-6d36def60c77", "value": 134615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209422, "uuid": "77e736aa-c170-4bf0-a070-d4968da4b7f1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209422, "uuid": "851fff17-1384-42bd-b20a-833c6e9163af", "value": "enclosed proforma invoice inv-00628934.pdf.r24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b303fb66-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207794, "uuid": "277bef8a-0e27-4f29-a5a9-f66ffaaaa3c8", "comment": "Malware payload (Formbook)", "value": "68d63479e5a11048e6bc1eaa242f8c7b", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207794, "uuid": "a339336c-095f-4549-ade8-952764c7f140", "comment": "Malware payload (Formbook)", "value": "0bc287a98874b2ba0b818013c4026180a2e210a65d0800a169dde7ad7725277b", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207794, "uuid": "663c97d9-841f-4900-95fc-46c24e61099f", "comment": "Malware payload (Formbook)", "value": "8637b7ec04a9ff11b8fc6d99a51f911aaad5a889", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207794, "uuid": "b32e41b8-0f04-4046-a3dd-5af05bb7152f", "comment": "Malware payload (Formbook)", "value": "8d61631fb6ebd61e66a7e4ea0457dcc6a57ce0fcc20ac228651dd0aa1d062909a2de232d85f914dd7ca8b0f299e77e7b", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207794, "uuid": "86bfcb2e-b2e5-439d-8d33-df086da2e0af", "value": "92F41229DF48871FDABC25BC4921DA0497F0D0642E52EB467EC474E8828BFD14F2269B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207794, "uuid": "57a04c32-222d-4f72-a973-5e98a8af40a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207794, "uuid": "350c9c12-37ec-431c-9ffd-f5b8c0d3983c", "value": "12288:sU4W5j63HmMBIV/v5v5apvsNnAFNIRLJVdJX3cWOkJkPrr2Hx1mM8UV3EkrohWW0:N4UV/ap0RaNIRLJVdJXyix1msV0kU4Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207794, "uuid": "816a0d42-a433-497f-9a2a-b7ca5e5c63d1", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207794, "uuid": "7d9fe961-bf7f-461e-b4ca-e636a0199c0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207794, "uuid": "eb9b22f4-17cb-4ada-9290-45b20f0f80a4", "value": "DHL_document11022020680908006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630d74a3-9bdf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618266930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266930, "uuid": "44eb1f81-cbe8-45d4-ac1b-684992889817", "comment": "Malware payload", "value": "f72e6263dce9c0505020fec6294fa172", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266930, "uuid": "8b9f666e-3159-4083-a496-b49fc736d134", "comment": "Malware payload", "value": "0bf7fd784e5eb55e97967ed69c767ce46941d507c9c5db5d99c2f0df6162f8c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266930, "uuid": "d2ee8dda-23b3-4f99-a40f-f6952cf9915b", "comment": "Malware payload", "value": "e56350fee01b7cf99a0cec43cb9b89c6935e6ea0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266930, "uuid": "8fd1918d-9877-4680-99ed-a3ea54e6cd22", "comment": "Malware payload", "value": "f77f3f70d63b036babd195505569b848e1e596c2e8e2f61b60c75d78428967a7118c679ce76212867454c8e198a5ae93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266930, "uuid": "f593034a-28ed-4930-bd31-ec0ecbd5ba85", "value": "50053327AB370A2E3C94C1787AF15487801196DD6CBE6CE67D3E1B92D2C91CB11B3B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266930, "uuid": "bb8bd4fe-8e05-44dd-b295-93109ebdc92b", "value": "12288:F6QLodxK2NirSKwgW8TGIYG27eSVfndb4cv6jMEBph2di7cFWj9O4S:F6QUDVirSZ8nYGyV1DGph2m59Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618266930, "uuid": "cb73f13b-8a7a-45e0-810e-a15348081442", "value": 813149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618266930, "uuid": "e7bc492e-fb96-4263-9eed-4be679872ef0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266930, "uuid": "08264dd7-78e4-4375-8477-75b6da386a92", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f653fbe2-9bb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618248279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248279, "uuid": "56100d56-418a-48f9-80b9-94fc035a2c26", "comment": "Malware payload (Vjw0rm)", "value": "e133d60f77847c11dced777754ddec59", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248279, "uuid": "20b35f4c-398c-4c68-921a-f30737cf0fb8", "comment": "Malware payload (Vjw0rm)", "value": "0dfe57ada48e9d64c4f2a730929a89f52801a89a89103f2cd693eca5528a3891", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248279, "uuid": "aad20052-6c18-4444-81a6-0b4e5a3697c3", "comment": "Malware payload (Vjw0rm)", "value": "5ae741ce53233b364acfbc971d8dc59166aeaa1c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248279, "uuid": "f478ebc7-1aa1-4803-b767-2898f5eff27e", "comment": "Malware payload (Vjw0rm)", "value": "429bd30914576eefa2caaec7846f72eb5017d17a2b304156881e35becd646482b815e212e033790e31e52614a68e7f0d", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248279, "uuid": "7745cbe1-eb14-47f7-b183-2aaa8468bb6b", "value": "2363E990B74D905FD2E20274157A38089CAFE92152F860F9F66FA464E777A2C835DBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248279, "uuid": "ae3decb5-2354-4990-9be6-b4b53ccb5c3f", "value": "192:GvVz4813lF1jA9A9gz/o2QUNLSlTegskME/Wrm7:yO813lF1O8bJsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248279, "uuid": "ce117a94-d823-46c5-a809-5cd40760fbfc", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248279, "uuid": "9d40016b-313b-42f7-a222-3317229fe175", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248279, "uuid": "f0164d3b-7b24-4d40-aebf-1dbb5e9b877f", "value": "ZXHNWASVMN.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c45afe-9b6c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618217752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217752, "uuid": "8f2138c4-c4ae-48e6-a570-9fb20a7ea686", "comment": "Malware payload (AgentTesla)", "value": "f9be2c8c678fe48ade1c19d9a4096520", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217752, "uuid": "3a756c60-13d0-48be-82e2-b4d855f3f2d5", "comment": "Malware payload (AgentTesla)", "value": "0e2ee878f5b82b9a77bcf1dc457f0545ffd5a5cee8425d208eaeb481b9cc4bed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217752, "uuid": "f5aecc26-d777-4fe8-a8e2-04c5c05d335b", "comment": "Malware payload (AgentTesla)", "value": "a375322d7cb9f3d2bf21072968f9a01f4572ba70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217752, "uuid": "7f3541a0-81cb-4553-95e3-5a9327f7b196", "comment": "Malware payload (AgentTesla)", "value": "1314239415139ac42e7dc9992b44be88e7bf4a47a6059f054f94309fdddec597f0ea908a52ed1c0842ba0962fb97f3f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217752, "uuid": "671aa56d-3be8-4fdc-917b-a679ca93e981", "value": "2BB4237144486E56D0D9ABB7FD81DBF343A66521268802D6E885FA2F076F3EE18D10CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217752, "uuid": "6445ef01-ceb1-412f-9ec0-906f73a9a4ff", "value": "12288:SfH+dWU+Tr65QXzbOtRObIGhWH4hFezdHGIYrM:SfW+n6QbOtR0jWYo5tY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618217752, "uuid": "2d63b4e8-925a-45ae-b022-56549ec77696", "value": 541557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618217752, "uuid": "853062d4-32fd-4da7-9fee-072783417ec4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217752, "uuid": "b9cec0ba-b75a-4eb0-8367-cefdc480ea11", "value": "Payment Advice Note from 02.04.2021 to 608761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e675a74-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207276, "uuid": "3c42ea04-4b04-454f-a849-62034804b9ad", "comment": "Malware payload (AgentTesla)", "value": "7570dbf7f7d16580dbed9b36570cf11f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207276, "uuid": "7b276c18-eb07-4770-93a7-5bbcf0eb8c64", "comment": "Malware payload (AgentTesla)", "value": "0e38e0c684966c233b4ee778586a8296701d77bb45e1a36b5328c62442a6ba61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207276, "uuid": "0d176739-1465-4a81-a1c2-08f7a4f4b987", "comment": "Malware payload (AgentTesla)", "value": "dde92b209665d47ed22b82a4bcdeff419fe71d71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207276, "uuid": "436d9ab8-17b4-4c30-94ed-09d9acac238d", "comment": "Malware payload (AgentTesla)", "value": "4d7438db599d45aab34142fd8a3e204a8b070ba6a46bae931d1f082d85e2bf506c7ba09f91daae36d12ac9017dce8d72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207276, "uuid": "ae5b5e36-bd2f-4e3b-8aaa-a79943df002e", "value": "A6659D987604F4CEC4578D32C9545CF09610ACEAD31BE243A0573D99B93E68FDEA68F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207276, "uuid": "27c51844-011b-48e1-a602-b73f4b93cc7c", "value": "12288:ez7DN/O5bWxTNJkfuI40ooSiUrCVcK0fCR9rc+qrQmjiEYZVpPug73Ad/:uB+WYyQUrCVcK0fCRi+qrQMiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207276, "uuid": "48652fd3-2829-483b-be9a-94285548e506", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207276, "uuid": "1d2ea928-7fa8-4d06-8238-71d5449031d3", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207276, "uuid": "dae31a98-11e2-4d76-9bc9-3460b56855d4", "value": "PO 9506.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c752bd3f-9b9f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618239611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239611, "uuid": "f2a55baf-aaf5-425a-85ff-30f891c47739", "comment": "Malware payload", "value": "7b6e38b44130e1cc0e431dc2eafcb4a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239611, "uuid": "37c18cc0-7ed7-4201-8135-c9e7b3de048d", "comment": "Malware payload", "value": "0f083aac77fb734a8e81fb9dff218f0414ac6c4c9a23b2832837fbc2c7e2031d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239611, "uuid": "19b5b319-1407-4699-993d-ad852dbdbc80", "comment": "Malware payload", "value": "c9a705395fab442261c174021caa9348ebff6b19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239611, "uuid": "35067693-c7dd-4ce3-bc16-11248c1606f8", "comment": "Malware payload", "value": "2eedd2f592404992ee4d33f0b3d4ed287a1bea11b048216c9b368a9077d76851831e0baace2fced435fe4bef06f863f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239611, "uuid": "232e48e7-6795-40db-b67e-dbc55f15cc3e", "value": "AFE32B2C24C97D20E9E6CFF4870F1879016B722228139D63616C49D8AD69BBEDB53D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239611, "uuid": "40a78fca-b464-44ba-8d1d-7a5d76a99e17", "value": "1536:9HlCQCGPJD+M3tu2xycMpKdvgdalZq2Sqyjx5QGZFu9jMst7WhfzwVYQSaHbWpjf:Ph+atfxynoXq1NLFZXfz8SNdUD2J/vES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618239611, "uuid": "1936655d-db55-4f3b-afb2-cabcf4f831e7", "value": 146218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618239611, "uuid": "04d486f5-b1c7-4d0c-aa32-2e95f6052352", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239611, "uuid": "9574c832-1c35-4bfb-99d9-076569b45a1e", "value": "0f083aac77fb734a8e81fb9dff218f0414ac6c4c9a23b2832837fbc2c7e2031d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b16140-9bb5-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618249037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249037, "uuid": "5116cc73-fd81-4ec8-9e18-44f4f5f1ee98", "comment": "Malware payload (RemcosRAT)", "value": "66525016cb1f9420e5e5c178082346cf", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249037, "uuid": "c1a5e020-fb2c-4231-ac9c-6833dd9025f5", "comment": "Malware payload (RemcosRAT)", "value": "0f3cac160b09665561487322c11c5ee1ad0eb221b32edfecf1fe01d5b5f278f7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249037, "uuid": "a3d1d420-81f6-4ce6-9d3c-4fee4955c74a", "comment": "Malware payload (RemcosRAT)", "value": "afe3c32389f0009959d9de94feb11e2bf1f1abd7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249037, "uuid": "ff97794d-eee6-46a8-88e9-fe6459b06b5b", "comment": "Malware payload (RemcosRAT)", "value": "c840a149682c4cdadf84b530d4cce61fd892ecc1278cbfb627bdfec0eafb90af02e4f889c41786e7a4580ffde11a341f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249037, "uuid": "d763632c-aa7d-4042-858a-ff30e8a50505", "value": "77F4AF11F2D19837C07E1978AC2796E89C3AFF10FD689A4A67F81C085F387907E66197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249037, "uuid": "2d81d286-80ba-46a2-9704-300ecd75879b", "value": "23399c21b0aa604a8aa13da9702198d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249037, "uuid": "6f9db95b-c6a0-4e66-94a9-3f1686ce0f70", "value": "12288:wjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c0kKRmp1:wjMmMH8XEgfqFDd0kK8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618249037, "uuid": "2242308d-ea81-4005-bfd7-8a8dab7a3adc", "value": 787600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618249037, "uuid": "cf0b95c6-f094-4d54-a7a4-101fe7c8c11e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249037, "uuid": "78d0ef80-a33e-40c9-94f7-e144d2d9a95e", "value": "Dringende Bestellung Zitat CTX88467638,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01fd805-9b40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618198823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198823, "uuid": "7c926584-50f1-499d-bae3-9ce2deb7ff17", "comment": "Malware payload (Loki)", "value": "cb5cc02ac13f9088efdeca71887b7666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198823, "uuid": "a39f8136-acef-44af-845a-85d384419f81", "comment": "Malware payload (Loki)", "value": "10dad4c75ab3fecb7cbce449c9980980253e1c7b1eb5e42a62dd0623b9bca81e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198823, "uuid": "3f73fd40-5ec1-4dce-88eb-03cf5fd60d32", "comment": "Malware payload (Loki)", "value": "213c5d30330a959522229846bb17c5115b01356c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198823, "uuid": "2132557d-343c-4509-8633-a2a9060835e6", "comment": "Malware payload (Loki)", "value": "7ccc431ead28b24d97aa57cd68d2f03f481b6a2ff91b216c1240147eeda740a122a9529f4a04c07f320570d2590ad7c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198823, "uuid": "dc061933-453b-4a62-88ac-36d4073591d8", "value": "E905BFAD3650B6DFC957C976CAA42C64EB61747B430BD207A46312EDEA0D99BCF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198823, "uuid": "5dcccd39-8b57-46c3-a991-29cd7f823639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198823, "uuid": "3caedd74-b029-4fa8-84ce-68a38f52a7a2", "value": "12288:M59c+Of/i6OYe1c9Ce8ai/S8SNul4NDMa99Rq6KFmj5Djr+csGoKaVAlBTi7YHaV:MkOYbT1PK4D9cFmh/+csGfjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618198823, "uuid": "f978503a-45fc-49f1-a742-2873963975d7", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618198823, "uuid": "3d5b9845-4d9a-4852-ba45-ede53b7eaed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198823, "uuid": "078e4575-3a47-41cd-b172-2aff0087b8c2", "value": "LST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf806cfd-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618236188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236188, "uuid": "4592349a-7667-40db-918b-73692373f305", "comment": "Malware payload (Dridex)", "value": "9c1da8f055a46f3ad5e1d6e5f33f6c11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236188, "uuid": "7b6efe9f-a012-4d4a-8774-22a528c1a786", "comment": "Malware payload (Dridex)", "value": "113ab4590b567654cae8ea18a0ba97a4b6897d660718b76337cab89c561d81b0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236188, "uuid": "3620972f-4573-43f7-9805-447f61018e2d", "comment": "Malware payload (Dridex)", "value": "2a8b11f63b8133a1c3ff8b059500dd8a275b09d4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236188, "uuid": "4370cead-a6d2-4a7e-b4fe-79a513c7c444", "comment": "Malware payload (Dridex)", "value": "77ea9f280c99e37bc6d94c4791ff0bbab6ba3d80261d602889d38e841438351bded6acceee7c02775ec83250d30f7591", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236188, "uuid": "80c2cfc6-f40f-43fc-b802-dab4cc29ec86", "value": "12A39DDDCC53B4C6D6148FBC8A0971C514F4C4B63A2FB10A6989A26F0D41FAE198E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236188, "uuid": "5f7217be-666e-476e-bc73-66bf7274089a", "value": "1536:/RI/KKxQe72hawT0DausD9Byrty30wEGttZv9xof46:/RI/KKOkMHfD9ByrtyOG7ZVxo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236188, "uuid": "85725e29-2a0e-4c56-b463-4c671218db14", "value": 98209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236188, "uuid": "711a94a7-752b-4beb-a1cd-9df3fc0a03db", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236188, "uuid": "2791c616-aada-4ae4-8870-19744e7d3ea2", "value": "documents-466266883.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdd2a47-9ba1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618240377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240377, "uuid": "3cfe722c-7930-4cae-b824-24a76f4e7c96", "comment": "Malware payload (Dridex)", "value": "22d9661be91eea3ed757e249b066e607", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240377, "uuid": "3c335b38-a05e-4cb9-954c-7511c5290848", "comment": "Malware payload (Dridex)", "value": "1261bcd15e477e8988202a7871969443726839bf80238468e41913d3cbe674ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240377, "uuid": "0e881d84-7a4c-4401-8057-f95cd5ab9975", "comment": "Malware payload (Dridex)", "value": "315b68122763ffd65924eed187f4f1f4b8289d2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240377, "uuid": "72d39e61-d01f-4411-ad23-59d493656946", "comment": "Malware payload (Dridex)", "value": "1570dadb4fa5b444dff8a7c0f7c43a3cf34fea14ba22113afe93f05388ceee6008487c8a06bbd81edf6e7f544f58bbca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240377, "uuid": "d392db14-f060-4d20-8652-87148e1ace70", "value": "DFF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240377, "uuid": "ea7b3981-0cd6-4172-abec-81d5435269cc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240377, "uuid": "82e994ea-3806-4a05-8157-4758f86239aa", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240377, "uuid": "9b04457f-1be5-4e78-8e8f-a5e497e21e42", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240377, "uuid": "debb4165-241b-432b-a179-749ee2d68f86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240377, "uuid": "e82324b9-0116-44b3-8720-99af43b628fb", "value": "68719.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d0ca73-9bbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618251904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251904, "uuid": "a4a45028-68ce-4626-b5b4-90aaa983b4c0", "comment": "Malware payload (AgentTesla)", "value": "b716dcb97899774bccb04b263e45f3e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251904, "uuid": "2b9ea545-adb9-4117-b42d-e542e57f4f33", "comment": "Malware payload (AgentTesla)", "value": "12b61c45424886804d0492925378264c03ddeaa263b28d078049f6659ec34ac8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251904, "uuid": "867ff386-af69-49f4-a325-1b26d9f691bb", "comment": "Malware payload (AgentTesla)", "value": "bd791941375b41e760a6fcb86395ad6719f989a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251904, "uuid": "f989d5de-1281-4724-94b0-bdd4f219c897", "comment": "Malware payload (AgentTesla)", "value": "04de6a3a6253a86f6a074d8cef424bb1bdb0a03ec9eaf28eaf947bf1be64cb9fd7364d8443afbf39f6b4886d6820a9ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251904, "uuid": "837e8aba-0e0b-4bf4-b34e-d41f50a96710", "value": "E3E433227016177FD49942B45EA135F18EDF8135AC0BFE06B38B8BCA12F6985521E2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251904, "uuid": "33686d42-c22a-4401-8ff7-08454c816689", "value": "12288:sWXYcf8BFirq/z/rqEAPpASuKwYgQptW45EZzKgRfrfrr+zKFcFs:sWXgBFirkzWPeSusp845EVRn66J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618251904, "uuid": "718fff66-7e8e-4230-a3f4-87b98463ad29", "value": 693417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618251904, "uuid": "37d60b21-5c26-4ef3-9ddb-a28f8de7a189", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251904, "uuid": "119b4a9d-c2de-499d-976e-4a3b0a7142be", "value": "548235.PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d12aa3-9b6c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618217756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217756, "uuid": "fd998d3f-6e1a-458d-bf21-5ae7687d035b", "comment": "Malware payload (AgentTesla)", "value": "65e28f2d01fc1d21e9d6632b85ce197c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217756, "uuid": "649a1b92-7851-4670-b5dc-45683c34c308", "comment": "Malware payload (AgentTesla)", "value": "12b9e3e3878aed00a346cfbe1cbcfe58d52af8a7b27a0420ef91d3b8395ffb19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217756, "uuid": "7a5b71ba-17be-48ae-bf61-2b7a392f14fb", "comment": "Malware payload (AgentTesla)", "value": "80314bd15640f1fa2219d984f8dfbf57e31c2305", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217756, "uuid": "f54141af-f0bd-4de7-a18e-8cc5b9c31457", "comment": "Malware payload (AgentTesla)", "value": "284d86920769e966f55b7407b223c0036592495f4c5be44d31af0afb9207f05b19d9414a43f3ae5fed5a40f80019877d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217756, "uuid": "a2604bdd-b501-4e39-9d0a-3e44a306339f", "value": "ECF4CF30728CABA6C83E67354810528053F2B90AEB15DB5FBCD8215E1E63F5A8737B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217756, "uuid": "cd908e93-de49-44e2-94fb-8efdb1a6e251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217756, "uuid": "a8fcfda0-026d-45f1-a037-43c4bda2d445", "value": "12288:SBt33BHKdWi+br+5uX1VOtRObIyhi54hrevdmBIg11:SLnls+v+6VOtR0PiqSYBIg11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618217756, "uuid": "ebeb0317-777f-46ea-857e-efd3348f574a", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618217756, "uuid": "0d7177f9-d396-4d11-b1dd-b4b5ae2a72d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217756, "uuid": "50e76160-a343-43b7-91b8-41d8db03fcd7", "value": "Payment Advice Note from 02.04.2021 to 608761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e36772e-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618206282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206282, "uuid": "ce9c8f28-dfff-41e4-ae88-545da2eac7c8", "comment": "Malware payload (Formbook)", "value": "4d85f2cc8ec2dedc7330eefc35b2922b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206282, "uuid": "88434eef-d685-4375-ac3d-5c8f2a3fbe59", "comment": "Malware payload (Formbook)", "value": "132bffde916ecb2374bc576a1e7d041d09b8411ed3c885b1d5e9b01e1ca073aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206282, "uuid": "a9301d48-5d4c-4c34-935a-7c0d8bbd1964", "comment": "Malware payload (Formbook)", "value": "7f0d05debf2120775ea9e55553a3299a9148f101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206282, "uuid": "227cc595-e366-42e7-9435-92ec44cdfc73", "comment": "Malware payload (Formbook)", "value": "def9fc19b7ef38e91e92a1015dde445677acfd237488210360bae9e5d00769430d7e9fb23dcdb0cf78a4c93e22dc97f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206282, "uuid": "b0161960-0b62-43eb-ba45-748ce75880cf", "value": "05241312D2EA783FD097A17A0CB3BB25C377D50513292A8B8BE4AF576F75D83412A443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206282, "uuid": "287494a7-dc24-4ef2-914f-144f6d4cbdc3", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206282, "uuid": "d4b604c3-d9aa-467a-a9b4-da2cca1c7afd", "value": "3072:HyewmN4skJ655tjA0t4JE982rs/7NTqfpcxLcsLZpEG3nJuNGq0Az7KFablVqAK5:HdbtJrszNTqfpAAsNJcP/sabPq95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206282, "uuid": "864315f6-6bc1-439b-9670-23ae4cf8eec3", "value": 228105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206282, "uuid": "f68cd68e-3e65-46d2-87e7-208b3a9db3e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206282, "uuid": "ece9cfbb-3460-4c47-aeee-6d7f82ff73c8", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e971b2c0-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618207456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207456, "uuid": "9418af84-4394-4fd4-816b-7c90b9ab5c3f", "comment": "Malware payload (AveMariaRAT)", "value": "199796d8afa08570d2dcc4448c85ef57", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207456, "uuid": "ccff5a4b-3a9a-4736-ac08-1af7151478ff", "comment": "Malware payload (AveMariaRAT)", "value": "13356069fcc14e4acc6e0da16a76a8acc79767e2ebdca084ab67a7d8a559fd8e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207456, "uuid": "7558794c-25cc-4d24-89c0-1c39b30fa673", "comment": "Malware payload (AveMariaRAT)", "value": "573638654e04a6d364a8f742e74ce1594209a199", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207456, "uuid": "f67a8c6a-3257-4be3-84d7-3f93fa2d4de3", "comment": "Malware payload (AveMariaRAT)", "value": "ef005a49fb95d984f83a69becc2b2b2b62eba0f1083e95f2779b25e804f0c8ed5b662a914e9f33e05361592f15cbf747", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207456, "uuid": "5edb2af0-bdd8-45c1-90dd-7300d18f0044", "value": "A8E45B22F591C432D07E3879CF6B45DC482EBFE0ED38584A66F65F0AEA7574028652E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207456, "uuid": "3eb4acc6-cfb6-4859-9f9b-c9d99998cea4", "value": "f7b3144163fc8e2773fb040c538c4217", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207456, "uuid": "bf69b82f-c0c2-41b3-9f3a-b5df0cb41bc9", "value": "12288:+neSgWVWzZrInNQ3dhtmwROiAQQ0KRmpL:+eYWzZZUUAsK8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207456, "uuid": "35ae8813-0b11-4a43-b381-9afeb8bc4be3", "value": 711312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207456, "uuid": "efa8da71-3bdc-418f-ae17-340539e797a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207456, "uuid": "c655b3ac-baef-478d-8299-62c79afa5481", "value": "PO NUMBER 3120386 3120393 SIGNED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20887d5e-9ba1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618240190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240190, "uuid": "c1c9e05b-69d4-48fc-94d9-10859e32e6e5", "comment": "Malware payload (Formbook)", "value": "12161e3bda2429635ba6721810d403f3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240190, "uuid": "4d5e98ce-7b30-4016-a087-3fcd77d8d098", "comment": "Malware payload (Formbook)", "value": "179cb6b33c459db4a6a3e51806d3f6c0d8ce41069b56662472e36ddd7673a777", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240190, "uuid": "c8cf5f92-d8b5-4c41-9dd5-afe3e1bb33f0", "comment": "Malware payload (Formbook)", "value": "e093dd6d54ef8553fc1e97f1909f123170ee9e57", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240190, "uuid": "9e44a424-ec0d-4138-a934-8e1d685e7ff6", "comment": "Malware payload (Formbook)", "value": "250b40fac6cbdb4f28c982487ed47fa49c4c6cc134dcd5bc3b9d1ac6fe5998b7ba6870d67339ce4a7b475f7d03cb4a3e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240190, "uuid": "901c1233-5547-4cff-9983-9f01d2fb83d4", "value": "0805123827D8C917D9BE5F79A4F151105770A121AB23E30EB6BC106D1F72BE18B2B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240190, "uuid": "01add83c-d4f9-4788-af2e-c37ec109d6da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240190, "uuid": "cc420522-3cd8-4a7e-8e14-274c5df8221e", "value": "24576:GKZyt20UbJmHinA6bBIR8K4vBM9ThvWYTn:Zm41nVExgmNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240190, "uuid": "aae573fc-4079-4826-a13c-46761b425b54", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240190, "uuid": "d846ffce-0075-4fbd-900f-1dda7697ec3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240190, "uuid": "a5342e7b-b1fa-4379-85cb-5bca38487a39", "value": "Arrival Notification - S2101280194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded37f4-9b75-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618221637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221637, "uuid": "2f1269a1-826d-4b29-b0c8-9be0d81330d9", "comment": "Malware payload (AZORult)", "value": "45a4af98d9afdab6c5f709d4fffb1726", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221637, "uuid": "09accda0-f820-4639-8378-f1c4ae6ae158", "comment": "Malware payload (AZORult)", "value": "17acf24c05c7bca527ec089ff2581de0a54e8793a89027cb3beea7bdedbf6296", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221637, "uuid": "c3f7c03c-e8e2-495d-ad46-966676f2f4ce", "comment": "Malware payload (AZORult)", "value": "f6b11554a14ef1d414945e7df008dc9e70b48fcc", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221637, "uuid": "35625317-8c91-4c02-8136-714f0e35802e", "comment": "Malware payload (AZORult)", "value": "7a5980048bfcb4a3edd3b69e639059873acb6205aaa517f2ad583f1f568926424ec88c5efb1f15af2974693c305363cf", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221637, "uuid": "0b15b7db-1ccc-47ed-a13f-52bdfd4524dd", "value": "BCD4F1216399CB56C2398BF2A432500317B5F1FE3917DB580E59E1D7202AB0D9EE5EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221637, "uuid": "38587ab4-8efc-4d17-9ce5-54731cce1abb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221637, "uuid": "6dfa84c2-51ce-4249-97f9-6cda96fbe893", "value": "12288:47Gl4bHCUIlnCypm0NaqjWgKYQjUgAF2VVjQp0N:PSDIlnCyAKagWgK+2bjQp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221637, "uuid": "ae35702e-1347-43b7-aed7-2d47e075ce87", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221637, "uuid": "4bf4dca1-3577-46af-9831-2d36d5bec3b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221637, "uuid": "5aba7692-9668-4221-9c85-779549bbbc91", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555c6c65-9b95-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618235124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235124, "uuid": "e42e4350-de76-4787-991f-34f694f71f07", "comment": "Malware payload", "value": "c82b1240aec498a6264e77945008c861", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235124, "uuid": "fd9ca1d6-48b3-4e70-b896-adc0d1ad8a8f", "comment": "Malware payload", "value": "17e9ecebbff7320f12b691cd4c6e6ff4250ad1536a3b95089bc6ad7ed46356a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235124, "uuid": "4ca35c73-c118-405d-ab13-e08c0d57a49f", "comment": "Malware payload", "value": "e214a267258c4479419ed18d6cc6896922569250", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235124, "uuid": "a4921352-c5e1-4b5e-b8b6-402d38eb84b5", "comment": "Malware payload", "value": "45a9bbdc7247cce3f51fddeabaa5c481ed7e70772c127ea75cbe41943b2281d2086c5a2e0bdb1267c39bea498f568c2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235124, "uuid": "b6c577d5-2a35-4dbb-8b72-c5c098b88b1f", "value": "BE816F4797044872CB8F03F8CE17890C6B648252176650F72B9E378E6F85AE3F679B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235124, "uuid": "c2d183e9-98fd-46d2-9039-d0dab09e22e1", "value": "c3a15a1718e72493b378fabaf339126a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235124, "uuid": "172fb9c0-ab23-460d-b752-853c83a49d7f", "value": "48:vpgNyNgfnpfV1cB/B5QudTEtWXblbjOsV2OLuZKQi3uYmR/HS:BLQt1cB/vd9pvV2wuZdi3uVR/HS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235124, "uuid": "6620bd71-0238-4f48-8079-5b47a805bdb4", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235124, "uuid": "ca331a43-ad9b-4ce7-acf6-d6e9d7ccdddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235124, "uuid": "295bd075-fd82-4d98-ae4e-a591e75f6249", "value": "SecuriteInfo.com.Troj.Agent-BGTI.5173.14320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0664c766-9b8a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230267, "uuid": "e85a0233-5a41-4f9f-9ed5-9f8834ac910d", "comment": "Malware payload", "value": "a7eb8d7b83e5fd622c1e205c911a110a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230267, "uuid": "7c3bd65e-bb17-499c-b4b6-8f2789b4ac78", "comment": "Malware payload", "value": "187e0a02620b7775c2a8f88d5b27e80b5d419ad156afc50ef217a95547d0feaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230267, "uuid": "1f8ba20b-ca49-44a8-80df-42e26328f65e", "comment": "Malware payload", "value": "c685312922a40d841e583f9399f66d35d6ccfb46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230267, "uuid": "df4b265a-313d-44a8-915e-4688098ff9e6", "comment": "Malware payload", "value": "5d9a5cb5bda3a6f4ec888dbc0feb7db526f24aea2e483b2d111d0e4063d76d40bdaf2e1e3e55f3c1ee1cc407e3c2920c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230267, "uuid": "bb1202f2-b61b-4355-91c1-a754509e684b", "value": "81E4022073E6C033D01615B6821DC7B14BBB7839AA59E99FBBD94FB80F216D2E716305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230267, "uuid": "6f1c2f95-5cc4-4abe-a68e-0dd32e1e388c", "value": "05d1b7139fbfc5ae2b0270198739f50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230267, "uuid": "66a34d12-273e-4c30-a5b8-b4cc8b4686ca", "value": "12288:utr6/CnX8yXPD3N1tH1epcuSdCusLqqcYourJqeK2xGn:uUSjXPD3N1y9SsJqrur8ezGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230267, "uuid": "e89ecc84-35a7-4c55-a3ed-09a7f465f882", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230267, "uuid": "c58a9a38-9375-476f-bbac-f4aaee8280d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230267, "uuid": "7005443e-0134-47a5-b9ab-10170c885344", "value": "index333.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c94993e4-9b70-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618219428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219428, "uuid": "465b4bdf-8e13-44fb-94ba-d0a9786b0825", "comment": "Malware payload (AgentTesla)", "value": "6cd928e3be0956061f518082a5acb60b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219428, "uuid": "14148ee5-ea28-4f54-a9f4-7ccf17af55f7", "comment": "Malware payload (AgentTesla)", "value": "19a975e2303b2394ab8ec3550799702b6a6a1eb166c588e90619e2c117baf73f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219428, "uuid": "041b1c64-8d91-4eef-bd36-0d8f838f0533", "comment": "Malware payload (AgentTesla)", "value": "0e377a42bd4197fceb15e458ccfb46445e7f0132", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219428, "uuid": "bd40216f-40c9-4f9b-8c95-c91279502afc", "comment": "Malware payload (AgentTesla)", "value": "513eda9f915ca9c4e10658d16774e4335849c01b0257cd63168c928af9a3d7041bd6177f6868088288da950f1475303c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219428, "uuid": "c325292a-2ee4-42e7-93ee-af144bb29d83", "value": "C28422D432525753E4BE2AFDC6818B249186FDF4BB993608710D33CE4C7B34A9E916A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219428, "uuid": "5295876b-280e-4e05-acd4-77f952f78315", "value": "6144:RyT0CRmNtvySlIWXP5qVwqNglfqmzs1bZNgWWYnJapvfVRLNlbXdxWruoV60Adm/:4z4tqSCWKbGSvFPWYJmFVNl5xWJU0Em/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219428, "uuid": "68486d1f-d546-4c85-ae31-11c8c27a30fb", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219428, "uuid": "cb98258c-b5e5-4581-8227-5a57ced3e5e9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219428, "uuid": "9e63e2d0-8503-4445-a7bf-14b9f7dfa6eb", "value": "ORDER 9387383900.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8204926-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618209520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209520, "uuid": "e22e2be5-095e-44ed-ab6a-35f5aa48cf43", "comment": "Malware payload (AgentTesla)", "value": "d5f1fbbc0dffccf347d4fb7f801cf445", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209520, "uuid": "8c18effe-2691-4e86-abaf-7b8892419a4c", "comment": "Malware payload (AgentTesla)", "value": "19bd0b352a50b82c411dd325b170d7689c1485850f1543001158ec8394d05e5e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209520, "uuid": "b15edb05-7067-4f58-ad40-d00d29d8e3d4", "comment": "Malware payload (AgentTesla)", "value": "dddf6928d32a7a3cf4cb5b664f73028cd84fa460", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209520, "uuid": "544b45ca-54ae-42c6-9b88-b4d0dbcde047", "comment": "Malware payload (AgentTesla)", "value": "11de5a7e558b9449593793b0ecc53ac2e25196f1dc7fcbe86baac3b245cd0ea273456bf3e41ed2783c64e0d2253ea969", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209520, "uuid": "45dbfec8-c542-4d97-9386-efe60aff7b89", "value": "7FF4239F357600FCDE30192B8F54CB985F671333B722989887085E66B163366AEDD06D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209520, "uuid": "dd738b48-317f-43d4-a9ce-19bbedced857", "value": "12288:/7wzBF7NGoyrHrkW7GPSeFDyTGHWI12RnG7fmBpWoSVI7LzAfjIEUNEIc2YjZyD0:cXpHerwPS8gI3124zmBpW7I7HAEHc2Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209520, "uuid": "510c5a3f-c53f-4321-98bc-6ae8c174a825", "value": 767471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209520, "uuid": "f961a92a-c9c2-40b9-8145-db699e099fbc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209520, "uuid": "eeb6f82d-6cb7-4dd1-ac0e-e45cd3b661e2", "value": "New Purchase order.R20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a475f749-9bbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618252867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252867, "uuid": "bbb4f349-2aa5-4af3-8c18-351974499373", "comment": "Malware payload (AgentTesla)", "value": "2a39c7e2a2d9ed686e08dd32483f5ed4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252867, "uuid": "a488c95e-11e8-4213-b7ec-16f95b45d155", "comment": "Malware payload (AgentTesla)", "value": "1b13da06ef3f63ee35fa6ed273eeede380b6ffce84b933675a52f1a60058b529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252867, "uuid": "900d084d-a22f-46f4-84e1-acfabd72d75a", "comment": "Malware payload (AgentTesla)", "value": "4553afc5c64f803c5c02d56d6460e87707432cd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252867, "uuid": "7dbc6744-7bf2-421c-b93f-1bb1c1fd2185", "comment": "Malware payload (AgentTesla)", "value": "ef2da1c484a14936f35f6df62c661658cbd36ed1022f109cbec7ab30f6e5e25667ad8b2875cbec20b3ebe00455417ae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252867, "uuid": "2202b91a-216e-4078-90b0-42f0bd8bf6ac", "value": "9C05E02137E89B09E0BEAB751C34918417F1F846EB31CA0E3E94554D4D72B818A77BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252867, "uuid": "503e850a-0e76-44dc-b3bf-a19636b0a248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252867, "uuid": "adb21331-7353-447a-84ff-4b41a04c8435", "value": "12288:iFbBqC6JbrXicK0HZyzeXMThtaxtxqVGffIf5+RSumJMReoER0EHl0pjP94/trK:if+3yyMT6IQfxRIEEbl0pjP0tO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618252867, "uuid": "f5e4dc01-a11d-46c4-9893-09fd82c111f7", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618252867, "uuid": "35c8faf0-6395-458a-bbbc-58fca758bfb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252867, "uuid": "2bf4a48a-ab50-4a7c-bbb8-251a0721ec46", "value": "2a39c7e2a2d9ed686e08dd32483f5ed4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a52e9e-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618253263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253263, "uuid": "c92601a3-f879-42e3-b919-9cffb0d8cb9d", "comment": "Malware payload", "value": "cb454c163fb621bd4428587f315c432b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253263, "uuid": "0e564796-9eea-49a5-80a2-6d2b743b3665", "comment": "Malware payload", "value": "1b5b729d7d3c954efe6f4c43c2f70d130d7305b073b851bfb119c6c84a473599", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253263, "uuid": "9937833a-cabf-4fcd-9e56-e15214acea77", "comment": "Malware payload", "value": "a0e32f8cc3ca1bed6309c3c5ae4200baac7bb8a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253263, "uuid": "5f6c2b3c-2f80-4ed4-9713-ef059a2908e0", "comment": "Malware payload", "value": "ba3d787ab31bc3db55958848a563d663cfabf624794bcdfe99527c28709d077ad0b5ffc0ce148650b169d32de2c5b030", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253263, "uuid": "6c2bca73-9831-4ad4-973e-c2b10e93f169", "value": "A2157D36F1D3C437D5737A7C8E2B91A8E826BD511D2CA55A7AE40E088F392813D1D2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253263, "uuid": "05f75ce0-637f-481c-8bbf-5c4a7b652574", "value": "12288:LAlF6Uoww/SY6TB0bbg3dW3JHrvVDPjjqXtBIV0Q5VFRObABXOPOAu4FDCIe:LAboz/I6budWhdq9EROsB+GAu+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253263, "uuid": "ed1207dd-a12e-43f1-901c-e99bee7fb10a", "value": 903358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253263, "uuid": "6189d90f-188b-450f-9fd4-87252609093e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253263, "uuid": "fdc88471-50f7-4128-83b2-90fe3d3e7817", "value": "cb454c163fb621bd4428587f315c432b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6634c6f-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618225033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225033, "uuid": "a5ea2f54-bb99-4dd7-aa27-b67bf357ff65", "comment": "Malware payload (AgentTesla)", "value": "9a8808e03b68e5c7a6b92389cf523684", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225033, "uuid": "6f9ca505-70d1-4372-94c0-5bd5646e3719", "comment": "Malware payload (AgentTesla)", "value": "1cdb81091d98d217a4cdc8c570df9178e797af21a9d4b1bc39c49766322ae4bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225033, "uuid": "fcd6aa39-eb11-4548-95fd-76be326635b8", "comment": "Malware payload (AgentTesla)", "value": "a9156e69f05b27350444aa07228d4aa15799484c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225033, "uuid": "7e411733-2186-43f8-93d6-3ed115d0bcf1", "comment": "Malware payload (AgentTesla)", "value": "359ca884321b4cb47912114508ce9d011c6068732eb6a8a6b6f1d0c05f501b175f8eecd4219608062be24464197d7199", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225033, "uuid": "97c2c3bc-7e5c-46e0-b078-e68c4d69784a", "value": "DA1502512710D793D7A897B84862E7380BF47EAAAF41C70B7D9430EDBB77B294D46220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225033, "uuid": "b920d6c6-1440-4fb0-8892-7d6b4d63aa8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225033, "uuid": "3b4c6c9d-5d55-4e3d-8abb-08f14dc0d493", "value": "12288:jZOLC97rscaT4ytvT3aB1FK7CEfZgXRj9QAD1lCUUH0BgJxzKFMjvLe:jaksVMytjmFKWJjyAJUxU/UvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225033, "uuid": "02117619-1baa-4df6-8bb2-8bd931ffbd98", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225033, "uuid": "00955a7e-758d-42cb-8f4f-583daea3a69e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225033, "uuid": "4ba89254-dee7-4a2b-9aeb-128b30e53f18", "value": "SecuriteInfo.com.Trojan.PackedNET.645.19369.30388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827f1bc8-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207283, "uuid": "bc88481b-e002-4006-acde-2229833fbc2b", "comment": "Malware payload (Formbook)", "value": "ac806a34044e36a9e2e57d9c8d03c5cd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207283, "uuid": "a2467336-6c1f-40b7-88c4-ea118c934d12", "comment": "Malware payload (Formbook)", "value": "1d0adb616d93466ededea6adde68f9cafda6750bb96f8c2bc16b4353db57cc6a", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207283, "uuid": "e9816f63-4b35-439d-ba46-623065dfa890", "comment": "Malware payload (Formbook)", "value": "45d60b82f12bd038eacafee30c8effa64d43b35b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207283, "uuid": "1efec73e-cb1d-4bef-8f92-e2a9449618bb", "comment": "Malware payload (Formbook)", "value": "fe46e00feff86fefc037fe65fc8faa12fae1e53513025bd9245bacd5b4f95289d6560a741c698e432b96b6d32bca523a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207283, "uuid": "4dd09965-3110-4f66-a4d5-f1f25286d9a2", "value": "52142329F7FF996DF09C2E79D95ED82889E40CA84472A1784AE51BBC61410BCEC17C0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207283, "uuid": "fd3917d2-b872-49c2-8430-e65e7198ff32", "value": "3072:h+GHDpX4soWDH+Hme8ldRGVxIrp5DtonaQ/awvTAfuICBPB+8ScGuMrC7uiMFXTU:hdjus9+v8lwMvALmuIC/+8SOMrC7uiMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207283, "uuid": "a0666062-71f4-469d-b819-4a5337a5574f", "value": 194325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207283, "uuid": "11a17fdb-350c-40e6-843c-1ba90772050c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207283, "uuid": "b7e8747f-0b83-4d23-b28f-37227b501493", "value": "PAYMENT COPY_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc33b85-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618229985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229985, "uuid": "7e82a795-33d7-418f-9b38-a3383da2c2e1", "comment": "Malware payload (AgentTesla)", "value": "36a7049a4f3be8788f0c844319a5364b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229985, "uuid": "69a76764-b235-4e1a-85c4-0d90ca4ae844", "comment": "Malware payload (AgentTesla)", "value": "20251c86adaf2dc2cf0513e3dc83e78a768d1b016e0dcd738a0e55d3ba7227c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229985, "uuid": "5ae31145-8863-4a90-87c6-b9476b21552a", "comment": "Malware payload (AgentTesla)", "value": "fbefd649daddd22154920dcae7dc79f8d6a036ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229985, "uuid": "c5375d3a-ad6c-49aa-9521-2d7d07dfa1e1", "comment": "Malware payload (AgentTesla)", "value": "1288dab15baeadc568ecddc1a093b5bae6882cd705dff0dacb5b4f7b71d5b5100ed03e3a997410115c2d6b8e6925cc7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229985, "uuid": "e804400c-a2b9-4957-b063-592dc71ddb03", "value": "DB05123827D89D07D9BE1F7964F0921413B4B121AB23E71EBAB8606D0F727D5872B316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229985, "uuid": "b15773af-bcf0-4e39-8a43-6f5c5fed17a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229985, "uuid": "bcf236cd-461a-4141-b142-44546ad1bea8", "value": "12288:z63pA3f95jKm8HAKA1bBSxvVa6VsOMG6e46bXxec0N4iAhAMLsguzxWYTlK:qpa4m8HAKA3SNqG6jgvCyyhdxWYTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618229985, "uuid": "93ed5481-d1f0-4116-aa25-fa317bbf9db9", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618229985, "uuid": "e70c32cd-10f2-4451-97b4-4b85bb869e32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229985, "uuid": "512e5bc5-da46-43d6-af07-e91b8ddf1f96", "value": "VJNPltkyHyI3CCo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540bed96-9b95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618235122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235122, "uuid": "d17444b5-03c9-439d-8690-853bba2c9df0", "comment": "Malware payload (Formbook)", "value": "92cb9845d9e44ee6318d47283da092cb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235122, "uuid": "879bba55-3c35-42fc-b4a2-4f6529466929", "comment": "Malware payload (Formbook)", "value": "2080ae2cfe843c0e1754f994b356086718dd6dceedf974ca37b629fb4da817a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235122, "uuid": "4a7a6789-e3c7-4cb5-a70c-18c18954b43f", "comment": "Malware payload (Formbook)", "value": "c944397b631e2f4114af182e02e015580952204c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235122, "uuid": "837d3b36-d5e3-4625-ac99-d812c00d2bce", "comment": "Malware payload (Formbook)", "value": "ccac6c8fbd57b3d67805f72b9a65f70b02b0745cbe0e4a0034703831ad36361958af422e2853b19edd96828513558035", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235122, "uuid": "b89788d0-72e0-4616-84bb-c485396a1714", "value": "5924121B66DB9C7BF58199320D7BF77AC1BA43203411534727818FA3AB1A683CB192C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235122, "uuid": "5029b44a-f782-4cd3-aacb-298d7abe0313", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235122, "uuid": "459b5c5c-d623-43ac-bd28-6bfcdc7bc2d2", "value": "6144:Hd5dKTJjcc65cHEg31M9mRzmYi05oIwi6dnSEcQi4oAhv:b0TlfHEMXEYi6oQqnRi4fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235122, "uuid": "6fc4cc90-2d88-40b9-b9aa-99b8e071667e", "value": 228096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235122, "uuid": "5e491380-fd4c-407a-9fe7-946cac2f159b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235122, "uuid": "eca5ecfe-0c01-4c78-810c-272ea0247038", "value": "SecuriteInfo.com.Trojan.GenericKD.46060611.6470.18175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a035aa-9bb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618248302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248302, "uuid": "e0fa82d4-9866-4d0f-a58d-74b975c32e6a", "comment": "Malware payload (Formbook)", "value": "c7bdff233116ce2056a461117080bf14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248302, "uuid": "773c9bd4-1c08-4670-8dc4-4674fc38789b", "comment": "Malware payload (Formbook)", "value": "2083ab1a1176b41ed9264ea35b404b5c99737919e29d318653588ae75cbb0e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248302, "uuid": "919a8c8f-c2e4-4076-89c4-527d0d236de7", "comment": "Malware payload (Formbook)", "value": "1f725c59d49370e7546e388485278638579400c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248302, "uuid": "12a256e2-cf71-46a2-9a08-1515f595aea0", "comment": "Malware payload (Formbook)", "value": "c6578f29a4056857c0e7ad8392f605d48c26612951a25f01fd21d28129042e79e81de14029981794a6c9afe36b71c6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248302, "uuid": "45d3b442-1b13-4a54-9ed0-d9a68778b550", "value": "AA05D12033E88B5DE5BE9B391C30914407F2F946EA31DA0E7E94558D4D72B81C663BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248302, "uuid": "f4f7d3b9-0588-4745-ad48-3914018ea4ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248302, "uuid": "09488586-582f-4279-a507-699e0980d77d", "value": "12288:X5FMNCUNmNiSjO1PiFWHMX/vtqNiKyRihVm95tPjaoTFInwYJbLK:X5F2a3O1EWHMXNEiKyRi3cgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248302, "uuid": "4568eccc-63f2-4445-b6cc-8f4b2bd3bc60", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248302, "uuid": "dc54e6e3-cd0c-46ca-a05a-f35c3839ac5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248302, "uuid": "b00ccbfc-fa3b-4a8b-ba3d-2aa018955bbf", "value": "Nuevo orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060536e8-9bb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618248306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248306, "uuid": "185f0e11-8fe1-4850-8878-dab5c420eb95", "comment": "Malware payload (Formbook)", "value": "ef3a903ab8e9d9d8c891bd3329a5eca0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248306, "uuid": "bb104d52-709c-4386-8558-0640823b18eb", "comment": "Malware payload (Formbook)", "value": "221db5644aff21efcfb29d38a08d7dc06a3c4f4a476c17b63e87fc66044252df", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248306, "uuid": "e82a9932-dd60-4f8f-a74e-be491595919b", "comment": "Malware payload (Formbook)", "value": "86f7d3b903a30a21b69cf58f6a3571e1475518d2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248306, "uuid": "3f057a32-3fb3-40d6-b90c-11596cc3d9bc", "comment": "Malware payload (Formbook)", "value": "8accd561350348b485be3d4ccf0822fd23c24b4016fb74fd9aba9f13e395dc25078130f2e9b41106adeace77e5baa4f2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248306, "uuid": "69844ddb-b642-446d-9457-e571d7f71e07", "value": "F82412DBFFE4FA42BD4508B9393025221C0366443BBBFEB9FA0A2DAD417818691D5DD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248306, "uuid": "242f6f3e-cce1-4a2f-a70f-cd791788d291", "value": "6144:Lx4T+DuP2miUKhYsNW3LuVYids8OxpSqBIfE2Ns:Uqu8r3QyOELJqDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248306, "uuid": "3ea33e33-28e8-4a73-a8f1-35bffdfd39b6", "value": 215255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248306, "uuid": "da6d1a11-3908-49e5-9b1a-13bc84ee0421", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248306, "uuid": "29ee7eb0-47a9-4d07-b7b5-43f3fea78a47", "value": "Doc.70035.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15783a2-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618208730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208730, "uuid": "c80b9d12-0fb6-43af-8e4b-46b2f69d54e4", "comment": "Malware payload (SnakeKeylogger)", "value": "5f7e40ff62fc754e28f53ef784bc748e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208730, "uuid": "c2499f7c-9ff3-45e2-a339-e27ff85318f1", "comment": "Malware payload (SnakeKeylogger)", "value": "22c484685b9a66dd6cd81db66c5e6696cf07751f1b2badceab02fb873382de67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208730, "uuid": "78a0a8a7-9c6e-4df8-9649-a2111867436a", "comment": "Malware payload (SnakeKeylogger)", "value": "58dae7ba0cf8c986eaa1921fc3aeb4af66c21097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208730, "uuid": "3917976a-9b68-4567-9665-fcca22fe58e9", "comment": "Malware payload (SnakeKeylogger)", "value": "d87b41574cc06a495a64f343eb911b503f824426e0b4ae30d9259b9ed70270f4cddfdb565b5d936f0ba9613ce53cb3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208730, "uuid": "6f76e160-0a1d-47e3-bd0f-7eae21392def", "value": "43056C7C32507ADEC9B7CC329DA81C20FB68A466470BD617A06711AD9D1DE97CF340EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208730, "uuid": "cbe833a6-9450-4c3d-ae32-49447a996ee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208730, "uuid": "5953fea1-9028-4c6c-ae48-3d000fbc866a", "value": "12288:iPanQQ4RXa5BdpZfcvNq1HSclsSEvI0HMm2Bi6nUWUHqN66KwSAThYtBEFeRu+bW:JnQnRXa5LpFcvNYHFlsSEAcaUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208730, "uuid": "c0fe56de-f6ed-483e-bdfb-fa5da2b2f30a", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208730, "uuid": "4528388b-01e2-411a-acdb-8201d2546ba2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208730, "uuid": "0672cb45-06e8-45d4-8384-195b606cf82d", "value": "PAYMENT RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d73cd3-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618236006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236006, "uuid": "f05404ee-8c91-4862-aed1-cd1ed836edf6", "comment": "Malware payload (AgentTesla)", "value": "0d0559bf1874823edc7a058c532dccf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236006, "uuid": "a8aa883d-ab7c-471a-a6d9-b42ec4572352", "comment": "Malware payload (AgentTesla)", "value": "22f8962aaee85e57df28767252e009dc4325348054250d5fca53365a58e68fd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236006, "uuid": "99564e88-c59d-4542-8486-333674a31ea7", "comment": "Malware payload (AgentTesla)", "value": "63ea33e0fc2d3b21f80119007dbb45f559e35b17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236006, "uuid": "5d9475e3-d634-4f38-8170-a18242b9a1f7", "comment": "Malware payload (AgentTesla)", "value": "2f7a02c7192f391ffb69bcc820325599ab8cb56ffd6e70cb5cfa6e35c6d8b7ca9d3c495c2b8d3a54cbb52cf15f7fcda7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236006, "uuid": "0c4efb84-5b60-471b-9354-91801533514d", "value": "75E412247395C781D66983BA9563C8438336F1DC2927DF5D0D9892C83839B8CAED5EE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236006, "uuid": "94dd3a5a-81ea-485f-be5c-ba2af0a8338f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236006, "uuid": "c74f4a09-ca81-47f7-86b3-3a5570c6bdcd", "value": "12288:z2iNnvwptDhFK417vuTVwsEe48UmEekSHT8YPe9JMuX:z1twptDrK417vuZREe/9EekMeTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236006, "uuid": "42516478-6f6f-44a5-91ec-dd989a089305", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236006, "uuid": "c624d7cd-4157-426c-8185-71b97536af0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236006, "uuid": "8b882b5b-8477-41aa-b488-4362637916a5", "value": "SOA 4-12-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c19ef0-9b9b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618237675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237675, "uuid": "bea42ba8-db56-4e55-a38c-521c4ad7b29f", "comment": "Malware payload (AgentTesla)", "value": "b95bacc319f509d6e4e7a90cbb03b02e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237675, "uuid": "0e3e01e6-f9e4-4b43-813a-26d15abea57f", "comment": "Malware payload (AgentTesla)", "value": "2326735859de22f42915e84eb501630dc24098340e01d255fefb77f2e018d324", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237675, "uuid": "93bda467-6522-4155-9836-ce142cd49272", "comment": "Malware payload (AgentTesla)", "value": "d7d12cd86c4d21992df461f0b99b6673db702ce9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237675, "uuid": "abfe7ace-e57d-41af-8b81-93b8bc1bf041", "comment": "Malware payload (AgentTesla)", "value": "f1b79e05540b7cb773f921302380b30a246fbff23e5b5f33e62df2799b79d811ed441aee5e06e91f0f65ff67e0e5338d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237675, "uuid": "3e8b653e-8735-4e6d-858c-9c36c688e97e", "value": "AD15F13EA648DD10E5BD0B37D9E59520A235FC026B63D37E29E1396C5FB2FF81522206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237675, "uuid": "5e412130-79f1-45fc-9daa-97189be63bbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237675, "uuid": "449225d7-7c8a-4338-9671-c64da101c862", "value": "24576:E75aaucXCg8U+PMQLm9c7XU8UW+LWYTH:EFIG+L00k88W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237675, "uuid": "c6989361-a0de-496f-9d65-a116af2f3b30", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237675, "uuid": "119af2ff-df17-4032-9183-f9b01064308e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237675, "uuid": "a186418b-4765-460e-a389-6a846a634068", "value": "COMPANY PROFILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7b4285-9b87-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618229175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229175, "uuid": "d879c7f9-9350-4d80-bab8-feed5ccc7a0f", "comment": "Malware payload (AgentTesla)", "value": "90f1ca6638aa4e020b815d9177b6ee5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229175, "uuid": "8a436790-78eb-425c-a425-e899aefe3ac8", "comment": "Malware payload (AgentTesla)", "value": "233f1fa61d62abafbddbfe244eafd52d804a22463b8fca069e6cfa86b05b7994", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229175, "uuid": "7e43a8d4-c537-4d8b-843a-97607e5d9344", "comment": "Malware payload (AgentTesla)", "value": "bffd7d6c2240d48fbd8406ec0d45c572030d1c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229175, "uuid": "349472e4-cd7e-4b45-9074-15774a5af046", "comment": "Malware payload (AgentTesla)", "value": "8b8a0b03504419953abce12c385bc77f44e59989e4765886cb2817504ae00fb7ce031eac815db503014e97dd9332dccd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229175, "uuid": "941f4c77-14ae-4cd6-b7d6-d79f9d1e0867", "value": "E5F4F11067C4DB91D93A47F68526A00243B6F1DE7833DF696E4CA0D6272BB0C8DE5E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229175, "uuid": "5fe2b134-0ba1-4500-b665-bf51d9a43c03", "value": "12288:JFrVP3m542egQrW11cRRgA2U8r1xTOWRNRSOwVFq7lt8v1kqGWpp:r1h2U2uRRg/fNC3qxBNWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618229175, "uuid": "6bd335ae-58b6-48d4-98a4-3fa3a2327f85", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618229175, "uuid": "10d5137d-81e5-4317-8b67-b9fc123e5a58", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229175, "uuid": "82db4368-e89e-4363-a514-5a820df37c85", "value": "PO#011.PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab73093-9b6a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618216907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216907, "uuid": "89fe8396-ea4f-475b-9c2e-7f6a7e75b7a3", "comment": "Malware payload", "value": "6e0512d2d80bb975459b61c95063b31f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216907, "uuid": "8fe1d3f5-deb6-4c13-a72f-f6d2cdd3aa99", "comment": "Malware payload", "value": "234513dc02d0cd4c655140de663de6ec2d41400b861b97d2e8c447fd3e0e5f0b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216907, "uuid": "c3dbf5d8-6c7e-4fa5-abb0-89013549221a", "comment": "Malware payload", "value": "234fe5699f640011eafef4291d4b9d0ebf87a5b1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216907, "uuid": "12bb3f7f-e457-47b4-abac-10d376dba3c6", "comment": "Malware payload", "value": "6d54b7aa5177ae7c8a5c95e492908f2ff97beac79c39d65aae3583e8ef9da13f57e87e5ee88cb04de5b5bf7d899fd0f6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216907, "uuid": "d78b0305-b01e-44fe-a968-9172d463907a", "value": "D0E423624B699C1CD38994AA57E5A29D71BA4487A0ACF07CFFBCD7D3408C702B4E75A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216907, "uuid": "4846cf13-8517-48df-857a-fcf998c4940c", "value": "12288:IbVbpRMGHE+TYTjiZ4Mf7aYjd3AG3vK7WWEX/cXgkhl4u+vUswsNhmOuBvV:EeGHdsTjV6aYj9AG/X/cXgWaPUsws6OE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618216907, "uuid": "4ee3d8b5-b888-4e1d-9f34-be5d44388a2d", "value": 657893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618216907, "uuid": "ba0e36c7-89a6-41d3-b32d-1352eb31f0e5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216907, "uuid": "3bd84532-b229-48b3-9500-e726b8d639d5", "value": "FRITSCH052021.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db234ee-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207946, "uuid": "726ee4ed-6bc5-464d-935d-9def111b9895", "comment": "Malware payload (Formbook)", "value": "4378fa52afd2075333d20acb48add489", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207946, "uuid": "47a0e672-a596-4ca3-84f9-de07d936d8ba", "comment": "Malware payload (Formbook)", "value": "2380824898738f7c2781da1b32cf11286cb8c6aa1dc57b7eb0f611dee03d7c9f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207946, "uuid": "6442ac4f-92de-462b-b832-8261bc211bda", "comment": "Malware payload (Formbook)", "value": "10fa1ee7717ddff870b3ee91ca3b8959b1db8837", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207946, "uuid": "ba1bb7f2-a7e8-47e1-bd99-46f60a44ab84", "comment": "Malware payload (Formbook)", "value": "333207c969e1cbc23a1196737afcafb728000cc2b75814670860d2bf300fcd4414340cfaa81fd66f5f983a66df061d12", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207946, "uuid": "36960c95-ed29-486a-a9cf-695e829dfddb", "value": "D6242227C89FA7A570131C77E7398AF1E89059EA4DC6D101AC87EEE99302C9C219C5DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207946, "uuid": "390663e9-07e3-4a93-ae7f-5b63e1f55ee8", "value": "6144:Esu+/lacea3eRkBs+IgrUL3t06bcG6dvsdnleWu:EsxlRnBYTH6dAlev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207946, "uuid": "b35d588d-45b8-43f0-a2cf-4308f8fc1b04", "value": 222016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207946, "uuid": "bfda8bac-a7f4-4911-9ece-740a7cba5f38", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207946, "uuid": "eaaa47ed-34c5-4f50-ae8d-d9b85dee53d1", "value": "PO652_009989.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b16e5d4-9b51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618205794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205794, "uuid": "44c684b9-0821-4220-9ab3-be35f8d740b9", "comment": "Malware payload (Formbook)", "value": "964eb54177673d61d8df505f79d93447", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205794, "uuid": "b141b2a8-6c2d-431f-9743-73a5270e7573", "comment": "Malware payload (Formbook)", "value": "23873ddb9361cf28d8a648d2d13bc1aa70989821e6ed2f50526376e23edb1a4b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205794, "uuid": "d634ad7a-01c0-4684-8e23-4e39b64fcb22", "comment": "Malware payload (Formbook)", "value": "9481780244c32d2b40455114ed5c0cc86a0382ec", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205794, "uuid": "4fdd181f-37fb-4efe-ab43-edd936059ec4", "comment": "Malware payload (Formbook)", "value": "defc79faa01fbc1889ace9a016ef182f54a7bceba72ccca65dbbddd78b6cd31d725751f17dcc2ae44a786dc9322b90c0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205794, "uuid": "75e57c9c-07ec-4fd2-95d2-77fc012561f4", "value": "68A533E358CA6712D42FC0B5CEDE486942F69E252D24CD967A9C327632356302BD0B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205794, "uuid": "cd9f659d-137b-4c1c-a2c2-a105d5644911", "value": "49152:S++VOAQciTpsJEbZSuPVB5O4J9G/CTn4eQqxbQcr7kl:SNVjjYps85nQG9GaT4e7xUcrgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205794, "uuid": "277d4eb7-8e58-4895-9145-21a8200f083a", "value": 2179072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205794, "uuid": "f1b67a63-fe69-4134-b6d5-53377952a879", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205794, "uuid": "654d3f4e-e5ad-443e-b65e-70127863f3e1", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c687c0-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618207956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207956, "uuid": "35ed26d9-6be1-4877-b459-88b16e64d6c2", "comment": "Malware payload (ArkeiStealer)", "value": "9913f058c2914afd20222350009a6cc2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207956, "uuid": "fd38fd2c-93c9-4b1d-8bee-639785f42e04", "comment": "Malware payload (ArkeiStealer)", "value": "254c13fb1111b9b3b19957b5cd7f1d28db878e2f6f58a5b9b0427f6ed27eba05", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207956, "uuid": "6f9cece9-f57d-4371-9ba7-ba0705e5d333", "comment": "Malware payload (ArkeiStealer)", "value": "88ff6adfb02407ccc02dd1a087f92d7f7febe0d2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207956, "uuid": "c6644e80-91df-44cc-869c-4970a1208936", "comment": "Malware payload (ArkeiStealer)", "value": "53cd18a4119501196efa3d73d4f74fb6e0f98c28099087a9f7b5fa47b64168199984478cc9ce603dd51ab76acdc996cf", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207956, "uuid": "09aac667-db25-41d3-acd0-a6b6bf5b3e37", "value": "651502A12A10DA53D7A887744D51E3380BF57EAEAF51C30F2E9931DDBB77B188C12216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207956, "uuid": "2084f57e-7c5e-4647-8246-9f401c06c05c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207956, "uuid": "fc2aa18d-ed41-45a4-82bd-cf8c5e0623be", "value": "12288:SKwN/40UtAWbUZqQYTl+/5hI0Je6q7CbneYujuYZal8DnDBzKQMjvLe:476cTYTlTr67ujglJLvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207956, "uuid": "a734116d-c66c-45a4-b989-2dccb86ff78d", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207956, "uuid": "b4873777-accb-494c-98c7-2080a49d2ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207956, "uuid": "7401ddbe-94dc-4308-ab14-25c462e5533c", "value": "MT103_Swift_Transfer#452-567-2XXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee40e2c-9ba6-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618242415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242415, "uuid": "1b2f91d2-27ca-4e9a-971d-421a28478785", "comment": "Malware payload", "value": "df25c2e82ea71fc6804667bd325e9b75", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242415, "uuid": "5d725f33-d9f4-4ee5-ab34-f364cfb7d009", "comment": "Malware payload", "value": "2596b722c705352a548130409b7789b9391c25131cdc60d709f2d44a4ab4e8a6", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242415, "uuid": "74cec31e-d06b-47f8-9b0a-bef89baedd99", "comment": "Malware payload", "value": "9b0ae78f374532f1ddcee10482c1b4e552be3105", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242415, "uuid": "b6798024-875a-4abb-8b89-9930604d7c6c", "comment": "Malware payload", "value": "7c0fd61c36b98ab03074e7229d23058ed6fc42ba351363ece38841062b20eeb0a56108e693f4238f793aed56367ba862", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242415, "uuid": "f58c58ce-7d7d-4f9a-87cc-d4c077f85e0f", "value": "DB54231FDDBD664EE1A2903560C40DAD2A606C8DC114B7CB808D2F7678891D7DBEE297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242415, "uuid": "3d43a44a-5b52-4fa7-a34b-caa5c24111ae", "value": "6144:+QwcZzFwZbAY7z4uyte+pqDhLvMBHNKLVWwm2m9tIoUnf5ni:7wOwGFU+puL0tXwK9p8Fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618242415, "uuid": "41a68b79-850e-4310-8781-0848746117b8", "value": 293870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618242415, "uuid": "63f53c1d-beb3-4012-90b4-9f515c41ad58", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242415, "uuid": "b8dbf60f-dca2-4083-b274-bead1f21d5a4", "value": "Copy.347563.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb16b090-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207458, "uuid": "8468f91a-5a59-4a8c-902c-f1c6a9a803e4", "comment": "Malware payload", "value": "1ba2e552ace86498cd5da987f671ed86", "object_relation": "md5", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207458, "uuid": "1fb1f216-3895-405a-8792-3929ec105518", "comment": "Malware payload", "value": "25fa5cb89251085f91cfd40717760626b211d0de0ae61019f76bde66cf00d070", "object_relation": "sha256", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207458, "uuid": "80e497f6-a534-4d7d-b847-21cc7bf5f771", "comment": "Malware payload", "value": "70a5ef5f1560380487096d3afc7a3d2e8b77cc0f", "object_relation": "sha1", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207458, "uuid": "c7f71b27-3e23-48ac-8fd2-38380c7e2a03", "comment": "Malware payload", "value": "b61f45756436e61151eca40ecbb49a1aae81ec0fb1c152b2e05e9f31590c38a3918dcfd511e17eee16d724e9f641fea7", "object_relation": "sha3-384", "Tag": [ { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207458, "uuid": "c8959c47-3e48-404e-97af-364070658b11", "value": "64242311B8C27CE5F887283B06A7AB1FB5301B1EE71E60958E9BB16DC9B502D831E156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207458, "uuid": "9553a9ba-6504-4a21-bcf1-e0f5f4467078", "value": "6144:DrllJRgMIXZSytpTT0otE70K7YjK2UIAY8Er:7XT2Xv7E7boeRY8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207458, "uuid": "3386fe2d-f34d-4c2f-9484-18e882b70f76", "value": 227236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207458, "uuid": "c46e3698-6378-4505-946f-6ce89dc27042", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207458, "uuid": "420fc05c-fcbe-467d-b28c-2a826008108b", "value": "Notas1_Castaneda_Martha.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e0018e-9ba2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618240788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240788, "uuid": "e498c577-33fa-432e-97b3-0266f0b7757b", "comment": "Malware payload", "value": "fd540e6c37d74ec2400010ef8c4b0173", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240788, "uuid": "f0b56a4a-5672-4f7c-bf69-7a5519408726", "comment": "Malware payload", "value": "264046078d721ea889449f78961637e3decac7c0209f89e48829892c4f013f8e", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240788, "uuid": "722a8f30-00df-4955-bebb-870f50c46b0e", "comment": "Malware payload", "value": "5bb0cfe06a2596bd8b25adca292fe2dea09eecdd", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240788, "uuid": "7323a6ff-53e5-460e-8da2-920482ab4894", "comment": "Malware payload", "value": "b1ce34abd7242f6c7a6cd364464999f3b3d8509907e829538ce96215e4b3ed459183b7439591052d477f95377aeca07e", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240788, "uuid": "cf1b7604-ddda-4832-94cf-1f85c966a44d", "value": "6F7312F05D31A1FFD533419817F61B7E6A48BCEE62A08B166E7BA6298C1C61402040FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240788, "uuid": "c0d34b22-d359-4f03-9c53-d9acfabb9a9b", "value": "1536:YF+AYc4CI76ZlEBAi02XGRHjVj7AgYtK1/WwAVXDmhtTBapJ:063cZ2A4XwtRYA/1ABDmhttapJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240788, "uuid": "4403c6a1-12f9-4ae5-8a38-e35c8b384d94", "value": 74347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240788, "uuid": "9471bf12-9480-4923-afac-c37c3f3f1cee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240788, "uuid": "82d975fe-efe6-407e-9275-4549bec80a47", "value": "catalogue-21.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4bf07b-9ba3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618241253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241253, "uuid": "5b4e6cb0-705f-4a51-93e7-a6446ada4cd8", "comment": "Malware payload (AgentTesla)", "value": "0ba47a5ef639d16a1bc68b7d9c2fca34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241253, "uuid": "7fa58246-43b8-4bd0-b542-dee2a05077e2", "comment": "Malware payload (AgentTesla)", "value": "26b048d3a6ed74b12a81a258814b966fa8176e18c4d88fa18ac1313903da2c45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241253, "uuid": "fca041ff-0cfb-4653-a1c4-07434f266e6a", "comment": "Malware payload (AgentTesla)", "value": "d291357fcf1a8424e412989f006b40e77fa1e5f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241253, "uuid": "0b1cac37-c2b9-4798-9a03-c10055b47281", "comment": "Malware payload (AgentTesla)", "value": "af032c8ad7e58ae16358004fa958b95a9e054e5fee073feb1804e83fe3e4951f35d3b02a70eba4487c6c921e1771aea1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241253, "uuid": "232590a8-1963-4c81-a0ee-1afa6d8e9501", "value": "9D15CFAD365076DFC827CD72CAA81C64EA2074BB531BD203A01716EDAA4D69BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241253, "uuid": "68201aba-d2a9-486d-a243-61cba605909f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241253, "uuid": "28b9f018-880d-48ba-9992-e3495871b826", "value": "12288:aodXQ2/ifIKwgC8f0I8Gw7wWRJfBcqv83ME1fh27i7eFJxU7yZwmtWjnFJTHj3iq:9p5ifIR8F8GoR37+fh28J73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618241253, "uuid": "b7bfc3a7-f2af-4d03-acc7-c05fb215741a", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618241253, "uuid": "21399938-ce90-44a6-93c7-4c4a1d838d27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241253, "uuid": "01138c06-c6fa-4ce5-b6cc-0641a48bad47", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8751f0bc-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207291, "uuid": "b6a2473c-4694-4e59-a13c-f70b11b03983", "comment": "Malware payload (RemcosRAT)", "value": "39ca00debcaf7f4f226c55bb503aed17", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207291, "uuid": "3ea0119e-cbc7-4f59-8b1d-56e54c724877", "comment": "Malware payload (RemcosRAT)", "value": "2853836d84c9e62f4abcbc8be750267b72631bb8d0039e5e8d2f45641c4a46b6", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207291, "uuid": "c8c4982a-40ab-483a-ad20-498dce9d6c21", "comment": "Malware payload (RemcosRAT)", "value": "8d079a7b0217cc8abb50f051d53194a1dcefe8cd", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207291, "uuid": "a5b7faa8-6817-4477-ae93-c6f4f95001cc", "comment": "Malware payload (RemcosRAT)", "value": "7f530812ab5f79429fff02b400420527cc8ada0836ca036d6ababaeac38f2d6129205a427e516daf906e8224f0208ef1", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207291, "uuid": "86f907dc-8ede-486b-ad37-94cfeb4c9ee6", "value": "B493CF42B50152F9EC3C4671DC33449A0AB53D7F629125BE63BEFF281862387496BD3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207291, "uuid": "92231676-8213-487f-a8f5-9e4925d3271d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207291, "uuid": "a483acdb-b938-4a2f-b029-a324787a0aba", "value": "1536:Om0EuDMniUobi7DiGl6UysCoNcG3TO6gv2I/SX0Bxi2Y:JBkMggZl6UqoN33T4v2CXi2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207291, "uuid": "48bb605f-061e-44d1-80ae-581ab076a316", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207291, "uuid": "6afce99b-e40e-45f3-8887-e404595fdbce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207291, "uuid": "ff3c4dd3-8e5c-4127-9793-71e05cdd6863", "value": "Cobro Juridico_0291662728_7023446_452487041454723_016698_5192136884256735776_2301761820735_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2916888-9bb3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618248166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248166, "uuid": "0d10642c-9793-4987-bd5a-11e54c4cf042", "comment": "Malware payload", "value": "af4c749508c43b22a65112b5236ed31c", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248166, "uuid": "c7675e38-80fa-42a9-94e0-92956ddf2495", "comment": "Malware payload", "value": "28e6b8ecae6692df4f9e19f5f4447351c4baf93233676e846a9d8fcc70cc5da6", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248166, "uuid": "d67d3b7a-bc89-489e-a7a3-e98aab848142", "comment": "Malware payload", "value": "e32f704b61c9ff44fc72b84be99f72b9dec94b12", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248166, "uuid": "5e1dbfbe-ed7e-4aa1-8e48-a1cb204119de", "comment": "Malware payload", "value": "b4f2cffd36fb3b392418d634c0239a07e3970160ce5e1f88984c77c42241bb22e32c7852dd716562bb0ac50a152f8157", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248166, "uuid": "32a2bf31-12ef-4958-b625-a2cccfb11b5f", "value": "5A64231DFC88395CE9855D73109C05DF7B30ACAD9A04B6C1418D2A32A9CE6D6BF9F386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248166, "uuid": "f42430a3-fb1a-4ca5-baa9-78e5db32aa28", "value": "6144:lNZ+SrbG/AMRKcIC5RuVmhLvMBHNKLVWwm2m9tIoUnf5nk7:DhfHFF2L0tXwK9p8Fk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248166, "uuid": "43431f53-2ec6-49f2-b0d2-81e3dbb1221a", "value": 311610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248166, "uuid": "61b2c27d-8ac4-4d5c-ae6d-41664e798a1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248166, "uuid": "d6cb8480-c15e-474d-b8c1-fe99ff91e75f", "value": "Invoice 962.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73146c95-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618209405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209405, "uuid": "e46edef2-4cd4-4d8e-aa8b-8f7cd95bd7e1", "comment": "Malware payload (RedLineStealer)", "value": "840e844757113c05dc8618397202f357", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209405, "uuid": "718eb663-d850-4c26-a6dd-aabdf783f677", "comment": "Malware payload (RedLineStealer)", "value": "28fbc35964c5a137d5e4bb2c770fbc6674d26fe478e18a0759e0647a44cb0d54", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209405, "uuid": "bcf96bd9-db54-47df-be11-fc678907097f", "comment": "Malware payload (RedLineStealer)", "value": "da645fea1df7fd2cb07f9e8bd388bdc6e04c4750", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209405, "uuid": "4643da83-661b-4edf-8fda-5a9ea42fb0cd", "comment": "Malware payload (RedLineStealer)", "value": "9e7cec6695b3822cd675022c6ad320addd8024235351dd4160c2e9977652392985a0af445073f14c8e2de700c379a6d4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209405, "uuid": "378dfc27-6382-4dc9-92ae-f19e1f5dc22b", "value": "C475CF007E45CC91E1992677C98B81744334ADD0A65FE73FA9E933AD11323EA7C899CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209405, "uuid": "fd607630-5e5a-4694-a271-85d6655b3be7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209405, "uuid": "176f52a1-2343-45c7-a205-af38ce1fc4e4", "value": "24576:YBr+NHC/DIsyRlKz3KDAyC16fe6rKTwokfsQIpt3bmv4dP+sfp2E:YBSC/0F4GMAPrKTisQIDrmpypb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209405, "uuid": "a43c8abe-b74f-4802-8f83-b457f5b906b6", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209405, "uuid": "7169b320-a535-4398-83ce-41bc6ce46d83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209405, "uuid": "6d1865bd-cea1-4092-b0fa-b2e8a6bc067f", "value": "clean(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aabe48b-9b79-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618223134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223134, "uuid": "35aacef5-07f8-4246-8057-c215a7bf5709", "comment": "Malware payload (AgentTesla)", "value": "a71fb3b529bfd42e087d5534f172cb2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223134, "uuid": "52177afa-35b9-49f4-8bbe-f821fa19ddfc", "comment": "Malware payload (AgentTesla)", "value": "290dec69fdb0449c8946967cfae069caa852b69cfaeae41ad68bc5a1d629bf68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223134, "uuid": "4c774a63-ff6b-4fd0-a04a-b042eabc308f", "comment": "Malware payload (AgentTesla)", "value": "e2851d87c9ca584be8c588b62d5b6674ce88fb2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223134, "uuid": "ed071467-76c4-47cb-b38c-74c9e3e6a07a", "comment": "Malware payload (AgentTesla)", "value": "26a7875a5bc533c65fa791e82f1808a852cb9d1a74f63bd2909e5c29e8af652dc357dea54349547c12930b0510eb6a89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223134, "uuid": "d689af9b-3d0a-4d31-bf9f-45e30b155e0a", "value": "05F423B4C270EA218982754C47D3FDC3A8A59FD8587BFDEF81FA4544A56A0B0DE7122C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223134, "uuid": "1ef7fb38-b90d-4f1d-84a0-c049c03d4856", "value": "12288:0+6aykOpikARZgjS77JfTWSeVwIycnqOP3AcCsPjUXYmhlp5X+yyywsySxNY:0+6ajqsftd4w12X1C0jUVfTOZY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618223134, "uuid": "5dfc40cf-f2b2-4cf2-a97c-88293b9cd35f", "value": 727813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618223134, "uuid": "1b06cdde-6d02-47a9-899b-77b58e7d930e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223134, "uuid": "966b9dd1-91c0-45b3-898c-f26468a59611", "value": "Remittance Details.pdf...rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce25708-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618233392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233392, "uuid": "b1f4ae39-324d-4770-95f5-338191068e44", "comment": "Malware payload", "value": "a01c6a3db8e862ab85386b6700e941bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233392, "uuid": "48c2db99-175a-4841-9b94-5293f6b76ed2", "comment": "Malware payload", "value": "29859bac1ca73683bf6c9ff17a91d249d0fa9ecb18b6b03ef03cf17545fad2be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233392, "uuid": "ef02ce00-2e9f-4d9d-9fc6-dc3ba30cfae0", "comment": "Malware payload", "value": "40a1b88e94c9268e7120e48cc0b64f6b20779a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233392, "uuid": "a864bda4-4e06-4235-904d-cf3acb4c5919", "comment": "Malware payload", "value": "8e4dde235580fb0215760669d503aeafcf9925336e15f2c9d708a17f33a3dfe7cc6f9a2a89c10926a81f0cb1e51bf61a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233392, "uuid": "4638fbac-d054-4294-b391-f362d9758db2", "value": "7A622B01BBC8467DE26A073B9C719B6956F07E25D702EF5C15C4391E2E3278E0692B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233392, "uuid": "af516f76-633a-4d11-ad6d-607a8d976f4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233392, "uuid": "d030d780-5c7c-449d-b01f-1b3725278af0", "value": "384:M87FybegpzmEDTO4jCCNWiElvkr/sV3D0FX0XRno5J:M8pjgxNMZ9SkBnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233392, "uuid": "62d29d2b-bd56-4f1d-a2a5-0a90ba8a6870", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233392, "uuid": "87c4bb3a-5c20-48b2-94d4-b6e7e8f21937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233392, "uuid": "d8366f3c-f076-4b0c-a7bc-f4485c20ed3c", "value": "scan_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea867cb9-9bb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1618248260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248260, "uuid": "01f2ad90-c6a0-4af4-88f4-f31b30cd1274", "comment": "Malware payload (STRRAT)", "value": "d7c932c04b0b703ec6bee5c11b79dade", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248260, "uuid": "91fe7bf6-b436-4cce-8fcf-45bc29d1c3ba", "comment": "Malware payload (STRRAT)", "value": "2a6a3b74dcda911c57176788555fc532f6403358c7fb1b415e381a077eb95031", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248260, "uuid": "727e7b8b-6c24-4378-a795-88a74d070164", "comment": "Malware payload (STRRAT)", "value": "10e68cccf444c9f25a0fe2c51b22980e31811d33", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248260, "uuid": "75a5c7f4-e232-4eff-853b-6a24d0db5623", "comment": "Malware payload (STRRAT)", "value": "52d51e3e4bb57b74ad1868cecbd6664ec9807a99a70c9d0a4842e247d89a6aea69e556093bd8670279be4dbcceb226cb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248260, "uuid": "cb6c22ec-5963-4149-bc0a-3db5f34f85e5", "value": "03A3CF2EBCAB81F5C15B52B2202E6222E74B51D9E512A03F36FC45859EF0C7D42539DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248260, "uuid": "f3b3c3d5-be04-4a29-8ad8-52a2f3705360", "value": "3072:AB2g2eVpFQmpn2K+tjpneF/CsqPHqDw5ytxl:AB2eV/pM1edCsqPKDNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248260, "uuid": "821c5ff1-f644-4170-8494-eae1241f8a35", "value": 99085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248260, "uuid": "ff3bda4f-2dc1-4dbe-91e8-3bc0aba13710", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248260, "uuid": "71717e24-ec54-4627-a0e4-e757c34ee210", "value": "SKMBT Request_ Quote RFQ _ PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b454e9-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618253268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253268, "uuid": "7dc3ee9f-b50a-4c6b-a050-6617d4cf0b36", "comment": "Malware payload (AgentTesla)", "value": "be64ba16260fa8f15fe08e3fbcc32a0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253268, "uuid": "8314245c-9f80-42ff-996d-c1928f12d8f9", "comment": "Malware payload (AgentTesla)", "value": "2ae9d3570e2167f65c181acc99f212c4c9ee048d67305d22fbf20a290cc3c591", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253268, "uuid": "5317a362-656e-4266-82f2-8b933e87e967", "comment": "Malware payload (AgentTesla)", "value": "a50efac30209e9404ce82fbcf1462460e14e335f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253268, "uuid": "696d4331-6457-4d20-89b7-0ca025c13d32", "comment": "Malware payload (AgentTesla)", "value": "d29b605ccfee0dfbca6db97850746a8918e9bb3a221011d1afec1107f9832c1e5d4be28fda90430b41f19afafac23cf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253268, "uuid": "dcb47092-13b2-4aa9-bbb7-ded51462b462", "value": "48D4E1E27C80107BE987AD3412EB1735F2F1A6E36B72988449955CC8C936FC5BD1EA4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253268, "uuid": "5d5f5fc5-ce04-43fb-970c-2cd7097d56de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253268, "uuid": "ad5a2231-79d2-4f5c-9bff-3cdaa6e989f6", "value": "6144:G4eMc/D0ulPavWtxrHf1xBh9ELOrrAKyXRLA3XnmfMUlZUawPlgiZdfDIKwX:GDMQxScdHNfh9E6vO+nnoMUlZibDfcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253268, "uuid": "a7580bfe-4869-47dc-80c1-1c1f80cafd51", "value": 628384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253268, "uuid": "e3f81994-c3d2-4fb7-859b-f110a70041f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253268, "uuid": "b198a528-1c9c-4f73-b17d-28db659e2b1d", "value": "be64ba16260fa8f15fe08e3fbcc32a0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ef2858-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618209374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209374, "uuid": "c229a983-024d-4185-8edc-04cc6d90bfae", "comment": "Malware payload (RaccoonStealer)", "value": "000e43fe0944da48d0e033d95a7cf1e0", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209374, "uuid": "95a16191-e6a3-4e93-8424-2690eab1f989", "comment": "Malware payload (RaccoonStealer)", "value": "2b2b2b7bb20ce4a49a3e58b7177661c6dc19aa01d1550ea6a352ef92a3ee99b2", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209374, "uuid": "30468c6b-e041-45ef-b699-cc974613d4fb", "comment": "Malware payload (RaccoonStealer)", "value": "8bd058abdd9e9eccf66577e7df849099b864cd13", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209374, "uuid": "36ac978b-712a-459a-af32-e33406838457", "comment": "Malware payload (RaccoonStealer)", "value": "6b4cb52d7332ae24a1de7787e01936bf2e9c1b8b4cd5717454607e4041d6c0b9ba90c66f08f90c3d827f20fbe88f9b59", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209374, "uuid": "630e3b5c-beb8-470b-9c07-94366bc76b3a", "value": "9E64BE1133E0C133C51364758625C7B18E3BB471AB75A9CB7BC40FB85F296C2AA3A70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209374, "uuid": "b5d8a659-5019-4bf5-8386-b28b52b7102f", "value": "5c9f82cdabd8e2926163412888fe3f28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209374, "uuid": "cca8a2be-4285-44bb-8f6f-9d427d90dcd0", "value": "6144:FFRkpULl0VzIwFm8fEzHgLH4oAvGb585hAcBToHtX:FFRbhkIyjkgLYoAvCkAcBToHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209374, "uuid": "a7b31053-7790-4782-8dff-718c4385ccc8", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209374, "uuid": "0624c7ea-fb0a-4bad-9503-b428edd7afc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209374, "uuid": "9e55b8f3-c47c-4756-b912-d434507e54c2", "value": "setup - 2021-04-09T114140.132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9a327b-9ba1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618240160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240160, "uuid": "ecc2c117-e26c-4658-9006-1288bc6e6d9c", "comment": "Malware payload (Formbook)", "value": "b381c3b3ae648607a03a7bd2e9a57ef0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240160, "uuid": "2f53f5b0-3c78-4a44-b0f9-96e32d5252dd", "comment": "Malware payload (Formbook)", "value": "2b62240d040ba8b7a41dfba4873063d6e23cfbf5b01095eb6496b699c026f69a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240160, "uuid": "99dea440-6947-4271-b7d1-bbef49ac0212", "comment": "Malware payload (Formbook)", "value": "b0bef4455c3ea2c66cfd8af3a4b7cbccfc5a58a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240160, "uuid": "ce880410-ea4b-448c-a175-c20fbad8ddfe", "comment": "Malware payload (Formbook)", "value": "6550f8a3ff5b8aa43df980a02668795b4ffe1796770f33f8ba4c824e51d5f4b83689fcf5eb99c83cbeeb2a9383139b0a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240160, "uuid": "5956a96d-5743-4e77-9523-87b5183e0bcf", "value": "FCF433743378B5DD3981A86ABD570051F55402276F1A337DF2BD629A2B8CE39083DB3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240160, "uuid": "f9907f3e-0864-484b-8233-929379ab2d9f", "value": "12288:62emgQEZlpdt26ONWQhva74AMgMlHr3NdcRds0KuGoiVzg2MRbd0MkQU:vER26O3Ja749gGL3gRiYGPlMRbzkQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240160, "uuid": "2111ffb6-e015-4002-a170-6f0a06d53d94", "value": 753534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240160, "uuid": "55c269d9-e1c5-4d89-b921-cadf21bca2fb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240160, "uuid": "84e5b877-b60d-40f6-acf4-45e8c943615c", "value": "Arrival Notification - S2101280194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be80c277-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207384, "uuid": "87040eaa-8ac8-4c20-8728-e66111435bbd", "comment": "Malware payload", "value": "915dbbe84a2db4abaab347392d040582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207384, "uuid": "088181f5-a32f-41b2-87d5-ad8edd18b16c", "comment": "Malware payload", "value": "2bdc3598d5a250fc8b13524bf3ad0b58c4a62b4181449a98db58a1d195043d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207384, "uuid": "87d79f3c-9a65-4fb6-86b7-35e918a197ee", "comment": "Malware payload", "value": "1518746dff14c9b1be22e25ffa30c6f94fa8736b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207384, "uuid": "1ac07db3-f81b-4972-aead-02fd5ecc7762", "comment": "Malware payload", "value": "a36ab8106ddf6d3fdf1769432e4a11f59c6a2972837e612790f0a0f9d21dc9808bd938d1db9267c1dd1e310540a4b3dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207384, "uuid": "285a6147-5f18-4199-bdf6-98f6f1223e3e", "value": "DEE4F1A23151438AE9EE19B2AE9F856021E13DECE0D1535DB4F5B32987F335011CEB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207384, "uuid": "7d7cea65-6ae7-47f7-a636-e35e7cbd9dc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207384, "uuid": "7c3a718e-32a2-4086-8daf-09921f6233a6", "value": "12288:3TsChqY1g7+AIpaKIazID5CcgMuwS2T8Xo2i10Oln:BRg7+paKIaUD8xFWgXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207384, "uuid": "7f0a7504-2534-497a-8707-4d6d3f375aa8", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207384, "uuid": "94e464c6-3658-450a-8b48-3ecf3281d788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207384, "uuid": "60ff2ca3-c55c-4e4c-9747-c1f8f1b3f1fc", "value": "NEW ORDER 292-2CN2-XWJ932-AB3C-38ABR-DS2-2821NJN1I0HDBW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6fd4cd-9b74-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618220906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220906, "uuid": "1674a686-c75b-4609-b626-b77db096409d", "comment": "Malware payload (AgentTesla)", "value": "93623c6f69f7bbacf6d6d152eafb387a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220906, "uuid": "32034e1e-f0ff-4291-9778-65627775f256", "comment": "Malware payload (AgentTesla)", "value": "2bff26bd657e4c721f059b9f4cfae9a53e82db292707dbebdaa653b61581ab28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220906, "uuid": "5659b187-89a7-4d90-bfee-0c2acbdc8693", "comment": "Malware payload (AgentTesla)", "value": "7be788081c4dc6eed87cf4bf65d2dfbcad8f88d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220906, "uuid": "263e389b-17d9-4ed4-82a2-835d24b96cf2", "comment": "Malware payload (AgentTesla)", "value": "ad8b61a72b44e421589318f7daa98dca01cf99649c1fc4daf517b8de6f9ab1dd189bf059cda145ee814dff01438c2d2b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220906, "uuid": "6e70cf8b-b8b9-4653-8f57-1b9aad5b8827", "value": "BBE4234F93B02BDFD919F00B94E153423A94657084BF1E6DB6D73EA09CD88E52198EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220906, "uuid": "16fc1432-e897-4f4c-b219-eca8fd757975", "value": "12288:tYH1A1npzN+Byjvo93McPMBgias7lOtSvNc3DmKmILiZjSw5Ka/SsPnkmhgTT08:Y2pkyDo9jP84QlO8cRmIuZH5Kxsvkmhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220906, "uuid": "6d2fd783-1368-4cb1-bd27-2ebf7ac92d72", "value": 680891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220906, "uuid": "15fe7853-6987-49f5-9c0f-fd5f4d6f149c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220906, "uuid": "0578a18b-14da-4a82-90c4-3740a7310dd1", "value": "Order 00223342.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce599a4-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618253042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253042, "uuid": "81530fb9-b2ce-4299-857d-0d0535237019", "comment": "Malware payload (Quakbot)", "value": "ba32b14fc8f6bd105a5b26e82aa07929", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253042, "uuid": "4dad4625-1326-4523-9c4e-437e432d7f9f", "comment": "Malware payload (Quakbot)", "value": "2c94a7e8ffd221e0d563d8ccc9252b70cea56388ebd9b4441f9a728fa4020507", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253042, "uuid": "7da435e5-fc76-4821-b600-23efe8d88c38", "comment": "Malware payload (Quakbot)", "value": "b29e99c178674313e26972532f3ae2f04bd16ffb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253042, "uuid": "c0761710-c242-4de6-a9e9-02dc42af834e", "comment": "Malware payload (Quakbot)", "value": "bec4713571b35e254ded67fb85147166e0a41081237da0faed880d2922eee09b58d7ae4ca4303533ef6dcee67e21fdc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253042, "uuid": "d941afa3-970f-4fd4-8d36-c5a5fef5be0e", "value": "E1F45B36F1D3C437D5333A7CCE5B91A9A827BE511D28A45A7AE40D088F3E6813D2D2D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253042, "uuid": "c7060e67-3d3e-4823-8563-9e6f8fc0589c", "value": "12288:LAlF6Uoww/SY6TB0bbg3dW3JHrvVDPjjqXtBIV0Q5VFRObAB76gH:LAboz/I6budWhdq9EROsB3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253042, "uuid": "9b60ee9b-7f48-4a61-a072-9d9581c796f2", "value": 762846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253042, "uuid": "cdb0630f-17a8-4436-8a28-e52e0c8662c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253042, "uuid": "adeab738-65fe-4ffd-9a72-f48d1cd9856e", "value": "ba32b14fc8f6bd105a5b26e82aa07929.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45b88fb-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1618253323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253323, "uuid": "971cb9f6-3350-4ae8-9aff-bd4021aa385f", "comment": "Malware payload (Amadey)", "value": "b77d9cf0898f11009292cdddbeaf379d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253323, "uuid": "5e27d08f-804c-4b3e-ae6e-6da9cd64ff87", "comment": "Malware payload (Amadey)", "value": "2ca400a06037c9a9ea1e60c1cb577aad185efe8e184f6d44482c480b616d54d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253323, "uuid": "be3537bf-9af3-48da-9150-faef64d3d446", "comment": "Malware payload (Amadey)", "value": "2af64c3097373bf1a583d43d4ff30487ad5b9646", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253323, "uuid": "bccb2a3e-6e33-4e1c-8e42-70229133c962", "comment": "Malware payload (Amadey)", "value": "2b990f8be6d83782463ee4b6aaf6f0a1227f2c37e33f47440c7ba213f5dfe6452eef8907d9d0adc8f266bb05e3f6ce41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253323, "uuid": "5c621f18-da74-4564-b72a-13d60bafb4b1", "value": "F474BE5EA6D470A3D0752F70D461B7E44378B8645EC764CE9F842A3C2DB1BC1E8B2AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253323, "uuid": "aa75744b-64d7-421f-bd8b-9e04a0bf57a8", "value": "7e13866414f4ebd95471c7c78ee916de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253323, "uuid": "dfb56217-a36a-47da-8eca-cc9854c76789", "value": "6144:1s2aC99RUF1bK8CprkM82+oIxe7VVbgg5Z05n:1Vb6FBKRprrxIc73bgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253323, "uuid": "c8227fe6-a38c-4afb-9da3-659f0165b8d0", "value": 341024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253323, "uuid": "f75c3a95-215e-4608-950b-b72d5ccb8220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253323, "uuid": "69691bd2-acc6-49a3-892e-ab71b8585084", "value": "b77d9cf0898f11009292cdddbeaf379d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13eec552-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207527, "uuid": "379fbaff-07c9-470e-9ce0-a1dc61422520", "comment": "Malware payload (AgentTesla)", "value": "3f9e0027a4bc548b419188e8eb34889d", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207527, "uuid": "0926a306-5466-43a2-8838-0afbad2b96b4", "comment": "Malware payload (AgentTesla)", "value": "2dc0848f9902acd3ac2a0706aa06e007f2fcb2b95825a15286acc2a4da06f47f", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207527, "uuid": "d06ab64d-b02e-4fd7-ad7b-fc69b5a30593", "comment": "Malware payload (AgentTesla)", "value": "86376241c0c5ccb84020990195796d9301940b66", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207527, "uuid": "c9444a97-7e31-4f90-a780-fdf7f8600628", "comment": "Malware payload (AgentTesla)", "value": "7a530c8354c754599683a9c9cdc5ded8a53a558ade6e30825797b09d738e0d4820ef5dc59eabebfae25a2499a3098b0b", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207527, "uuid": "3ca06a6f-480c-4fd6-96fa-0361c97f801e", "value": "3EE4233C765E0E4D66E4485D44825AC3F3A5A88FEBF6BC8119ADC9041548F1EACFE1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207527, "uuid": "6fc8506d-97f9-42eb-8405-9e2e8ac2e9c3", "value": "12288:LPerlK584VPqsEfjRcl9jd3IefwNh/lLxvQebwyheiwEZIBzpbVfbnD3L+:LWrlKm+SsGc9OmmbLxvQwheiPaBdZTnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207527, "uuid": "6ce9f367-001b-4f33-b86d-6a251d9115a4", "value": 702472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207527, "uuid": "853c2136-d078-4a57-ab4f-e1adbc4a3f78", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207527, "uuid": "51b77456-3dfb-46d7-8ae0-51478873d306", "value": "SARS Final Letter of demand. DEFAULTER.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80b2843-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207883, "uuid": "a6685bcf-1476-4a18-ae81-7c2532ec14ba", "comment": "Malware payload (Formbook)", "value": "5946d0ee4becb515a1cf39ef3f3dde56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207883, "uuid": "990de93c-7b02-4b16-9e12-f124da571945", "comment": "Malware payload (Formbook)", "value": "2e2c3bd3883976fc398bc30cadaa16043e792861e7b12db344cd285375df8605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207883, "uuid": "5103ad10-8dfc-4912-9c18-181a80db6042", "comment": "Malware payload (Formbook)", "value": "3321193ab8c09ab1098d8104afd021145eca89c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207883, "uuid": "2b9e255d-cb5d-4d8d-ba9f-52f3a6cae847", "comment": "Malware payload (Formbook)", "value": "795ada78a27d46a5f43c1f398ed0e93431c24b7ffc0f7af4850a3392ef2774d83aa934abab22bc0bb0ab80220a02f2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207883, "uuid": "cb9af15f-bc80-42a9-9c89-c5abe287c4e6", "value": "9905E0D1A780C568D8AB9679883BD6A365B3B25EDD68C50D3D92FF0F3C32346401399B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207883, "uuid": "0af4e725-e552-4fbc-87d5-219d9da3ebc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207883, "uuid": "51a98a55-2aa5-478f-ae1f-d5ec23538232", "value": "12288:g7Z5LlLscvSGSaabV/HhLaeOYeEKJgUNdaxRPWId1u2KudAA:g7Z5tdqGSamV/BLa3YBQpIdQMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207883, "uuid": "719f927a-96b4-447e-8a4d-f40030c68f66", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207883, "uuid": "9d4e05b6-f37e-4c06-a563-b9f7eaf5342a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207883, "uuid": "1f68b066-d0dd-49fb-9c5a-352aa1e1dace", "value": "Swift copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe008b3-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207835, "uuid": "5093e481-ff15-4e57-975f-cb15c161820f", "comment": "Malware payload (Formbook)", "value": "fd5d7af280df58a0216ecdf3a17831e8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207835, "uuid": "f0c91302-7a7e-4e8e-9f34-fc64dac64443", "comment": "Malware payload (Formbook)", "value": "2f6c17fb14dc6f322cb468f1c7ebec4ab4a709b2623c23a79f3ec8c484740dff", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207835, "uuid": "04343798-c809-451e-855e-1b6b0ac591d6", "comment": "Malware payload (Formbook)", "value": "baca9df99a1fe531c494bd8c14255dd4cfe6f513", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207835, "uuid": "2b5557db-81dd-4d0a-bb68-175ab9e3bf21", "comment": "Malware payload (Formbook)", "value": "e6fdaa01438c5b6166ab5bdecc61794a13be3ba4d4aca5c72ceb2f8a4604e916429313aabde22962bebce4a445172af7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207835, "uuid": "16839e92-b574-4c60-9615-e60c4c2e321a", "value": "C3E423EE114DBEEDFD96A3FCEC058CA81E307A77D69A48D446BE0B8992093105A74253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207835, "uuid": "3d9be76f-35ac-4d06-9a36-09e5d6b137b0", "value": "12288:PGvRYiTLteQeklcFtQhq+HE89YO4UTanOqoDujjEeX2mDrsKuFN/GIJo/pk8TP1t:J0LtKklczVU/kiAjoijnrsXxGIJaptTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207835, "uuid": "59c691c4-0c3b-4301-93ec-c309178a5444", "value": 716310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207835, "uuid": "80b841cd-e3aa-4033-8726-40d3d0a74800", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207835, "uuid": "58fe9486-0acc-4610-bb0a-0368115206d3", "value": "ORDDER-238486-LBT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f7d86d-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207148, "uuid": "ecfdffc9-4be9-4e60-bb1b-ec2b6c005bdc", "comment": "Malware payload (Formbook)", "value": "e5a94b6950b66e329f7f9e2541a1ddaa", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207148, "uuid": "14c750ff-711d-464f-b617-659d5d3cd3d6", "comment": "Malware payload (Formbook)", "value": "304ada33ac607b61717ee8abead37c30a988d91032bd3af2d7146b71c6db231a", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207148, "uuid": "430487ce-f8bd-40d2-a175-a0efcc4904a3", "comment": "Malware payload (Formbook)", "value": "0b6712de89db5ad60ce8d1140d46f21abd832a10", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207148, "uuid": "bf07521a-87a8-4bae-a0f9-ccdbd83c8925", "comment": "Malware payload (Formbook)", "value": "3ceb4e5053e4d7d3c32af6edcb33ff8e06a91b98c9c164f1a077b2a04064fb0d9671bc3f8f8b36ff159ebdd5f563a663", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207148, "uuid": "83b67bc4-13ea-499d-ab0a-310fd3f7623e", "value": "752423FBEDC110DF778499EC881F0AAE595C4F81DE5B089922C47932D09256EAFC9A31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207148, "uuid": "5db93d37-ca1f-4b41-9c5c-65dfa89fc58b", "value": "6144:r6KR44EhVuCEorQg+t80a2RRRfRUo5p0Xh9J:hT3C3kgmZrTpUq0XB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207148, "uuid": "04a6ef8d-a4fe-4683-98e6-43f5826195e2", "value": 216199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207148, "uuid": "09faad40-8116-4a1c-9196-7c7add1d5fab", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207148, "uuid": "4b9b701b-12d5-46ba-a31d-cca8e01cef77", "value": "MT103_004758.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156450fd-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207529, "uuid": "06e63890-5cc1-45c5-be28-bc8a7c07cdf6", "comment": "Malware payload (AgentTesla)", "value": "46613171e18635566b17ee3c1b81136e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207529, "uuid": "2b143e45-290b-446d-b8fd-cd2f229ebc6f", "comment": "Malware payload (AgentTesla)", "value": "311c073357613457c62827ff5bf9db9f8afbf244a7594ae308704e6fc532bfba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207529, "uuid": "f6ccfaa1-e4d7-4556-8975-1a15eccbc59a", "comment": "Malware payload (AgentTesla)", "value": "e3b7bb7a87b5ee2d87ad7163f9b6e346ea55a333", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207529, "uuid": "f9660d30-e504-4434-a911-0882f2ef6bcf", "comment": "Malware payload (AgentTesla)", "value": "7b8e9a268707a7a5334645ee2d9b8423881d8ac1e585891357c1be3f909641110798a71078e57ddc8e5aac6c25789eba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SARS", "colour": "#4C2768", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "ZAF", "colour": "#6316B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207529, "uuid": "666dc1fd-afc5-4f2a-b55d-51b0408c48cd", "value": "FD05014E7754D3B1D0FC5BB4553044005BF9D84FB716E61A2DB8FEA87933A888A8C7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207529, "uuid": "95c6e8e5-ec07-4208-9d37-84d51aa2f19e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207529, "uuid": "fdc782b9-9c7f-480d-b1b1-67d000481703", "value": "24576:qEvRa3KnqoOw7Mmd3fVI30++fCpj7t+iR:NvcaqBwOEyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207529, "uuid": "20825aaa-d0a2-40cf-ac64-94f7335ee22d", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207529, "uuid": "79680870-bc91-4dcd-b56a-029e2b945a13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207529, "uuid": "8642f841-c765-4d08-9423-7dd6afeadcf8", "value": "SARS Final Letter of demand. DEFAULTER.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7986fc62-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618208127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208127, "uuid": "3263ff70-4006-4c7a-acbe-c146e6b05f3d", "comment": "Malware payload (AgentTesla)", "value": "e6f1974aaeafa83cfb19e421a1c063ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208127, "uuid": "aeddf48e-6d6f-4c1b-b03c-2fb1ea23b915", "comment": "Malware payload (AgentTesla)", "value": "31f153b1270cc3279425f4aa1d576dc02142d2008afdf5b7fd21f74431bb6473", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208127, "uuid": "6c47ad58-27de-4e80-8fd8-ee640b0c99ef", "comment": "Malware payload (AgentTesla)", "value": "7b358e43bd2c990af2dccd1eedd4ff8a165c0304", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208127, "uuid": "f7346fd8-0ee3-4a00-bdaa-bda97d3655df", "comment": "Malware payload (AgentTesla)", "value": "95f4f340edaae4b496399c497d886b68b5189a23581d6a7845aa7c16835dd6eb870211393154195636106931d6df04db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208127, "uuid": "c3cd126f-9937-4abb-b228-f4b39a9e5c37", "value": "FCF4E01B73902569E91C0D77850B04C063F5CD7BE638F31E3AC93AD60FB179A662E626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208127, "uuid": "2cc5dafc-0904-4f87-947f-2bbf3d9fb5a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208127, "uuid": "4c8a401e-57ea-4cb3-bc4f-3e3a6dbd1dd8", "value": "12288:y6szqqB3PQhPp5owTZW010CjZH+TqUXHImiN+laFNXLurd:VszqIgfoZ01LVH+OUXHjiN+laTXLurd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208127, "uuid": "cb4fd042-a7d3-4755-a885-79f0a6fc6815", "value": 722944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208127, "uuid": "3d899638-d23e-4c5d-9841-d6b399126cfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208127, "uuid": "13e4ab52-84b3-4a8b-a5f7-ab5cd70cb3bb", "value": "QUOTATION#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859fc3fb-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207288, "uuid": "825aa62e-452f-411b-931b-2ec21ae98cfa", "comment": "Malware payload (RemcosRAT)", "value": "4517b696eb852a931d3b388be730dba1", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207288, "uuid": "3013fde4-3496-45c9-8c98-2c42ff7ff25b", "comment": "Malware payload (RemcosRAT)", "value": "31f45773b3f2f7857a0228b561b59561fbe932bb047dc10c3ffe8568b552ad28", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207288, "uuid": "3b099a01-e9de-4e30-baa1-797f2adb5e16", "comment": "Malware payload (RemcosRAT)", "value": "985cb6a2d761739be1e3a155c999755a6ae701c2", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207288, "uuid": "3bca6d7e-ebc2-4ae9-9e96-4050092847f9", "comment": "Malware payload (RemcosRAT)", "value": "8fd498ae9f3ce61ffdb5e422ef328854f5098c5bd1648e60f25d5aa17d4c4b837520f84d0907172f0dd1e06872813dce", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207288, "uuid": "f181a89b-0645-4723-9019-c565fde2eca5", "value": "FC5301A8E7204B6F3F0D19614317EAA5C58DE1A788EB684DAC74D74684530CFB2E907B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207288, "uuid": "6fa60384-4868-48a4-9d2d-7b8ddfc13de8", "value": "1536:C1SBs4aNy1+fF5HvDKHwe73mAbHdkmzDN3b2gWRY7a/O1QIsxQd:Cxc1UF5vS2A75zt2gWRY7am1QIgQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207288, "uuid": "ef234a80-c4c5-449c-a18f-e68447d9e3f8", "value": 61735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207288, "uuid": "087da029-64ee-44fd-958a-c5f1e8408905", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207288, "uuid": "3c919b7f-ca22-4940-9c26-4a7ec458aeaf", "value": "Cobro Juridico_0291662728_7023446_452487041454723_016698_5192136884256735776_2301761820735.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da703489-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230194, "uuid": "8735bb9b-b3eb-4913-8527-4a6354277ca8", "comment": "Malware payload (Formbook)", "value": "111325614561306dcfbbb69f1c83a613", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230194, "uuid": "0053e50d-3f04-44bc-984e-131d6fc277d0", "comment": "Malware payload (Formbook)", "value": "3361c124c5310bd0ec210907338a93a7f6cdb1313c78c8af72e385813913728a", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230194, "uuid": "b4c8824d-cf89-4181-8da7-39acca1ab3d9", "comment": "Malware payload (Formbook)", "value": "cf38b300fd8767db95585f78ea427ba26b8cbd8d", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230194, "uuid": "2d145115-59a8-4e2c-bedd-dff98b6e87f7", "comment": "Malware payload (Formbook)", "value": "d4e0cf7ad9d83b0903554a06aa4b2876909ebed2dd74a2b311774deba7769f6118091be3abfd2880188191d03f52837a", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230194, "uuid": "6509d1f4-6935-4214-b0b8-7f2cac4a1864", "value": "3B6423D2B8E415012CDA39E1995A47507BA8A3F21D0EF24319B7CBBE058D29176F3E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230194, "uuid": "749ad5b5-0258-4dc6-ad38-3cfc0d3cbc81", "value": "6144:Y0a3K34oIjJpCAKOnBpH2gYaGtZzj4S+nh4Gppv7xZtXORYEIeW0BMGUfe:za3K34oISynBRVYTtZzj6XVZtXOCeW0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230194, "uuid": "7c3df5fe-5764-42a6-bc2f-ec6b22cc29ef", "value": 335585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230194, "uuid": "ab82746c-08a3-4acf-b604-8688ddee366a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230194, "uuid": "002720e5-3ced-4f42-b97a-239bd6589922", "value": "SHELL-RFQ-Project.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8fcf61-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618208696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208696, "uuid": "ec50427c-e932-4829-b2fd-0c708bd00fe9", "comment": "Malware payload", "value": "e5150ff409b4ef3ba63d076de8523485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208696, "uuid": "a926118d-8b1c-4a5b-86f4-f2a244d60575", "comment": "Malware payload", "value": "3391f042d36df8b46c88b59509fd9838901d8b351c7bcbada9c63e0e500e5f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208696, "uuid": "fc5ecef2-610c-43ae-8e28-8e47d71831ef", "comment": "Malware payload", "value": "552d771168b7c04c34095ef917c0472b52ce7c44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208696, "uuid": "96d10d3c-c121-46bf-83c2-c1aa3b0c0fd7", "comment": "Malware payload", "value": "e8cb6ab44e7027ec5754fdd6fa93496c398707535fb2bb05dfdcd1bab9b63e2efa6f41dbe62e1c42f5a0ac7db26f4a0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208696, "uuid": "04f36c4b-724a-4b10-a613-255306694f90", "value": "4E921961B3E86125F2798E7D3DB0C41675B6BEA7B511EE3C1698300C0A32358A4D2F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208696, "uuid": "c47219fc-bf9a-4cae-8db2-888f0b4ab268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208696, "uuid": "4fd764c8-8983-400d-8887-9ff55903c5cf", "value": "384:IC8Fd5bxETVn4+L5lyyzwIKnC9YTHE7j0MMUSWKafSdnlX4XaXmXoXAX1XcXMyXY:IC89bxA/DyyUIKCGE7vxadnlIqWYwFMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208696, "uuid": "387dd849-f881-45c5-9d10-306dbb822f35", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208696, "uuid": "292f2e7f-6918-40ea-a473-1a0fc5227990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208696, "uuid": "918c0ddd-657e-47fe-a42b-668f41692063", "value": "COMMERCIAL INVOICE N\u00c2\u00ba 0001792E21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b02bd71-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207941, "uuid": "2c69eb86-56c1-407c-be98-7f7bae3d4a36", "comment": "Malware payload (Formbook)", "value": "bfd82adb1ad34756bbae74f36b03ee9b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207941, "uuid": "87c1821a-5088-426d-b6af-97364237ab14", "comment": "Malware payload (Formbook)", "value": "33b95a7ff6f57654a427a784bd7ce31b5b58e0162aed0149833097a2fd0e5bea", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207941, "uuid": "d39023f8-c92e-4792-a894-d8953e04c426", "comment": "Malware payload (Formbook)", "value": "aa3b9c5120a64648e20b184d5000892e57615860", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207941, "uuid": "9b0ae9aa-bb44-42ea-b1e2-6a4066799327", "comment": "Malware payload (Formbook)", "value": "f74bf040a6cdab17685a77dfcbe0592ba139d7c7fd5133a947bd01f38450b833b95c12e5f47933c0f576553691217d4c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207941, "uuid": "d83ab479-d964-482d-b719-ca474660dee4", "value": "440533ECD29D27DF413B0A881A27FD4DBF8E5615151ADEB3175B4049EF30AA8F884236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207941, "uuid": "ac0d03b6-3486-43ab-bce3-11956472a3ca", "value": "12288:3UO8LPAfVzW8j9FFVTHUZBuRBtuDvWiPU0RwO+xqOZpsDFvL1l9ur+HjDJXV:3U0VzjRpWJPUowO+hIFquZXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207941, "uuid": "3d16c91b-f1f8-4f6d-8259-544d852b584a", "value": 821408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207941, "uuid": "173d7829-7361-419c-a65d-197632b22746", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207941, "uuid": "9da7a94c-298a-4918-b42a-7b91f3f76084", "value": "Purchase Enquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716b55b7-9bdd-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618266095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266095, "uuid": "479115ea-4b6e-402f-941e-a9c1a57ea73d", "comment": "Malware payload (AgentTesla)", "value": "dfadb7271523e3ce04437164acee843b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266095, "uuid": "b13b8597-2314-4b89-857d-6e9589078b7f", "comment": "Malware payload (AgentTesla)", "value": "361a0688f9302848b82d16ad1055bc9b6af14bcda81cc9020321664df4965e57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266095, "uuid": "25abfafa-80d9-47bb-80d6-38cfd98762c4", "comment": "Malware payload (AgentTesla)", "value": "25af5e459b11c534da249b59673cc3aec7a0f50b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266095, "uuid": "2968e9e3-a1bf-4ff5-81c5-af4aff9594b3", "comment": "Malware payload (AgentTesla)", "value": "1b889b0f28a8f391f81d79a645c0835b7336f13931efc394f89f510dea8abc8534d38ef268ffa36d11a49b1d33bd8c8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266095, "uuid": "6f5a0cfc-3809-4dff-ba49-898f1327364e", "value": "DA7423A2B5905473FB96A0B75CABB336D23BC44A21054BC79BC203BB90B57C7DD0AD85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266095, "uuid": "2aff2b6b-bbd1-4354-a9ea-6a4d3d865fd5", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266095, "uuid": "b4c06e13-27ca-4211-87ed-2b2a85b33ca4", "value": "6144:HdPFEaCI1+jZWshW5DC10Lyt4+5CtG5kJrsL1tMkISC5NLI/sePxogW:Vhl1GVWVCKuWNc5kJ4L1tsI/sJgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618266095, "uuid": "2ff629b6-9d34-4c25-99ac-b74b90f3f77b", "value": 338157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618266095, "uuid": "64853333-82d3-4a60-a39a-ddaac249c62d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266095, "uuid": "f322ee02-b37f-4471-8513-c2369a13e1d6", "value": "invoice2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf94f6e9-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618233585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233585, "uuid": "78d74e36-bd34-4bf8-bea7-dbbf684085ce", "comment": "Malware payload (Gozi)", "value": "6321729b9f33fea55483fbb3792c611b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233585, "uuid": "8008235e-6fc0-4781-a350-a8a04cc24f45", "comment": "Malware payload (Gozi)", "value": "369cfe293c93b001240bdee35859037c7513ceef781c8174938d0650c9e5575d", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233585, "uuid": "240cb451-6743-4172-bdc1-73bf6a8fd575", "comment": "Malware payload (Gozi)", "value": "816ad37e36a68f89ab2ca4fea4f83879caeb6586", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233585, "uuid": "15532469-9e2c-495f-843d-f65b36c20c36", "comment": "Malware payload (Gozi)", "value": "02076269056760388a01bcb23efac92e5ab34f182d55812f7e40e0856dd942f9d610e96e980477e2e0a065a260580737", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233585, "uuid": "d9ea7911-d036-41b4-98f7-2a631d536308", "value": "2295CE513A41C990F55A1273C1ABBDC00334BFAC79D7E72E349932A9053339A7C769AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233585, "uuid": "5e5b71eb-8edc-4d39-bad5-184b59510e01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233585, "uuid": "b63e0870-b5dd-4160-9192-58aee710be2e", "value": "49152:bYLlc5NGbPDu/xkxyuS2N3Qz0f9qqgdaE5LUSJpYnY/:IIE/u2YuSCQz0VqqadHDYnY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233585, "uuid": "0682ee15-ff04-452e-afd3-f827277f2b35", "value": 1878352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233585, "uuid": "43cdfe3d-71b1-480c-bf7b-c2b4240a0383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233585, "uuid": "47214d73-6830-45e6-8102-486a35e01af3", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59110d1-9b99-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618237004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237004, "uuid": "952a27a8-f2d1-4b68-876e-7773d8dc4578", "comment": "Malware payload (Formbook)", "value": "659fc452e1151447e46c8c129ebcbf45", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237004, "uuid": "d136da5b-d730-4a5c-b24f-1e9457ff98d0", "comment": "Malware payload (Formbook)", "value": "369d9bd2cfca1003d300b9bd737dcdbfe73c06a069224ff19c2a08cbfefbd409", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237004, "uuid": "58682dd6-2ac2-4aa0-b74d-e347e1eb7c4c", "comment": "Malware payload (Formbook)", "value": "8ce071b5af78055b674a4e8d7aea17611aea2e9d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237004, "uuid": "130681c8-f8db-4c49-889e-eb4bbf4c1ea7", "comment": "Malware payload (Formbook)", "value": "3860a6dcbd28e9162a42ad9dcba50009423865a06302a945fd810cff6d143756f7292945fcad6f4bf9b539dcaa77284b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237004, "uuid": "7b1e9049-4e1b-4523-b64e-0f8c2280a04f", "value": "CC2423B2083313B52A114680BAF37B296E946B6024F53D7D3D5EF12921D6B8CD9252EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237004, "uuid": "f0c0675b-d6d3-4111-8ba6-043daf67a778", "value": "6144:GW/monHYg+fv3s1C66R5L39G5kJf+uhYa6:GJon4g8cAZL9eIf3h36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237004, "uuid": "abb1e1e8-9145-4d31-89c7-76acf3f95b96", "value": 215654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237004, "uuid": "6d72d5b6-602f-4d57-a57a-17c983161bd5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237004, "uuid": "f9830fb6-198c-40c8-87d4-224d5432b492", "value": "Contract Agreement.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54ccd54-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618209489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209489, "uuid": "76644166-162f-47a2-b970-972a78dcb059", "comment": "Malware payload (AgentTesla)", "value": "127ae40009368fb03554057f1bf860a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209489, "uuid": "6db79b5d-4fe5-4140-a455-c53926ee08f8", "comment": "Malware payload (AgentTesla)", "value": "36c5c91ad9faeed3bbd7bf576aca9d4a5c040d802a521584cd094776e61320ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209489, "uuid": "3e23870f-27b8-4bf3-b522-68965445d0ee", "comment": "Malware payload (AgentTesla)", "value": "9e0d0625b8b95a90eff2d077c3416b6bc6bb0999", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209489, "uuid": "d1933eee-99d8-4baf-b9d1-09e07d478f08", "comment": "Malware payload (AgentTesla)", "value": "4a96a30dd6b22455f814fabcdf8d0da7b3f087846e47cf08fa5f5a6462528fecd8e75b9d6bd57c6adba1bdb58494b0c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209489, "uuid": "9a7fbaa0-98ad-4cc6-a1cc-8e333106886f", "value": "BE055AAD725076DFC867CC368A681C64FBA0B476430BD207A06706ED9E5D99BDF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209489, "uuid": "69a5cd07-0ca0-4d99-8a99-25fc5cb4f1a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209489, "uuid": "2634ed62-d49e-41a2-8f4e-e8b3bb425479", "value": "12288:PjuSWX3u60c63eKM74dMC2ycoSDY4c0AFikHvgpghmBVnSUn9ki5PqtHGKSa0LwE:PjufeC7774dbYov4c0aHvgpghm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209489, "uuid": "31252a1d-554e-466f-b3c7-b744411e66b9", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209489, "uuid": "4cb48be8-319e-47ea-8ec1-d075020dba1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209489, "uuid": "a10b3158-b764-4192-ace2-805a09cff585", "value": "127ae40009368fb03554057f1bf860a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e8f779-9b7c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618224326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618224326, "uuid": "8f9e8ae1-34d9-460f-9448-3ac952ea8826", "comment": "Malware payload (Loki)", "value": "f121f5a272d1f7fac784d37e608bae59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618224326, "uuid": "c5cd7e0f-561b-4989-b19c-1ee5d43781d4", "comment": "Malware payload (Loki)", "value": "36ce92775c1144923fb3387fe6cbe4e94a5717474b317e00155bc0c0b8b2beb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618224326, "uuid": "3c400310-4499-45ac-a312-3bc0b93753b7", "comment": "Malware payload (Loki)", "value": "8214edcdd76b79da7328f4d5367142ac00b9daa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618224326, "uuid": "b04421ff-161e-43c9-8b33-7fb4c1abffdf", "comment": "Malware payload (Loki)", "value": "d6c5eade9bf918ba60cdea13987d39587d488c20132c311bf1f66192c5505526b483a22e81ed5f5f4292724bedadda9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618224326, "uuid": "ddf0a8f7-e6a8-4cd8-98ab-0458393fd96f", "value": "85E30200B3D6DCB7E7D35E3148B3A766DBF14320252862475BA45F3A7712643DA2B28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618224326, "uuid": "a7b22b2f-938b-47db-af57-31c40451a85f", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618224326, "uuid": "a28e2d09-9732-425f-9424-4ee1a57dd99a", "value": "3072:HyewmN4skJ65Aa2spBfL/sm+Rax0qW20tE2TiZIQey0975:Hd9AalH+E0z+2TOIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618224326, "uuid": "e7cb2960-fd03-406a-b356-046f64ec3f8b", "value": 148200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618224326, "uuid": "a64d983d-2e45-458c-b42a-bf5307775aba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618224326, "uuid": "a7d1e6d0-85f2-4f0c-a849-22d280b9af4c", "value": "Anmodning om tilbud 12-04-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ebe412-9b72-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618220125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220125, "uuid": "3bf370ed-8e41-4b99-8eea-70e9aaa6e519", "comment": "Malware payload (SnakeKeylogger)", "value": "229efbbb09801172c9d35851a3ce484e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220125, "uuid": "9b8bdd59-8981-4582-a577-5075a4e1d858", "comment": "Malware payload (SnakeKeylogger)", "value": "3744807c95cb27f6e9c5ef01f2b5b32a78ceef7016fb54babe6a797977b72763", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220125, "uuid": "ea06e7d2-7e68-4fcd-ad4b-9d7940955587", "comment": "Malware payload (SnakeKeylogger)", "value": "bfa35ba04c7cce63dc1fdf161cebfa7bd9e63cd2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220125, "uuid": "7cc2a684-82a1-4fe9-94ad-14e48ce95902", "comment": "Malware payload (SnakeKeylogger)", "value": "9122d96d030fd215d356d975495152e93f2f73e91be8df190e4a05af988dd887515bd4df711956189f67a7f41a03b213", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220125, "uuid": "3ca7cc15-d60b-456c-95d8-37d5be62796b", "value": "3ED4F16177D6CB82C83207F69C22904747BAF1DA7823DFA90D9491C52429F0C9DEAED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220125, "uuid": "33423956-b977-446b-93f1-08108c377f1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220125, "uuid": "75038805-bca2-4f27-90ae-c2f191737dec", "value": "12288:XaRN/cqUrIyKEiFzxpETMWMFUcl0qtxc1y:Xac9OEibSTMCcl09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220125, "uuid": "97fc6e23-20a0-4317-8a49-1e63f8c43a94", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220125, "uuid": "874c04d1-4d8e-452e-b979-4b2fbda6f1a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220125, "uuid": "e44bb40f-a419-4dc2-8b88-de9d7cf084dc", "value": "RFQ No A'4762QHTECHNICAL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6535afe7-9b3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618198214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198214, "uuid": "f478095f-203e-46a9-b705-ecc9176a3ea9", "comment": "Malware payload (Loki)", "value": "33977fdec6df672222270fc7016e8109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198214, "uuid": "04de2d57-169e-431e-9757-7441afd1f492", "comment": "Malware payload (Loki)", "value": "37f33f1a7aae2be01b4433583f8c2e9bfe6cc3e225fbfeb9854f9aaf5c8837d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198214, "uuid": "4897a2d9-db0f-4d74-a56a-9776eb62a549", "comment": "Malware payload (Loki)", "value": "87bb4f9415401ae27b8a334afea35488c01c971a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198214, "uuid": "f77e4f67-ad98-4e26-8ffd-5c565a7547f3", "comment": "Malware payload (Loki)", "value": "7e82d31cbe8abc4f1151e6af9f4b2486315224e810bbd842abdf2b504ac8b28ff5616214268826d4fcee7f2a51bc4142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198214, "uuid": "682d44f6-30de-4a35-b196-03a3d0d43f76", "value": "71F37C9C766072DFC86BC9B69EA82C74EB50347B931BD203945312ED9A0D99BCF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198214, "uuid": "c90e855c-ad17-424c-8035-5b528b977183", "value": "3072:cvhyOc8tH+skdzcdtoK569iH1N2hEgrGbXQ7YxSiuuzpFMzKcQOYc+3wBt0:uH9McQWQEOGbgMVl2zVkc+3wBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618198214, "uuid": "e0642b2f-7eda-48e4-9417-34e54550fff2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618198214, "uuid": "560b8a52-cc10-47c7-8e1f-27b0f9b5f9cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198214, "uuid": "855e392d-0ccb-4279-ab1d-08d9ef0f2897", "value": "Enclosed Proforma Invoice INV-00628934.PDF.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4df9ee8-9ba0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618240090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240090, "uuid": "d045f616-c91a-43b4-ad4f-ec506fbc2cd9", "comment": "Malware payload (AgentTesla)", "value": "f8ef80e162d6028cb0d0baec73fb2f13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240090, "uuid": "2720fd42-d308-4cf1-9b79-ce446de8c4a1", "comment": "Malware payload (AgentTesla)", "value": "38fc5115e174f00f5c8ab3d484c1a94819915dcbaab9ed9ce13bebe7cdd100b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240090, "uuid": "5355eee1-45c3-4c2b-8317-4f65b260c0b6", "comment": "Malware payload (AgentTesla)", "value": "a221f8cbe4986634d4c597fd1010494a484a7567", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240090, "uuid": "5628ba06-dae8-4580-b263-070201f0e055", "comment": "Malware payload (AgentTesla)", "value": "9086416f811d154392a596e1402d8a5d769b0b18b35ff8b8d66488dae06e1b1f8f6328fddf5ce26eff733fed247ea2ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240090, "uuid": "b0b5d4b2-06c8-4495-aaea-5b287a21c634", "value": "D7F42343B5C08F3953CB5207670AB2F4C65BC96886EAF9D5EC4C64A6F5D9DA20B4F00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240090, "uuid": "87f7b59e-45bf-48f8-9dda-e10fd7564985", "value": "12288:AjhfrQtasfwIyeejHtR2zoJOPjAWJnDJBZ8mHhNKX8aGN44srjprqfC:whzwfw5BjNgzoJOPHr8gTKU44ipT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240090, "uuid": "b9da2eed-042a-4a01-8170-0aac775ce1cb", "value": 734862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240090, "uuid": "e4a4fd56-e2d2-461c-9580-b26ff45fdbc1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240090, "uuid": "a21f895d-017b-493c-94ea-ae176b9347ef", "value": "Arrival Notice - S2101280194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06024504-9bc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618256466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256466, "uuid": "f02ea030-249a-4e57-8d28-3d7601c44de8", "comment": "Malware payload (AgentTesla)", "value": "67e704a77a6bbb6af3c219fec0727ad2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256466, "uuid": "124416a6-089b-4fdc-80b8-ec9692bdeeb5", "comment": "Malware payload (AgentTesla)", "value": "39f0aea5c533aa34585a5ac35e40bfcc7d5ed3016b13fbdcb6fbfe6d976e87f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256466, "uuid": "72284c49-37a6-4b78-bc0b-dd70e5810f55", "comment": "Malware payload (AgentTesla)", "value": "9169f285f18b496009aef96a15f6027dee1c49c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256466, "uuid": "50772ef7-d3e1-4d93-baab-be61d653d13c", "comment": "Malware payload (AgentTesla)", "value": "907125ea32ca079db1eb0b795086a6223e611a7694eb9de5016e84e87768481af05e893fa7c89e928009f7b013f8e9ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256466, "uuid": "339811de-e08a-4b12-b0a6-2416daccf3b6", "value": "5DD423EC04A9F474EC18BC5A15E2FC9E54123228370246F9E4577E254AFD325F1BF616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256466, "uuid": "c825b7d7-9eae-410a-a2b9-2859493d94a2", "value": "12288:UKd0/Q/1HRzBbw0aVh2fuqwaAtiufPaEE8QqT9qfZbVHD8:UC0I/1xztLqh2mLfivKsfL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618256466, "uuid": "bb43b66c-c33e-4b5d-b4c2-307d26050228", "value": 604034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618256466, "uuid": "102616bd-bece-4b51-80c6-4fe39075f454", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256466, "uuid": "03f89376-5f2c-4a2f-818e-e4036eea0486", "value": "20211204098764.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d5240c-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235962, "uuid": "9673ace7-b3a3-4d5a-be9f-cae05891c224", "comment": "Malware payload (AgentTesla)", "value": "0df0d3fc7ea641a3cc697df98380149f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235962, "uuid": "a8d45562-c602-4dc9-b44d-284c99d1b672", "comment": "Malware payload (AgentTesla)", "value": "3a5c30055449247f22c553ec85ef739642e65e1046dac93d9ead539e2fc4fd07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235962, "uuid": "47f8634e-6ab5-43c1-a6c6-f249717c8db8", "comment": "Malware payload (AgentTesla)", "value": "6e8fbf7e0efc548b622d2d8685139e8ea3feb101", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235962, "uuid": "728e118f-6f6d-42b4-9eb8-25df0f9ab7af", "comment": "Malware payload (AgentTesla)", "value": "41b0f7cb8df26b6a55424305878806394a55ff7e171a8825b8ba2829b7c770dfec84a5de998b288119f74f5cf1f07895", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235962, "uuid": "eedbce53-12e0-4cd5-be07-9e718ec07146", "value": "890579037EC5DA9CF0D84A3E55FD40227FA3D896490E9FC658CBB7AD05E2906F521A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235962, "uuid": "7ec73d6e-abb8-4a95-b035-5bac3912c7a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235962, "uuid": "bc1b8d8e-5ac9-4933-af50-336ff4f8096e", "value": "24576:RdJKIyTc7VQoljgS/73HOr0BEc5ffrQ3jG:5KIGqtb/73ur+t5fzKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235962, "uuid": "33606af3-770f-41e4-9aac-560583b7a557", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235962, "uuid": "a71ed750-6d37-40a5-900d-e73cba0bff27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235962, "uuid": "2e2a7c80-f5d0-4e47-9575-c53a25147c59", "value": "MAR 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85220f7f-9bc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618257538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257538, "uuid": "b2507a53-9ed8-4880-840f-0d6b63c87227", "comment": "Malware payload (AgentTesla)", "value": "384db4d04abc935bd40db706a4cde6df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257538, "uuid": "8a31d430-6be6-4e0a-adde-a90fb718a570", "comment": "Malware payload (AgentTesla)", "value": "3ab5976acea96755679944ef2323848e9ed0fd463a76cbc382827396fd5a3078", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257538, "uuid": "57cb27f9-2e0f-4a56-b043-7f0555f87af8", "comment": "Malware payload (AgentTesla)", "value": "af69aafd49554ead8803f439ceb153d811917abb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257538, "uuid": "567b8971-53b5-42c3-8929-0c9f843e6717", "comment": "Malware payload (AgentTesla)", "value": "7972975a8c181d55739aad3e52c3f6cd92ceaca55ea6a80538862875c4022ee587438040068e6a1d3d283270a795e872", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257538, "uuid": "fd367638-fd95-42d6-8d84-bd53a42861d3", "value": "D715CFAD361075DFC967CD76CAA81C64EA6074BB430BD203A01716ADAE0D69BDF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257538, "uuid": "95f208cd-6a00-4e08-b811-6d430faddce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257538, "uuid": "ff14468a-3ebd-4a22-bb24-3bc897f0d3d8", "value": "12288:MAPJK/ICjV6Ge+hYgmIiyRQgBy/IgaGhTVI+iTQNr6zTjJ1rndoFOTJLCIS47G33:3PJ3iXYXmBM1xxyQNmzT11rdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618257538, "uuid": "704d2faa-1354-42a3-b01c-e468a4267f8f", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618257538, "uuid": "e59f984b-12bf-4bc7-8383-dd8af6e3f434", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257538, "uuid": "8b79769e-c8e4-4193-91f0-94521c7fdefb", "value": "THC-OOO987609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3553a970-9b9a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618237218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237218, "uuid": "e5fa4f87-99bc-4a16-b4d2-4e2ef8c3b69b", "comment": "Malware payload (AgentTesla)", "value": "6e0ae9f79b7c1bd7ea7bea58031ed3aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237218, "uuid": "5bf0ddf5-aeea-441d-83ac-4c963680e61d", "comment": "Malware payload (AgentTesla)", "value": "3b441c5ba6548f1edae7a948b87998d8bc274541faa678cbae9c2a26c5f6b273", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237218, "uuid": "b458f8b2-725f-45fd-9411-43c2f423b267", "comment": "Malware payload (AgentTesla)", "value": "d5070c9f7acee0761c77f10cc364696cd2128a5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237218, "uuid": "76d2430b-d16c-41d3-a93f-bf2df2b0eb21", "comment": "Malware payload (AgentTesla)", "value": "a47925641647a700c0dbe87e7a619cef1fb1764a43a25e3c7f5650d01e05aebeb2787f8c5e5c97ea88378c6eac9c93fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237218, "uuid": "5db0f83b-23b4-42ed-8b6d-86ff88563a52", "value": "46F4022827D8C90BD67E4F7558F1610417B0F121A773E71ABAA8606D2F73BD18B6B306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237218, "uuid": "e147ece3-7d98-444f-b86d-c349c5166c63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237218, "uuid": "a8aca300-8cf6-4d3d-9a7f-f8b2ebc0122d", "value": "12288:oirjKf751hJRdtaWqX3Y1w8moNqAgcev/38BM1+Pt7sv2YetPKaoh1rKxWYTlz:E3tfrw8moNCbvP8BM1+Ph9Y6PKaTxWYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237218, "uuid": "5f1ea015-e7cc-4eb7-9dbe-be12395bb314", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237218, "uuid": "6082fb16-0fe0-4ba1-b75c-69d41016e1bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237218, "uuid": "c08b8228-8e9c-4f65-9d36-7b6b86801e08", "value": "TRANSACTION_INTTRANSFER_1617266945242_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f01ae4c-9b51-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618205801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205801, "uuid": "739a23f7-82c1-4825-afde-1ef7f9fe2879", "comment": "Malware payload (GuLoader)", "value": "0bbf60240e66e82ba4adf5d8e9b61ba0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205801, "uuid": "b9516afc-60aa-4673-a164-5d814cec6c9c", "comment": "Malware payload (GuLoader)", "value": "3b4f801135ba694a061a4608da04b1c0935f090b7b4c540bcace9b1bd1eecb9a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205801, "uuid": "87090b81-d0c0-4e27-8ccf-9ceecb59c26e", "comment": "Malware payload (GuLoader)", "value": "d9d2142b4b34e3aad4020dd4d2ee918bd7d34847", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205801, "uuid": "9b1bf120-7fd0-4b09-83ba-94de9bdf562e", "comment": "Malware payload (GuLoader)", "value": "8881b96bc798504c62ece8d5eb420a69adb6e0f6f019cc7a4140ae4409e857738db8dda91db0229507ca03afc9779ec5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205801, "uuid": "2f5a480b-25e1-4724-b971-94f49599fdb0", "value": "88C5334BEEC68B65D2AD57F2A6CC846A174C2C2077125C8FBB8EF4B2217B133115A375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205801, "uuid": "ffbe56cb-346c-4e56-ab3c-33fcb08e7925", "value": "49152:pfLUFrbLpBmyvdK72GOAzkZhMUC+7cr+opxXEHGFPrwnnd0Vn:pFHXOqyhMT+7e+ofX5rwnnqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205801, "uuid": "c03e9b08-0679-4b42-aea2-c541fbca4220", "value": 2496512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205801, "uuid": "84d35b4a-eb47-49e7-a786-44f4476c7eef", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205801, "uuid": "ed267ddf-7a8d-4299-9a79-622bdd1e1e6d", "value": "Required Order Quantity.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "011711f7-9bc8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618256887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256887, "uuid": "9fdeaafa-7db6-454b-898e-9b6b24971785", "comment": "Malware payload", "value": "dd19bb77b590ffaef0fa80334bf05781", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256887, "uuid": "506b7ce4-0824-40fd-87da-92c9bd4fd606", "comment": "Malware payload", "value": "3b8a3f7841c911872878f9e562ba0e694fb7a23c3ac29c17a61df65a5765b0b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256887, "uuid": "058dcaeb-f82a-4fe3-98ee-ec5b4d2c6205", "comment": "Malware payload", "value": "6c07c7ecac52af4d4c578a13ec4f7616036fad08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256887, "uuid": "c16dbe42-ad97-4494-889a-094fba8d0e7e", "comment": "Malware payload", "value": "c94c993189e7634547df3b98c7cd35655a129ee7afee2557fc7b76940281af2b0a155626f58e6ea890b7ad85a090484e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256887, "uuid": "360fe812-92ff-42b0-b070-b34ff89ca8fd", "value": "95538016B757C9A3D1596A358EE2D6CB3331BC22BD81930F318A332F2E379509E42B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256887, "uuid": "a7a61e26-c61f-48db-b93a-4ed2ace02de9", "value": "384:t9wmDkQdELAcwIpXrLvjAls0I3xuw1rRx:TAtnpXrLv0ls7Buw1rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618256887, "uuid": "74a0c19f-7c16-4a40-929f-d1e21e48fa3e", "value": 65025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618256887, "uuid": "4b91e5c9-8b9f-42af-b8b3-38e494061347", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256887, "uuid": "91bf21bb-298a-4242-84c7-c4e13cf0636a", "value": "SecuriteInfo.com.Heur.28330.29259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0ffc0f-9bc9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1618257632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257632, "uuid": "2a3c6569-1893-4e30-8dc9-8ebc471f0568", "comment": "Malware payload (Amadey)", "value": "02ee028565fa711ea492bc8741517bb6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257632, "uuid": "3cf3469a-44e4-4cc6-9dae-afccb991b911", "comment": "Malware payload (Amadey)", "value": "3d7809d9eeab2b8d49967222cbed7962af14643472238fa9da69b035604bf9fe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257632, "uuid": "da431d57-6be3-4125-8dd4-5b14a1e977c6", "comment": "Malware payload (Amadey)", "value": "177938b65bcfa3017daf4884ca97246d0cdec66b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257632, "uuid": "9b6d1f37-51b1-432a-bf38-d44d377cf319", "comment": "Malware payload (Amadey)", "value": "85523f12d8f926fd42ddaea25c14c9f59550857923e289b27b2d6d1a98489ec2e3f22433888ea1dfc02d453a44946b2c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257632, "uuid": "b10c0ba9-f8a8-49e1-b219-384bb221acfc", "value": "4F54CF1073D0D032D09365798624C7B95EBFB8766A3AA98F7BD10BB94F283D19B2530D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257632, "uuid": "424f26a6-5bdc-47d0-9dfc-2b442d0ff8c6", "value": "e124209f91a98dbd65697c49d4798cec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257632, "uuid": "8d0865c6-ffd7-4202-9a64-b67779fa6aea", "value": "3072:wH36N1LhesnkfVJi8yT+93nGsb1OP3S2Al4XxTztaItHngScBcJUlmTLjrgwHx3H:F1LhHngpY0nK3SfSg9JYTXkwHxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618257632, "uuid": "a12f25a7-5613-4409-855a-f7d6453d1247", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618257632, "uuid": "bef36866-c220-4636-b00c-5f3e61750891", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257632, "uuid": "0ce94830-6104-47f5-bdb5-cb8f517bd37a", "value": "02EE028565FA711EA492BC8741517BB6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8fb742-9ba1-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618240242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240242, "uuid": "600763cb-3eee-4d31-b360-5be5c6aaf0ad", "comment": "Malware payload (AgentTesla)", "value": "2c027189bae22d11cec825cb9ea1cafe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240242, "uuid": "69b7abc5-3d5d-443c-b0b2-2d9b1de54cac", "comment": "Malware payload (AgentTesla)", "value": "3da9ec54df386f7079b344f3761263e655186f4a2cf793b8e48f2e613a359da6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240242, "uuid": "05074ae4-e935-4b4e-bd5b-8d66e822f06e", "comment": "Malware payload (AgentTesla)", "value": "7c0a3e74ba6df67b791907942977b59377782a1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240242, "uuid": "a9295a6e-2c59-4964-8b80-6335242d543c", "comment": "Malware payload (AgentTesla)", "value": "d06aa29f2f4bc3fc8e8409b5092cf1ae9efc8ddd6ff23d5278891392e8e174034f842abb464f69e3f20193432cebb389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240242, "uuid": "948b83ee-ffb3-438a-8b5c-b4a020ebeb1f", "value": "0455013953EB4A15E4BE1B3540F0604503B5BD169A23E30AFAAC30695F737D68A2F367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240242, "uuid": "b914130b-e55a-432f-94a1-503f2dcbbc88", "value": "12288:fopTcgSA5FMxYj3yATy1nWPGNUsSvjHAE0diJHXbms5PulZWYNh3Cq4HrRDi4DHL:oTNHgYjiA21WL7PNas5PuyY/d4HNhmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240242, "uuid": "5a28482c-cb60-4e57-907d-88db812fb1da", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240242, "uuid": "d7136291-2d15-4fbf-bba3-6919f498d9e8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240242, "uuid": "7313bc6f-fab7-480d-bab1-79cd8180c6f6", "value": "UOB_BANK_MT104_SCAN.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d8a652-9b96-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235823, "uuid": "f149281f-6a40-45b4-ba27-22b208ae3cc2", "comment": "Malware payload (AgentTesla)", "value": "8bdb5747650be0e1f6d7e39592464900", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235823, "uuid": "a335ddcb-65c8-452e-90c3-0ef419bb9e66", "comment": "Malware payload (AgentTesla)", "value": "3df772cc47cf13022c18933fe3dd70a97a345d6f320744cf0979f31576d86ab9", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235823, "uuid": "2ab6fd2f-5b33-457e-878c-977a4e79d449", "comment": "Malware payload (AgentTesla)", "value": "d01444a25ac98e743b88e66c12e3e4a02436d442", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235823, "uuid": "cab9fb3d-ea68-4d71-a6bc-1a1bb753fb89", "comment": "Malware payload (AgentTesla)", "value": "a65beef854963422c25881a067c07097c88770707863b0b54a426d12e160a21f3f7ef5b61dba0e498fe499f51284ef60", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235823, "uuid": "9bb345d0-4037-4bb1-bbfa-9169a2433f03", "value": "5FC423B0E237269CAE11126273F70F0F81A38FB55DDD502E866BF172D0295B9C0D96DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235823, "uuid": "d7bc91a7-67e7-45a9-9a2f-ceeebcf76903", "value": "12288:b7arU8ddsPbv/YekOiKwK7SMbeq1Nm3D6K002rF0O:byw2Ova5q1bx/0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235823, "uuid": "aac439a6-c963-4770-944a-7670e2f483f5", "value": 571517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235823, "uuid": "ce7dcb00-a4e7-4338-8189-f8896a8a29de", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235823, "uuid": "d5aeffe9-5f01-45e0-aec8-62a1b767369e", "value": "Files & Specification.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebe7750-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207948, "uuid": "6ed95461-f5bc-4000-b568-3c921a24e55d", "comment": "Malware payload (Formbook)", "value": "8bd036286ba806958482a6cccfa340f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207948, "uuid": "fd17b373-bfa3-437a-a52e-dd49e0bbf49c", "comment": "Malware payload (Formbook)", "value": "3ee16719fc617c8d3728a86d42cb51036bc0ceaaa6b94b06ce0b8242f2d47dcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207948, "uuid": "8ef88bf1-eb2e-4a06-806a-d01be1b60710", "comment": "Malware payload (Formbook)", "value": "89441675e21debbbdc415093d8f1866cf969747c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207948, "uuid": "e6da3206-e007-4dc2-b57c-faa6580432e9", "comment": "Malware payload (Formbook)", "value": "e37bf5f61fbdd0f81ca0cb4122635777b80a1379570d6af7ea13fb17e452826b0fe2b6ed229a725eb2dc0027ca5e39e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207948, "uuid": "8c3eb85c-61fb-4986-9481-3269250d3498", "value": "A834AD9D755476DFC82BC872CAA81CB4EA5028BB471BD203E45325ED9A0D99BCF180F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207948, "uuid": "5ac10b41-904c-4077-a3b5-b1dc0d2bd5c8", "value": "6144:yFlacia3ejkBceIgnI73t0ebcGed/5VG+WXqrf:yFlRHByhHedG+WXqrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207948, "uuid": "eb13b2bd-6111-404b-bb90-4f60b2259691", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207948, "uuid": "6f989e83-e8c7-44a0-aa0f-e6abcd433a43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207948, "uuid": "7b6e4bd5-e9ff-4ac3-879f-9a6adfccbf0a", "value": "PO#652_009989.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66226fc8-9b46-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618201222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201222, "uuid": "f149d804-22af-4d82-8260-78c9a200fece", "comment": "Malware payload (AsyncRAT)", "value": "27974ccf880d2dea88f9ba0bf170ac8f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201222, "uuid": "e0f57df0-5a2a-4495-93c6-27272ccef4ec", "comment": "Malware payload (AsyncRAT)", "value": "3ef4c947ea7f9618cb2e274ae2791ba402db0b8844f32780b05e8abdbb9f36a2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201222, "uuid": "53b9bfa3-4673-4e54-80ba-cb14d7b77493", "comment": "Malware payload (AsyncRAT)", "value": "dc429c6fdb5383072c70c5467052f35fc52e9294", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201222, "uuid": "3bcc88b2-1475-4d60-a4d2-7bb6921c34c6", "comment": "Malware payload (AsyncRAT)", "value": "1ddf602808996988bf9f7d6acba643f62b18a39f6c25c2a4ca21eb0fda6a2da1e7b7ce1bb320b272240341c018f9ecf6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201222, "uuid": "189fac2d-9f61-4e36-b4d2-3f6eee55cac8", "value": "525302A287B04636C8FB8F38297747E10174E657A70DDF36A24494D7ECA655C0E29ECC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201222, "uuid": "13b22017-9bdd-4fa8-a6d8-4b1218f04a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201222, "uuid": "b6b8642f-024d-4f4f-a910-bebddbf66479", "value": "1536:LcHtBxpYeYwnQCVXTUTGwRmjQu5njOiNi31nsj5zgpBUVAttLqnTDzR7Jb6mAj:oNBxpYeYwH4TGYmV1zcLqTDzX6mAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618201222, "uuid": "c19e6241-23cf-438c-aa52-54ab58bc5740", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618201222, "uuid": "4e941d54-21cd-4d53-b743-4f7cc7437e15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201222, "uuid": "d30b7837-eea2-4a8c-96e7-78ab328bf55b", "value": "27974CCF880D2DEA88F9BA0BF170AC8F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4083a020-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618207602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207602, "uuid": "c1050411-10df-4e52-8faa-c4e8950b6ab1", "comment": "Malware payload (AveMariaRAT)", "value": "5508a8d10593b2fcc7100cbf0edab9a1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207602, "uuid": "ae72e33a-0085-4f2c-a6c1-c2cd53b04aa6", "comment": "Malware payload (AveMariaRAT)", "value": "3fee9dd9ad7eeb2357adc1d38e030485a52de34f9b2fc823558d263d23b498e7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207602, "uuid": "c067d675-d6f7-423b-a58c-016d50702e09", "comment": "Malware payload (AveMariaRAT)", "value": "1434320ace37bb5ecb4beb2d02f5b8d04b0f5b6d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207602, "uuid": "75c935dd-a264-4a99-a266-112be01b92df", "comment": "Malware payload (AveMariaRAT)", "value": "1a8b59c4ffd6b4669fbe47e51c8b86114cd4a235267dda430d591196c8b0d0460d1e7ce091583f2191af4f5545583ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207602, "uuid": "da438e5d-524a-4857-97cb-b212c8915570", "value": "B9E442E453DB87ACC21265482884F6851EB2F55A30F50D60B37E84B8DF48EF67F88697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207602, "uuid": "44760e39-82a4-4c6b-bc5d-41d3d618537a", "value": "6144:csKIoEpE4v7KDKkv0SHU85kPcYqZ8PRhOuVcV1SAPAdzFDWRDAUwI:csVsSAPAdzFKRsUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207602, "uuid": "6bcdc06f-291b-4e06-b4e7-9829d4748736", "value": 713292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207602, "uuid": "159c185e-3bad-4cdb-9bfa-9520b52df61f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207602, "uuid": "e2898c1e-5c05-48d5-bf37-e47a23106cf3", "value": "Pago 2021.01.9872626.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9146a84d-9b85-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618228353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228353, "uuid": "5955ab06-de2d-4513-a2c3-62452cb11545", "comment": "Malware payload (AgentTesla)", "value": "88926051eb8f9a2ff4ab25ce7a0ad41a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228353, "uuid": "373808c5-67e5-4d22-8b5d-cd0d4ad55a7e", "comment": "Malware payload (AgentTesla)", "value": "40295912aeeb49a6c9cb45bf5981e80ed788de2984e6306ccfd8cbfdc6855c9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228353, "uuid": "316c41a2-2517-40a1-82e9-b5733ef5e634", "comment": "Malware payload (AgentTesla)", "value": "e67ecfbae026b6643e2efb7e22a0b209658d943a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228353, "uuid": "bef8ae4e-438a-46fe-9617-b1fdd9b28179", "comment": "Malware payload (AgentTesla)", "value": "9d07157661c1862a6c60d02fc04f3e4cc80e3a8bdbac339467cc74a22c9ae09d1792b8236a347dfde7f6df5eaa991869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228353, "uuid": "74d4baa7-e8ff-4966-8493-0598a4f9b3fd", "value": "8D058D6C72507A9EC9B7CC338E981C30EBA8A466470BD617A06701AD9D5DE97CF340F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228353, "uuid": "03606420-f678-4fee-9876-695a74c6b537", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228353, "uuid": "56d4d66d-9b17-4a1a-a856-a051a8b07fb2", "value": "12288:ig6kXAJ/2b2wJM0YoIVVT3qkZwQd4Ewym5oAA0K9oehaU+hDVD2UAdgGwUtMI6yh:0wAJUb0dPwyko+ONaU+hkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618228353, "uuid": "15658c91-1c61-4b22-90b1-de262645edfe", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618228353, "uuid": "b13a7915-15cf-4d60-aa54-5d8a8d68553c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228353, "uuid": "2258e001-7ae5-4adf-8564-203638cac277", "value": "Shipping_Documents000000000000000000020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a318239d-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207767, "uuid": "139f8479-d13a-42ea-92ec-50fa3dd24079", "comment": "Malware payload (RemcosRAT)", "value": "af058ecad4a2e9eab73ccc22ef8e8830", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207767, "uuid": "274ba65f-505d-49e4-9d5d-71b2303ff814", "comment": "Malware payload (RemcosRAT)", "value": "405406d5cae5375b31a61d4d0c9fc0fe4817cc314e55fb2fbd840ba1395a67ac", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207767, "uuid": "dea7f2fc-e351-499c-a76a-38ab612103ac", "comment": "Malware payload (RemcosRAT)", "value": "a5553ee35cec50b2835c988c2617a38d35213ad1", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207767, "uuid": "a5b34d30-5927-404d-827e-363b6bab1dc0", "comment": "Malware payload (RemcosRAT)", "value": "dc09c7a187e97e17a7d4bd9330c31c2fc6b59ccf3043929b63b4f820fcd0365e4f6acd5244ff9b060362d742fb3b6923", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207767, "uuid": "7f641cb7-75c4-4780-97a2-db9e584363dc", "value": "4B53020DA12B6E506BD2B3E5FF488775B6A900E2D08F6F7CD6456399EC1C324CE89432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207767, "uuid": "d10ead7e-0c52-4a13-9278-9b78c6c1968b", "value": "768:w7olnH5hg/XXdVju38TKDU90RTg+nbHpZrr5bAixWxLGaA/3QNZj26RCPv78krhS:Bn/gvdcmKDFg+b7wxPA/3Qz26R+v78YS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207767, "uuid": "c89198ea-3de3-463c-baa0-38948dfee488", "value": 61417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207767, "uuid": "c4e012b8-067f-419a-9294-9c0675dbe399", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207767, "uuid": "5a153a03-be37-42bc-83a3-8534db762382", "value": "Cobro Juridico_07223243630_5643594_539661009070075_49874359_5059639084170590400_7272781644.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39859671-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618214462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214462, "uuid": "3675ef84-0e25-48ce-ae6f-704c104c098d", "comment": "Malware payload (AveMariaRAT)", "value": "90aced49ee9c5ce3fc9f47ba8fd7333d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214462, "uuid": "319c92a7-ee97-46fc-b56d-97dacce8da5c", "comment": "Malware payload (AveMariaRAT)", "value": "40d4ee1e0fa412176d826027c500bfbc29ee4c65bfd13dcec2f0facd0021399c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214462, "uuid": "728499bd-a027-4106-a7a8-02be69d3e09b", "comment": "Malware payload (AveMariaRAT)", "value": "80aff2fec277427a40de384be7c8119a19354166", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214462, "uuid": "9fd170e0-dfe1-4c03-91e1-3014f84b79de", "comment": "Malware payload (AveMariaRAT)", "value": "ebe587a9da4a7a6e39ea3f40ede19910683f3b950008870c29e9af3e6693d85763cbefbbe0fa8c327f8b6677421c0cdf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214462, "uuid": "a14a8090-de5a-448e-9747-ea7d4c9d03c7", "value": "3B75E8F057C4535FF1DED23997A69F604AA8C1A6A8910F9703C99390AF8C35FA03C799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214462, "uuid": "7ed511c5-2700-4518-8640-ff7e3d3d2f1c", "value": "4a781930090209c67b1a0398b1940cca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214462, "uuid": "225aa97c-3c85-4367-84af-7d802185f8b6", "value": "6144:zdhq8+0St/u22jBUYWccGQy0AZo/aiEzHmHufrIbpZlvRBFyV9tDH6VdIa3aLHbc:zJ5XjBUYhc97AGaJ62rOw3EzxBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214462, "uuid": "e17df36d-ddfd-401a-901c-350bb21e1503", "value": 1560064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214462, "uuid": "5c9b09f6-6c63-4052-818c-aa3e7a06d5c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214462, "uuid": "b8fef153-8708-4995-8e85-c947a2ce06b4", "value": "90aced49ee9c5ce3fc9f47ba8fd7333d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848ec460-9b99-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618236922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236922, "uuid": "5c494963-0d2e-4e3c-8105-431213431a17", "comment": "Malware payload (AgentTesla)", "value": "5427feae910a7740ffd0a4095483209e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236922, "uuid": "96942705-b9ec-48b8-a3c7-1a8ba82ffbcc", "comment": "Malware payload (AgentTesla)", "value": "4119c459d899ba60aabda3f7b0fbbea1b23e952cdb778f61bfff7b10ff9b4d07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236922, "uuid": "efb9e709-b3c3-483b-ad5e-f9966b6bfa35", "comment": "Malware payload (AgentTesla)", "value": "a6c814299bf1b3784497feaf05ffa7e4306ffa7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236922, "uuid": "fa1ddc36-c95b-4025-943c-207e52fa6353", "comment": "Malware payload (AgentTesla)", "value": "f98c408d2092b48cffc9e18fd0a7ecbe937059d0dda30001c8c8d8b08aeabaeb8603acde4f70abcde043be4bf53cea90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236922, "uuid": "aac1f8fb-9c29-4fa1-82a1-5d2f23f30993", "value": "88B423A239B080CD7B6B6E4F47DAC315B1FA4737EEF63624860BD3993F440464549AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236922, "uuid": "ce673bed-4851-4b3c-9ced-2dd4208d320f", "value": "6144:FzVSv6ZzZUpENfRbXYpO2TqkNPq4ZD9NgXpJdEgtHUO3Etoc9Eovb1FVvqY7bE:5UAlUpUfRrYp7Wkh2vnUO33d+bbVvqeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236922, "uuid": "ad88bb44-499a-4560-9daa-7d15da72d05b", "value": 509024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236922, "uuid": "f963de83-791a-4442-9b12-99946235d919", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236922, "uuid": "c64f9862-9986-47ab-aa9d-15e4ab1a7966", "value": "Swift_Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb302a0-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618214497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214497, "uuid": "c0277663-a3ed-4917-81b8-dd1f759a10da", "comment": "Malware payload", "value": "78859832e79c6d7aedad2de7612b375c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214497, "uuid": "3d5f7621-62b7-4df2-9614-3d572ec2a36e", "comment": "Malware payload", "value": "41d1addb382678e81ab59cb80613f2c2ee746b2615233674cc8c323a9a0eff4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214497, "uuid": "b5e4cb67-569c-442c-94ca-b1d32ca8ab3e", "comment": "Malware payload", "value": "c3500ef4564a6f9db708642890e38a401915759d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214497, "uuid": "8b61d0ec-de73-4754-bf75-e259477d7fa8", "comment": "Malware payload", "value": "16b7686072784f3226acd843010878fbe240c180e2499101dc8e79b60853c93b0e45d13d5a02d9320371aa76a0430d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214497, "uuid": "feda3345-a51b-4441-af68-1ef0fc7c01d9", "value": "ABC58C29B1B34CB6F36A5E36581641A0673EFD843E28ACD635D6FA3E0BF514335261C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214497, "uuid": "14d6efcf-1ddf-4e0f-9431-a676f5088205", "value": "ba4cc0afb12afe0a3f885ae6696404ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214497, "uuid": "c2c9bea7-da1a-4319-9513-4665693b52b8", "value": "49152:ug8rPO37fzH4A6hanqNmmH0NUF9wZdmD:P8rPO37fzH4A6h0Xiad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214497, "uuid": "f380a340-12f7-4a8a-84c1-fc889029ebae", "value": 2611424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214497, "uuid": "8e131e0b-8d08-4600-831c-42003b465a92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214497, "uuid": "70bda1d5-49c8-4236-8bf1-888731bb4ba5", "value": "78859832e79c6d7aedad2de7612b375c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f06b90-9b90-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618232954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232954, "uuid": "ffc6788c-c404-4e8f-94e2-578722adcff0", "comment": "Malware payload (AgentTesla)", "value": "abeb7aa739c4f99c996b91e51a1fa885", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232954, "uuid": "2e02c3fc-aba3-4194-bad0-1cefa1d8f7cf", "comment": "Malware payload (AgentTesla)", "value": "428039d6537a6684c3825bc678f9939754a71e346a8bf5d50b9dabfdce19acff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232954, "uuid": "7621445c-64a8-472c-a17b-f1391ddcfec1", "comment": "Malware payload (AgentTesla)", "value": "a0dbd11a666dba40556f7131d5845a061769a62f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232954, "uuid": "2bb22908-aabe-4838-ad65-3949973f5e91", "comment": "Malware payload (AgentTesla)", "value": "f6792a30d8e8fb23ab83dc9ac3223c76bd974b855a7c9924a1b28d05cf1837d7059abdd09c6161cc551641b6b86ad26d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232954, "uuid": "c05f00f3-10fc-438f-89b9-ec638d7bd2c8", "value": "2315012D7208DD11E5BD0B3BD8E185206779FC22AB63D77969E8346C5FB2BF81166202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232954, "uuid": "ba9cac5f-5b37-461f-bab9-4c66c3c007e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232954, "uuid": "b6d3e03f-e23c-40f2-827f-96f11c24e9de", "value": "24576:4FRSVYNp2zQ7GGGaw7nJm7vooyqXRiuDWYTf:4HlNEUdGZ7nCgvK3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618232954, "uuid": "ccb65968-6239-4d2a-8346-80fe12b8b520", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618232954, "uuid": "0a72e8f1-f406-434f-95c2-aed124a6cdc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232954, "uuid": "a2988f5a-97b5-4995-890b-6d1aa3c74b7b", "value": "SecuriteInfo.com.Scr.Malcodegdn30.29716.20863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbafb2cc-9b46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618201420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201420, "uuid": "ca4758ab-6223-453b-a03c-3aa3736aaed2", "comment": "Malware payload (Loki)", "value": "e24caaa7608fb1f4a08e0c002250ad34", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201420, "uuid": "3a250b70-212d-4365-bda4-32bb35856c1b", "comment": "Malware payload (Loki)", "value": "4380dd5341f62202eb5b410568bc722c065273402f128d17eeb1b6922d263cf5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201420, "uuid": "9f7e9061-d2f0-4628-a078-90dba463cc89", "comment": "Malware payload (Loki)", "value": "d1feb5da4a64960ad472e2470c0e0b33a308688c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201420, "uuid": "533f8a64-75fa-4895-92b8-2a864fb16d13", "comment": "Malware payload (Loki)", "value": "cecb4546f096d7156e3353e7c9dbc10fc8cac17f7f0c2badefe190063f7f37b1a3e8728d8abe96b62d0b3be973237bb6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201420, "uuid": "0763ae81-5353-475d-bb80-176faecf6130", "value": "7CD49D506698CA41E0BA1BB2C47591F60231BDC9E9B7C74F16923D8A3072B8D8CF5F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201420, "uuid": "d40c98a3-d3c8-44f5-8fc4-fac4a0f299fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201420, "uuid": "30201b7c-324b-4faf-98c6-aa27944f5a0e", "value": "12288:JBTk0x42fjzzCECxuFFuuUSKveobmG4qalq3fwiLX89IozGjQ:/I0x/feX4FuuU9vBbmg9f5L3+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618201420, "uuid": "70431b84-9773-4e57-b411-099f3dacd5e9", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618201420, "uuid": "22a4bb7f-164d-417d-bc21-8921fe636a03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201420, "uuid": "c882ce30-ba1b-4ba5-a75f-d7ec20cf0df6", "value": "PO-4147074_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17734f7a-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618206244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206244, "uuid": "9e3de3e9-5c26-418e-88c0-8064b471bcaf", "comment": "Malware payload (Formbook)", "value": "90f0d3969357ee46a86cb67b4f8e0064", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206244, "uuid": "a5dcd89a-f4fe-4ede-a2dd-34fc9a56a3a5", "comment": "Malware payload (Formbook)", "value": "4384bb2d31e6ade5770b6e4b464d4d6d306898d021b3936e97deda6471a88521", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206244, "uuid": "6739e0dd-f879-45a7-a4b4-d54877589300", "comment": "Malware payload (Formbook)", "value": "40579942f470b9d403573a7b1546d80b363fbf7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206244, "uuid": "b559f31e-e42e-45b4-918c-c50c03e9a196", "comment": "Malware payload (Formbook)", "value": "cd668605f85ae95e84bbd21f48de7e8e070e1fc7d5de4be39ef0e6ef705e19a6b8bc6ed15906e57a0386cbd31ba82a77", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206244, "uuid": "45ec9088-5192-4046-b00e-eb1392f95e58", "value": "AD24121F5FC6923A96D26646A402671CFE73E434F9E34D2B8CC193DBDED0A1B14DA108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206244, "uuid": "44883143-0439-433f-a8fa-81275eabcb6d", "value": "6144:2evLWiSnBqBNWs+EN7iqv/Z4QIUhSdKewXJ9:jvL7nB0E4a/Z4NUhCJwXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206244, "uuid": "fa17563b-1a68-434a-b19b-3eabc6b1fe4a", "value": 215725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206244, "uuid": "306ea3a1-d624-4537-a20f-45bf2ad36c74", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206244, "uuid": "e4ef6357-448c-4af1-830a-f0df31b7e05e", "value": "PROFORMA INVOICE.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acb149c-9bab-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618244529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244529, "uuid": "d32cdb30-49ee-4724-a834-53d85d5693de", "comment": "Malware payload (Formbook)", "value": "60bcb12ff719b3eba42022265051550d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244529, "uuid": "8596a9a6-c5e8-4c3d-8cb9-09300998760e", "comment": "Malware payload (Formbook)", "value": "43a2069e57baacb53de658addca8950b570ce19334cd6c617c4c1060f9296fb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244529, "uuid": "65388afd-ec13-4647-9572-9f67b335be6c", "comment": "Malware payload (Formbook)", "value": "108a794f0bd4bd6b7261c9cd19f8493246fe75eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244529, "uuid": "26119ee2-2ce7-4576-abb9-672d096a6b7a", "comment": "Malware payload (Formbook)", "value": "e5f76bfed4aba0cb266e41ce58318ab376fbcec9b251e833655be3798302a411962ccef4307128fd8a27e7f9d2d7051a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244529, "uuid": "3700aaae-d4b1-4643-bc85-9ace22352e7f", "value": "F115CFAC36507ADFC927C976CA581C74EA6070BA531BD203A05712EDAE0DAA7DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244529, "uuid": "4f8b5ab7-b33f-4e9c-8ef0-a701b2163c03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244529, "uuid": "3ecff296-5145-4a9b-bc8c-fcdbeb18db4e", "value": "24576:LfkgkOV3X5Y+YWoaEEcUi9XfSaX7CIt8yRb:Lfk6Jga7adfLeIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618244529, "uuid": "9c90b074-9a2a-467c-8c89-58065b1ada98", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618244529, "uuid": "ce198cc7-904e-4c20-8a31-2a17f2fa1426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244529, "uuid": "f9215e4f-a5f6-44ee-a26f-0d43aa84b2c6", "value": "scan copy 2402021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44edd987-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618241969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241969, "uuid": "30563508-d4b7-4e9b-8a7b-646790e49a09", "comment": "Malware payload (AgentTesla)", "value": "3205d072f70725e86869ccce53281408", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241969, "uuid": "7b15e908-f746-46a8-ae4c-74805946de3f", "comment": "Malware payload (AgentTesla)", "value": "44e9c4cb56e317235ff3903e47b50db7b104353c1a889f0a05a5b48cdf53ad3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241969, "uuid": "bb6f4a6a-76f0-4a53-a6cd-db581de75fc2", "comment": "Malware payload (AgentTesla)", "value": "402047c142a1cf053e4e4857113396864c51ec47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241969, "uuid": "945c7ea8-8061-4d0b-bb9c-48df3c9ce234", "comment": "Malware payload (AgentTesla)", "value": "1c9f79d2a495c77df6a4fcd1ba18562d478d355b46addea49750584f574ab5a3f2343f295883e8c342932c7a91c2e285", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241969, "uuid": "29e54846-d7b4-43fe-a944-20b5244d1394", "value": "8F15BEAD365075DFC82BC976CAA81C64EA20747B530BD203A01316EDAE5DA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241969, "uuid": "99407ddf-c0ef-4a91-ba4d-233aee5f84b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241969, "uuid": "ebc2ae48-99dd-4994-ac00-76dba6639b93", "value": "24576:hHNWL4VjH/9q23KX2CE8hbD9UuvgNgexKd:+L6/9q23o2shnlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618241969, "uuid": "f196da60-a4e0-4c1e-8548-eeef35dba673", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618241969, "uuid": "c2f034ad-36a5-4da0-9e05-a183c4fe8ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241969, "uuid": "047d4d55-f0cf-43a0-b2ec-3b85a75593c8", "value": "Contact form.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941dda65-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207312, "uuid": "8a137b53-4dc5-41ee-9bbc-e99f7eea9450", "comment": "Malware payload (SnakeKeylogger)", "value": "e092839086aad0104492783af34f67d4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207312, "uuid": "40275e65-54f4-424e-965d-147b336e9419", "comment": "Malware payload (SnakeKeylogger)", "value": "450bed1f8df21145957661356f865f7d31762328ee7b2b087ab1df0a57e534ca", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207312, "uuid": "daa92d28-0670-4454-a761-5d7b18ae467b", "comment": "Malware payload (SnakeKeylogger)", "value": "619e2da09dbf2bd764804ee01bd577afbd7057b2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207312, "uuid": "3de1ec4e-ba3a-4458-8d86-21840418be06", "comment": "Malware payload (SnakeKeylogger)", "value": "14600737b0bad2e3563504ef4b0f11a02bcaa08f422a24cbbbe0aeb2a7541928a98786844c0a0246ea9875e7ce080bb7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207312, "uuid": "5efbb8c6-c415-4e2c-ba82-f3f1ede42f5b", "value": "7DC423076DFE03A43AB7580B38852EDCA183CC635E110F6B5F1214DF99EAB29B1D95C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207312, "uuid": "fc3c3930-171f-4b02-bafe-6e946d9c83fe", "value": "12288:cXzR+fJwZ7sZ2pM0Ak0PuCPCu2BeEwUzKwaNMqKpv:ozRTZa2p/3pjyePv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207312, "uuid": "479559f3-d940-4997-be08-37c1652c37bf", "value": 578409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207312, "uuid": "4693e721-2717-4aae-b86f-b68a9ff53965", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207312, "uuid": "9c81fa5d-16df-4550-bcde-71d6a0c35561", "value": "fyi.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3a9f52-9b70-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618219458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219458, "uuid": "9fe6b985-73a5-4359-9a0c-e26ebe59ddc1", "comment": "Malware payload", "value": "398dd67cef5047e52c2e4a9c558b21dc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219458, "uuid": "911bcc85-d02a-4942-9ef3-c7aba8698319", "comment": "Malware payload", "value": "454b8a1236e5c819a5eb73785d04de86f951ee7dc99d00698a60f2b7abdad407", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219458, "uuid": "5d369b12-fca0-46d2-be8e-8bf4dffb4d50", "comment": "Malware payload", "value": "1ce7af923e02a02e3af31be8099a5eaa9d267310", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219458, "uuid": "ad978088-75a2-49fd-ac90-89f6594380ff", "comment": "Malware payload", "value": "a76318dea2ea9b03cba5f6c586d9fd2732cb908e875b68f3baddbbdca7897b1968f2e820fafc7fa8c8a456443506edd8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219458, "uuid": "bd198631-0167-431e-8d1e-48bdc8c2fa5f", "value": "20A484ACC09747EC8FCDB7B46A1A1F891208B76DE385E5533638A7752B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219458, "uuid": "5abe176f-ea56-4d31-be31-38b4061d8855", "value": "6144:DLiNuUTIwbqkKuL7SxwqtOKz/cRWRRD/GoicGmaynEIaicslF5nL:DOD8wbqpuKaq4I/BRRDOoitOErQ75L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219458, "uuid": "8fea021a-437f-4b22-a412-f8f6b4e0d677", "value": 458286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219458, "uuid": "3298384c-f3f9-4202-a3d0-402f4ac883e3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219458, "uuid": "bb543e60-c986-4e0a-a69b-8fed080a0e25", "value": "INV_0008434567987.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0520097-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618206501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206501, "uuid": "1bff67a0-464f-443c-aec9-c9f5ec2869c8", "comment": "Malware payload (AgentTesla)", "value": "dc62921c8300d8ee4333b1bd99e7b9f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206501, "uuid": "a28b2726-8c94-4fdb-b46b-d5bb788b1732", "comment": "Malware payload (AgentTesla)", "value": "45f3a4a619770834b6c61f5db3182a1f884cc1efe9c2b38a10d57add2c270336", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206501, "uuid": "1718bf68-4fb7-4f59-8c23-805a1eac080e", "comment": "Malware payload (AgentTesla)", "value": "f692ecf682788d93ceb08f1c321e44b7e1aac69b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206501, "uuid": "b4243c9f-e46b-4a90-9854-5932e4ddc889", "comment": "Malware payload (AgentTesla)", "value": "a8db0dce3e214a6553a49f7d2dedded2156f053042d8b90ff24915149eec65a92ce849fa9824e15219291bb0401bcc57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206501, "uuid": "c5d0035f-69fb-4e1e-9f79-3d397db8d584", "value": "35E43383441A96EA21AC46DEC3C0675978353FD633BE5B5419C928E3C681F2DFEF4819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206501, "uuid": "359a023e-f1b4-4ee7-9bb0-4e1f2d59af3b", "value": "12288:GqogMNgVl9/x5gn2ulunfmu/WamQAEgggFxE1We5kDUevZrFg8Zxu0bhL01:GqoB6lrg2ul+r/VBj9ave5eZhM0NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206501, "uuid": "b57f56ed-91e2-480b-966b-d2bb4f1a9b71", "value": 699343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206501, "uuid": "abf0fb1a-6de4-4cdd-830e-c61260829071", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206501, "uuid": "b6a58be0-c598-41a1-9d2d-48e674db2fcf", "value": "invoice, 02209.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb1ba89-9b98-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618236640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236640, "uuid": "de00fdce-acb1-41c9-8984-c7485f85d9be", "comment": "Malware payload (Vjw0rm)", "value": "7d292fabadb1b6cb6fb48cbd4ce748a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236640, "uuid": "c8bf5434-9154-4f30-bb52-19a6a28f52f9", "comment": "Malware payload (Vjw0rm)", "value": "4641938e57106fd29330fd3584c3a67646c4084a71176a54f25cef0feee6caa9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236640, "uuid": "28b7669e-57b9-42b9-817d-5198f784d9f9", "comment": "Malware payload (Vjw0rm)", "value": "2a3fa325ec7add7a822a72188a240db8921d6c96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236640, "uuid": "c6ac806e-754c-479d-b459-316617758248", "comment": "Malware payload (Vjw0rm)", "value": "ec9e3796cb25b54cfc8f020e140177d75ffdbaeb4c66d498f90750a9c7024b322d0a58fcaa914adf35af228b7fbf1ef5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236640, "uuid": "29085b0b-97e2-4e28-afab-65a873611b75", "value": "F0D29C65D0DA4BFFAF216364AF274083ACFAF1749A6CED0CFDBD5916564005F1A202B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236640, "uuid": "3932d486-77c7-4db4-8b72-1bd56552c6e1", "value": "768:BrRTuaXC1e0gbg8q7oK68Jm/CmaT5mRL3EcbLqElqfYZmzZpwKUkMkPfLKXUk8WD:BrpC1e0gbg8q7oK68Jm/CmaFmRL7LqEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236640, "uuid": "0cd75829-5fa1-4f54-a177-d694dbd31841", "value": 30636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236640, "uuid": "11ce1f6b-d404-4943-a0bb-2769f026cf2d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236640, "uuid": "1b6f2351-cab9-4523-89a3-d394d2c587f3", "value": "ID902837730202.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe18400-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207762, "uuid": "c5cbd432-f896-43fa-a1b5-052058a5a58b", "comment": "Malware payload (AgentTesla)", "value": "2ae73d2b060aa5b7db56648e7d2a9910", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207762, "uuid": "07a651b6-14d2-43ec-9c2f-3d213904f310", "comment": "Malware payload (AgentTesla)", "value": "46445ab1b69071e40cc0191094db4f646dc6344a6623abdf5aaa0d3dac23f805", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207762, "uuid": "550980df-edbc-4d55-9f28-eefc9e7a65b8", "comment": "Malware payload (AgentTesla)", "value": "c0415ae71de138b3a755add538a53691bf355036", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207762, "uuid": "fd136ca2-67c4-455e-8084-0a2a1bd1f807", "comment": "Malware payload (AgentTesla)", "value": "98ee25a03ef311e6af665b70909b4b290cdcaa45254ae73481134a4688bc0b2890bd720d8717a7abd8eb614fc3c6ecd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207762, "uuid": "5a0b5cc8-a435-425d-890d-375aebe78485", "value": "4842EA0DFBDD823DD27A437AA9F18A30127CF9565857FBAF14C421A52D2234D01A1EB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207762, "uuid": "0052e2a2-509d-4e3d-95d3-764f642bca60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207762, "uuid": "04210f35-a524-4b74-a30a-411da38a5340", "value": "384:v8DgX2PbYQ4uViHLNNj3BpMJXha/XcJ0WJ:v80Yzdez3BGXKsJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207762, "uuid": "0fe4f4b3-6198-411d-946a-ea36124d1a1e", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207762, "uuid": "aba48366-b91c-422f-83d8-9d387ac0ea6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207762, "uuid": "b3f67d42-0aac-4737-ac81-283a904aa735", "value": "Purchase order and quote confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a43870-9b53-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618206830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206830, "uuid": "7c34fb5c-65f0-49ac-b192-51687d084d76", "comment": "Malware payload (AgentTesla)", "value": "1d16df8b4d98ce5d5f7cd04080e7500d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206830, "uuid": "7974f924-72d5-40c6-8fca-ea4a41db871b", "comment": "Malware payload (AgentTesla)", "value": "46be0e15fd8054635fd3dbebdc5619a5626d673c63c3a91dcb4e203d73b204fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206830, "uuid": "e3f3b78c-e3db-4174-9982-f56d2841f7fb", "comment": "Malware payload (AgentTesla)", "value": "835a7537e409a69fecbfe44cabc95b47f28d9006", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206830, "uuid": "d78b2206-a331-4938-95df-1a08d9c5f80b", "comment": "Malware payload (AgentTesla)", "value": "b0efe9569f4fa7d7135e2be3e1cd29107d2f9581d9ce09618b5c282275dd34d374c78f6199a7b16505143b0725c946ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206830, "uuid": "1793b0dc-9eb2-48ea-a22f-5491eed8ef02", "value": "CDF422437B40CB15F26DEBB4247195210BF9B04EA76AE76E7FA020FD4A57B488F44B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206830, "uuid": "f2c8827b-4b37-43af-9fb1-4118a0e2736b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206830, "uuid": "f326b811-9a5f-4696-993a-e94e51646686", "value": "12288:iF+wfXjjSt+mPEEW/CRPojrgXrY/jqkorkN8zRQWOJvoL4UtKD:iY0SbPEEVRgjuFkwc8RQHE4UAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206830, "uuid": "b2b3991c-11d4-4a32-a472-7d45df412bc7", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206830, "uuid": "3211e385-1165-4a3b-801d-0e175fd933cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206830, "uuid": "2d5e6ac4-95a3-4358-9a1a-38b2809dd689", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ac39ab-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207614, "uuid": "1950722f-5285-41c9-bd7c-7a09f1b370b6", "comment": "Malware payload (AgentTesla)", "value": "b46395385a28e6998e91642436d54c11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207614, "uuid": "a3aff8e9-3bbe-42e8-ae41-b1feb92f647d", "comment": "Malware payload (AgentTesla)", "value": "4749835657113be89c29ee23b6dc720532c9068285f1cbbbadac2e499de20cb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207614, "uuid": "566e8129-10f4-40bc-a9ce-4aa2aa513b23", "comment": "Malware payload (AgentTesla)", "value": "97a43c52d6fbc95aa302ec393a894194760e49c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207614, "uuid": "af7a0389-099b-4ac9-9e30-6be62f9045be", "comment": "Malware payload (AgentTesla)", "value": "ed8949c80126a4e58abd7ec1e9be8bbb4704a9cfabbd4719665f5464acdaa431bbd2067bb8de5c144d37601ff9013b81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207614, "uuid": "82ec530e-d5dc-4235-9fa7-5ae64045bb94", "value": "D694232CC597B80774F44C0A9D287DDA2C52EF8ADB626ADD17332E1E1850479C136BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207614, "uuid": "b487f5ed-0dcd-4cfb-8037-30ac0200c611", "value": "12288:8kMIx263mj3m1ipylQGtYYf0ZA/mxHo5sbUiWkldx:4IDWj3mw0lytA/m1+sg90dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207614, "uuid": "5d364de1-fb8e-4fe0-b58d-42a64fef6d46", "value": 422992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207614, "uuid": "e48c16a6-45a8-4f56-a1fd-a89a380f215c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207614, "uuid": "2a64a38c-a72d-4fe6-900f-f91749d6c7e8", "value": "NEWQUOTATIONs280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fbffbd-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207847, "uuid": "ff6c3732-6048-4dfa-8176-ac298ea1bcb1", "comment": "Malware payload (AgentTesla)", "value": "25ef0b38eefb274349be5f277ff63035", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207847, "uuid": "f812d9da-3028-409f-910e-05527120dc08", "comment": "Malware payload (AgentTesla)", "value": "4766c941067d02569766960e0e44934d7edc2e7fdf047d13ae7821c30afa0146", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207847, "uuid": "b7ef69f4-9a08-46c7-a8ec-d37aae66e590", "comment": "Malware payload (AgentTesla)", "value": "ff8274151c3a2f564fe9faeab9ee2ebef1a6e683", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207847, "uuid": "5672f801-9570-4351-9f22-c7eccd4da790", "comment": "Malware payload (AgentTesla)", "value": "200ae92d3c1d327eee5b39cf2e0610822538eca582337caef1f86c408ca07fd626da0a91395a048c3b93e5ffa7e3864a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207847, "uuid": "8cd715ac-0d93-4020-9426-b565c1ef9416", "value": "5145011037DACB46C93A47F65432940347B5F0DE7853DBAD2E4C90D9262AB0C9EE8E97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207847, "uuid": "a5b8c654-3ae5-49c8-84c3-70d61d3ac789", "value": "12288:K9Wej2JZXPltQH+7TpS7SUp8Tr2+DFuY6Koo/Tax3P:4WejYfQe7TpS7SB/2+D3oki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207847, "uuid": "28d9acbb-d30b-4b06-a1c8-13e7098503c2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207847, "uuid": "806f9616-3d77-47ba-9b3b-2968b37f9487", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207847, "uuid": "fd88cb1f-c50f-44c9-8e3a-01f52b7c3eb9", "value": "PO 9506.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c95618-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207366, "uuid": "6c473a91-dda5-4544-ae84-493959a04715", "comment": "Malware payload (AgentTesla)", "value": "e9ec3883621185cd8f8a7d8689537e42", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207366, "uuid": "e1767513-b927-4b17-be65-dc9ba1395a6c", "comment": "Malware payload (AgentTesla)", "value": "48a06be8de83afa9b0f3e57066c7b6567518985c06152a140d7245070366dcfa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207366, "uuid": "31b75f9a-3d6e-4708-bedd-5a67b490cf15", "comment": "Malware payload (AgentTesla)", "value": "506f60754b92e3515e013ebdec562b9e98fc1c16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207366, "uuid": "980dc264-3870-4f87-96b9-e91036781496", "comment": "Malware payload (AgentTesla)", "value": "97d2d215d6f8575dec3acf2bb62f9145ddc4f5c2e1b3d8167173f92e7dd06c9de4a8f62bf1c813d5d6078d3a62694318", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207366, "uuid": "dd421ee4-1cc3-433f-8215-ba710fb38e17", "value": "94129EBF7A0B0670C09823BD36EEF41FEE25846579E56348DF2804C6241C61AFF29E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207366, "uuid": "92a492c5-3c68-42ef-9b90-dc3a963b2e5f", "value": "192:VOaFnn27584c/sg7mgy2HtV8g/wT6AejWCG5mnk:V1Jnq61C+Ht2gYT86CG5mnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207366, "uuid": "ca7bd865-2b2f-4dcb-a616-d0b3501ef0c6", "value": 9315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207366, "uuid": "9503f948-3b2d-4acd-9ecf-d625f28aadf8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207366, "uuid": "7ea8378d-ee09-42a8-b7c6-75cb4b0a5303", "value": "MINUSCA P01-21.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db756999-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230195, "uuid": "0faadb61-a40e-4da6-9b48-a94b502ccd0e", "comment": "Malware payload (Formbook)", "value": "4bb710142c4fa183e24dbd3ce3c7b51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230195, "uuid": "247f2653-ef55-4857-a03d-368e8e389035", "comment": "Malware payload (Formbook)", "value": "4903d25c490e1b6c899c4fb9d3d3eb16d79c802245d4c2b667ff06f42724e358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230195, "uuid": "fd33081d-59d5-408e-a54b-89f047a1db37", "comment": "Malware payload (Formbook)", "value": "64a659096deda60c37861ddc0d26d3bfb11cc0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230195, "uuid": "64116235-6c98-4620-ad5e-8ce833c76e51", "comment": "Malware payload (Formbook)", "value": "ef9cc56c02d5628e96b757467b92000102fa5eb59bb254bcb23199df3fc2e962fbc4bb829c305a65092a3f3b06e333d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230195, "uuid": "6afd1bb6-092c-43d9-ac9d-42152494c716", "value": "77B4DF2A77812962C60D0E37496B28DC02F1C2277671F32F7CC625D89E27B5E563F626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230195, "uuid": "1d7ae11d-e5f2-4ea8-89b2-248f5b66c3ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230195, "uuid": "896d8c5a-dc7c-4175-a841-42808e30948d", "value": "12288:laRZszqqB3PQhPp5owXoJSq5Qbxn09z2Oe:tzqIgfobC909S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230195, "uuid": "5c76127c-5e02-4792-bc2d-997e412b7087", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230195, "uuid": "6546181a-42e8-4dba-9e28-6977f6d42547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230195, "uuid": "07d6197f-3104-4023-bdf3-59c9867a4378", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6df2be1-9bb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618248683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248683, "uuid": "598a3f7a-1f79-4cfc-9693-9aebc6798913", "comment": "Malware payload (AgentTesla)", "value": "7abd2b01e05d9e9b2eca7281d1c7270c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248683, "uuid": "3c819c9f-82a2-4fac-8ebb-73cac8973613", "comment": "Malware payload (AgentTesla)", "value": "49d4525ae61aef2328308df126532cdded24a8cd4944f6aa3dca464032cece05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248683, "uuid": "8ffabe2e-0215-4b00-9ae4-25f4b71c7eef", "comment": "Malware payload (AgentTesla)", "value": "5a51591bcc9954100a554a7c53984a1c745b7ac4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248683, "uuid": "4fb86daa-ea83-450c-9587-3e3958c8a94a", "comment": "Malware payload (AgentTesla)", "value": "24764997aa596ccf05e8e0a9fbb3c79fa9cc9415a17b8c99d9026a899072ae90313b0c85aab9b1b634471c30438391b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248683, "uuid": "c0406c4c-64f3-4ae2-9a37-c122ef01617f", "value": "2915BE2032D89A1DE0BE5B751831934807F2BC069A31C5CE7DD7759E0D7EB86C722B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248683, "uuid": "c11a0d4f-46f9-40f6-9a7c-1cfac98e0859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248683, "uuid": "b9651207-382b-4511-afa5-f1f51051762a", "value": "12288:bcZskx21yC6avvntz/Fdt7mDJ2bGZKUqGwLY22BpnKqWZ:bRkzXavlr9+Jrg5YjBpKqWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248683, "uuid": "f66c3b48-9546-4e1c-b9db-3e28cbc7d35d", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248683, "uuid": "5567f108-76fc-4fd2-9fdf-3345545804e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248683, "uuid": "6b0f1875-ef18-4924-85d2-61a76361d237", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DSU.genEldorado.26404.11527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcb6fd1-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207302, "uuid": "f37d0781-e546-4f04-9daf-bfa4faba0807", "comment": "Malware payload (AgentTesla)", "value": "6d9f400ba14586ac416b5bc03d44b89c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207302, "uuid": "b90a5c24-55a0-44ec-99c7-fc3d70025429", "comment": "Malware payload (AgentTesla)", "value": "49e0a841a60c9df1741707bbb6496ab05027d1e9233097488ad8d996888fa9ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207302, "uuid": "3f981a27-de7a-41f1-8fff-0930e5408682", "comment": "Malware payload (AgentTesla)", "value": "58ebb9756efac6df49ecbe5f041aa339d8dab2cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207302, "uuid": "343d7e04-e3cc-4c3f-8c29-07ce013fbaea", "comment": "Malware payload (AgentTesla)", "value": "939002402d6195c854131cd20a843c68afa73c8ec03a0a6c40f56ddd2cbf04e637dacc138503140381524a134826b239", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207302, "uuid": "43c5223c-9634-497e-9394-7e8da0f2eefa", "value": "B99423E0243112CBDE3847469EB0D8C893545E75803C56AF8E16CA2E7CDB9EF619C7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207302, "uuid": "da7f67bb-b2ac-4c37-af53-257d43e99281", "value": "12288:VrIRxtnULrnDFcf0fOBCVFZ435vHzOKWA:b/FBfsoFC35vHzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207302, "uuid": "f8a3b830-1c36-4142-809b-f35f9a8a8e58", "value": 422991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207302, "uuid": "beaf33b2-9468-4e58-a5d5-b1b523712d5f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207302, "uuid": "b297b9df-98ee-4fcb-a099-2d85eae99bf9", "value": "APRILQUOTATIONSQQO2103060_Hangzhou_Zhongniu_Import_Export_Co.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd207b1-9b63-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618213714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213714, "uuid": "8a9f3a15-caf9-4cdd-aeb7-081ec5687369", "comment": "Malware payload", "value": "8968cbd8ba6013249290d279ab347b7f", "object_relation": "md5", "Tag": [ { "name": "SWIFT MT103", "colour": "#59B927", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213714, "uuid": "a26bf0da-6f28-474c-b510-3b1f6bde4357", "comment": "Malware payload", "value": "4a02e2072d26db54c3a457458d5941ce14bbae2d1ad97442c56ea6bff0e01093", "object_relation": "sha256", "Tag": [ { "name": "SWIFT MT103", "colour": "#59B927", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213714, "uuid": "d5b25537-c5f7-4d12-ae07-896121a5fbad", "comment": "Malware payload", "value": "3b95a517934fb381faa939367be2624697408e23", "object_relation": "sha1", "Tag": [ { "name": "SWIFT MT103", "colour": "#59B927", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213714, "uuid": "2b1beae0-9be8-430e-8034-38c22538b52d", "comment": "Malware payload", "value": "35a9bd2afde05da8096153ef7066c42fa3592a2785806fae9e336a01ab122e9a445af8411a8fbe09182e9b662acfaebf", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT MT103", "colour": "#59B927", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213714, "uuid": "121dc027-70be-4dba-81a2-3c2d0f79c24f", "value": "11A484ACC09747EC8FCDB7B46A1A1F891208B76DE385E5533638A7752B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213714, "uuid": "b8143970-730a-41b4-bb22-1c0932783eb2", "value": "6144:RqNuUTIwbqkKuL7SxwqtOKz/cRWRRD/GoicGmaynEIaicslF5wq:UD8wbqpuKaq4I/BRRDOoitOErQ75P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618213714, "uuid": "9dc82120-8fbb-4910-abcc-a81787882ef4", "value": 454818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618213714, "uuid": "cb4a416a-8223-464a-ae4b-3c94951f8138", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213714, "uuid": "67568c38-3af5-4739-b209-e83e30009172", "value": "SWIFT MT103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973d347-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618208690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208690, "uuid": "f4478ac2-18c2-44d6-8556-f8f6388c03bf", "comment": "Malware payload (AgentTesla)", "value": "de8049430bab285613198d9b735997f3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208690, "uuid": "c770308e-1b3b-4f2f-bfcf-64481703b918", "comment": "Malware payload (AgentTesla)", "value": "4aa68cfc6d8664e244f6df6929038f66fafa05e63a671b489db1df6ce7e51b1e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208690, "uuid": "69bd21f1-84ec-4efa-aba5-c9d53475d46d", "comment": "Malware payload (AgentTesla)", "value": "d4d18218aba9163e7764544290e7509e1105112a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208690, "uuid": "c9d7f548-d71e-4318-a659-b9f2b2cf6b61", "comment": "Malware payload (AgentTesla)", "value": "693e81d25e500b314d2f7590e5914e8db5f5f2653945da7e6032d3b3b49f6c7f8d7f621346f94ee9ad869d10785dca90", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208690, "uuid": "3efb7964-6ffa-4b4e-9e3e-4351cecac90f", "value": "CAF4339C13C3EE3AE27B50666EDC16EF7517904AAD522E7DD1F77319F06A3248A2E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208690, "uuid": "1bbe8488-a825-4e16-945a-07f5e08ce676", "value": "12288:/xn7JWjusauXPTMINc2YuuLLUoLGYBOsCBvPBFoZMEm8M23uHeIelkR+CUCRsoCm:pkHNXbMgc2lVkPB63BFbEmp5+qCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208690, "uuid": "53be0e95-d00f-4569-a68e-dbb81d037a16", "value": 731240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208690, "uuid": "edb7bfaa-0d30-464e-ab5c-8a222dd1987a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208690, "uuid": "39a3f8e4-bf7d-4c57-ab78-32fd2612c93c", "value": "PAYMENT SWIFT COPY.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea3be6bc-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207886, "uuid": "e4b1148b-801f-4285-b624-63a78dd51d6a", "comment": "Malware payload (SnakeKeylogger)", "value": "a5c38bfd1a9a72945c15ca699b42ee86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207886, "uuid": "7b89a50a-6a74-424a-b6f6-45f0363cad4d", "comment": "Malware payload (SnakeKeylogger)", "value": "4b13f907ebd31b79bb034d2a08c0fc4b1f8a5e327c50f0701f9e97abae52d340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207886, "uuid": "71f3811d-a995-4745-926e-43c2088fba65", "comment": "Malware payload (SnakeKeylogger)", "value": "984619cd92b451803091c280d4d71fefa11cf39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207886, "uuid": "fa543a4c-8e3a-47bc-901c-911df4c9202d", "comment": "Malware payload (SnakeKeylogger)", "value": "4f686576e9982877c81200a784034864f98e3846c6d0bcbe7190e3f24fc80faa3dbfbda3f0f09d3162708dd56d1ebafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207886, "uuid": "22e1bdf6-7851-43ef-aec2-92e127293038", "value": "F4D40110A7D9CB45D43A87F69432D00393F9F1DE7823EB680E45A1E5311AB0C9EE6E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207886, "uuid": "96d13870-a345-490a-9e78-e2c3cad1cbe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207886, "uuid": "f3f6f461-2695-4493-93d0-7ffe3acd8f61", "value": "12288:a/6OfSFHDJnXeR5yOGdLMDJvtb3jJUCTjBWgDKK0VpOLn:ARSFHtnOSjLMtB3yCTjBhXmOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207886, "uuid": "36d362d5-9aeb-42fe-bde1-7298af71d4c4", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207886, "uuid": "3485a881-cadc-4adb-826f-9af4d552447b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207886, "uuid": "d1080518-d5e1-4e02-81c5-ec22d65d29fe", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53563252-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1618209351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209351, "uuid": "aeca2759-afd9-46a3-9b68-49badf0badf5", "comment": "Malware payload (CryptBot)", "value": "9de6a31aa1eb76e7132658397d08f5a2", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209351, "uuid": "f785f261-7959-44ad-9d63-5e10a9a457df", "comment": "Malware payload (CryptBot)", "value": "4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209351, "uuid": "7c1dec45-ce64-4eda-9547-4d5b38488a9c", "comment": "Malware payload (CryptBot)", "value": "15a17bf9120c528cfd30ec4c1f8476e6f5101a53", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209351, "uuid": "c42eaf1b-6216-4831-92e0-a2d24ef28f4e", "comment": "Malware payload (CryptBot)", "value": "22ca166a80561cb3ab0f53524721417045376e761edf12b695c88283e73ef54235302adb05a60369be425e78c91fa91a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209351, "uuid": "fb66aa78-09de-4870-82b7-8a8bef57a598", "value": "89F4010173D5C072D05325B64419C7B15EBE78324A7AE98BBBD90BFC9F2A6D0671A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209351, "uuid": "820b33e8-4d3e-4080-b291-1dd906372f3d", "value": "1c198acdc88e6433341d82c12cfad0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209351, "uuid": "9ae81b8f-3157-4cfa-a437-72d2420ef90b", "value": "12288:Kqe6gWLfgvXm+9sScMsOZGbL6i8aH7x49nVZvYZjkfKKNGOZ/eYdFlmxcLHo2I:KnWUvX412ulH7x4/ZMQyKQSeYHlmxm/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209351, "uuid": "20dfe59f-def8-48de-8c4e-d4e258a799da", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209351, "uuid": "08f51394-8d2c-44e5-95db-4f26443f0cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209351, "uuid": "63e948c2-3001-41b8-a7aa-50ab6b95b49c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e32ac7d-9bad-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618245313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245313, "uuid": "e301db41-7bbe-4ddd-933b-b6d533c986e5", "comment": "Malware payload (AgentTesla)", "value": "e4eefda9ef6ed795deb97d2b34c9f799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245313, "uuid": "a25a3165-3113-49d7-9b1c-f5352d50b520", "comment": "Malware payload (AgentTesla)", "value": "4b7ec7ea2778e6a70532c9664f862b95533c04e6891664d7089074d6b76c52da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245313, "uuid": "800cc8cc-995b-4ae4-9d68-c7fb71d32da5", "comment": "Malware payload (AgentTesla)", "value": "5380beee63eba11a3216f1057460eeb3b31a6350", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245313, "uuid": "071f0cc7-c7d0-493d-933f-d1832f80fbe2", "comment": "Malware payload (AgentTesla)", "value": "8f365cba2ecca31901b6fc14a6e8fdc7e27804c411165b55da10aa82788742bd25895c117f1139961b9634bb9ced2d43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245313, "uuid": "1f29ff0c-d1b5-49c5-9d5c-660fd146f782", "value": "FCF4232DE3BDF68FF73A74DC5492A10CC2408746AD8B3C6F6D6B129D2A0CC89A1125F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245313, "uuid": "39445b08-ecf9-491e-9895-03dd82ee05bb", "value": "12288:cKnu0BOVG6rG0oiuXkPWaTJ3jO5NbhhUdwy/kfnrIcdNtHYyGKwEfAK3c6eQDUPm:vnu3kFXRgAwdwyMzIczSyXw2mkUYzAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618245313, "uuid": "80b7dccf-a7c5-4b0f-b6b5-3c38067e547b", "value": 731043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618245313, "uuid": "3846a205-9014-4183-bbfb-eef30d06bd79", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245313, "uuid": "06eac24c-e714-4b1a-b950-491ac769e66b", "value": "PI09876.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de7804b-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618214469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214469, "uuid": "91b78f9f-9f8b-43dc-9646-d0aa46191896", "comment": "Malware payload", "value": "aa03380e809965734dbfff3b51ab711a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214469, "uuid": "e1ce27f4-e04b-4238-8231-af0076a32388", "comment": "Malware payload", "value": "4cb5c2e23d79668454913e21ce30ef302a1afb69f1a9760fab955f3323c41060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214469, "uuid": "995b8d12-35b2-4324-8f52-1db163e7ef45", "comment": "Malware payload", "value": "542feddc7aeab343d29eb28f7702aec2cb74d2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214469, "uuid": "7c52ec84-ac30-4e43-8148-25ef4f816c70", "comment": "Malware payload", "value": "fd88d77680380ab093812d0538cd9a4ff93e8ecae0fcac356d2e5e77dea071da3fe9df81f284fe3f6549ae6650e2d3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214469, "uuid": "596aeb37-eac2-4016-b311-9edeb4305e81", "value": "76624A25AADC8328E55F033C9DF665667338B83A6821EE6DD7CC60499E1270509C3F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214469, "uuid": "431559fe-2cd0-4670-adbe-adad0b07f7ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214469, "uuid": "545dd4b8-a540-412e-8b82-444fb21609a7", "value": "384:U87medlIDfL5v3QVRDOD7srijKw9MGXpXD3a0lJ:U8qCWdgVsSvw9B5T3aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214469, "uuid": "89e2c316-52a5-4d1d-95be-eb1160aee5d1", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214469, "uuid": "59ea20d1-1774-4f0b-b393-718faa8218d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214469, "uuid": "854b4de9-42c4-4eb5-a13b-2e54ca9aa77e", "value": "aa03380e809965734dbfff3b51ab711a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4474f3d-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618242263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242263, "uuid": "f6b9db5a-0bf3-4736-86c1-051033cc4dc5", "comment": "Malware payload (AgentTesla)", "value": "3fd648b3ec68bc624e2f0dfdc58647db", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242263, "uuid": "e7f14139-e270-4218-8cc0-2c4f3913d902", "comment": "Malware payload (AgentTesla)", "value": "4d0758db056e59390bab379936704b951e3bb04b94b1e674cf83d25d10eabc9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242263, "uuid": "c471fd63-4462-4afe-9217-1b92fe22daaa", "comment": "Malware payload (AgentTesla)", "value": "558e37009b674cc7fadc5ebe715a39b8c7e932ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242263, "uuid": "487770e2-04ef-40b5-9ab4-688d6239e529", "comment": "Malware payload (AgentTesla)", "value": "9d07ebab46f790e0d1e60e949a4185c6774733bee5e86e757259d3700285ce078e2c5a3d568f024f55f03cc50d4d075d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242263, "uuid": "adc2ef58-f167-4a1a-899c-76313b51ad98", "value": "E2F423ADB6BE2734E4C612EA737643030F47C76DA5ED8CE388F41380A757D10AA27965", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242263, "uuid": "a4e3fa79-1233-4ac0-a88f-6a79740c6711", "value": "12288:Sv6Z1YtOYJ4K/csJGEkOWBHqzFcJN+cQFrsXxk+EAtNGxXjgc0ynUR2tp3P3LRYm:S5MbK/c0GdrhqzFcDTQFgBkvuNvc0gVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618242263, "uuid": "39cd533d-ac90-449e-940e-7c344e3cc0f6", "value": 732547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618242263, "uuid": "80ec95b5-7106-48a1-86cb-43436e358cf6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242263, "uuid": "609d3b9b-dd7b-49c7-8b2a-9b06c173b3f1", "value": "factura y datos bancarios.PDF.gz.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd616ea7-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207865, "uuid": "5aa3727d-df01-427a-8d93-6a7fab175b6b", "comment": "Malware payload (SnakeKeylogger)", "value": "ba1686319be5270576a29cee296db2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207865, "uuid": "46f3cfc2-60bb-4d3c-96ea-59427e381d5a", "comment": "Malware payload (SnakeKeylogger)", "value": "4d43627e0f287ec9a64e7df3ebc4ff1792fa560b82a1cb8ba0e452f0f2f18640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207865, "uuid": "ce8bf3f8-42b1-4406-85b9-7605d38eaf45", "comment": "Malware payload (SnakeKeylogger)", "value": "2c9e5c01b69535ad80f05cc23001366b4b9ac565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207865, "uuid": "904cc405-8ca3-469c-9b33-82c1732f86ed", "comment": "Malware payload (SnakeKeylogger)", "value": "e16678bf047878700fe47b20dc0978a4e98ff8d8b4bd28bf6f8a14cacb7fc12e3ef0a36ff491f74ba34dd37d6b0e5efa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207865, "uuid": "952c522b-5bd6-452a-9805-839ba8276d8e", "value": "9705BD6CA6BCBEC5D82407B6F432950213A1F2DA642FDF58C990628D142B74FBCE8D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207865, "uuid": "c8e91999-cf61-4eaa-b367-331c3467b082", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207865, "uuid": "a8a2eaa8-f2d6-4353-b51a-b5a5fe47caac", "value": "12288:OlhvA8PNSHaEibT9CyqjrC1pJgsM0xEsmm1h3Q3DsEW3sLJG72W41gZItPvaaaoL:OlhRJJCy4ObgsMy6m1h3TEW3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207865, "uuid": "5fa3f261-0ade-45eb-98fb-bcdf57b35389", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207865, "uuid": "cf45309b-2021-4da0-9e2d-0076a67ab79a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207865, "uuid": "1b9544a8-2817-47c2-abf8-5f26b949f671", "value": "RFQ No A'4762GHTECHNICAL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f5219c-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207472, "uuid": "fc06c5e5-529b-4bc3-9f3e-fd0f3e6ee2e1", "comment": "Malware payload (Formbook)", "value": "12da2cfacec959b202f66cbeaa57ed71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207472, "uuid": "a63826e1-3774-470a-aa88-7c8d0e73d68d", "comment": "Malware payload (Formbook)", "value": "4f80df736e84a6371ebb7a93f11242a46ed0055c0ca742a1d973f70ba1b0e1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207472, "uuid": "722a3253-77b4-4375-a98e-d11975982e5b", "comment": "Malware payload (Formbook)", "value": "c34e4e47d2f45701ecf07929efd1a215bac07edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207472, "uuid": "d603149c-e1d1-4ff1-a748-3f4a45e47478", "comment": "Malware payload (Formbook)", "value": "8742175a194a81ac2ec512b4a3a57a398d46b50c23a1d592731598aaeb3f6ef6a2162f5326e196131b48d62c3ef03b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207472, "uuid": "7cd61a44-d499-4bf7-90ee-861342d768a0", "value": "99056BAD725076DFC867CC32DAA81C64FBA0B476430BD207906705ADAE5D89BDF241F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207472, "uuid": "d8e8dd61-cf29-4123-a84f-26b7fab67dc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207472, "uuid": "36f58ffa-975d-4c43-a6d3-58c41e3f9605", "value": "12288:mlQVLym6y8GkWdpUq+VHz6E3DpcIFu2A86OEFSi5+KQMbnEnPqXprKNUMvox9318:mlKLqw4hTBVTYO8SpKfHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207472, "uuid": "5c2ba3a8-e95b-40d2-89f0-fa7053398aa9", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207472, "uuid": "73d0d245-ee5f-4d8f-b00e-42c26fea3ff3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207472, "uuid": "9c0fac1f-8a57-444b-aefd-0328a7d7db1e", "value": "CIVIP-8287377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea475d26-9b69-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618216476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216476, "uuid": "acc47e60-4e21-489d-821a-e9ec362c706b", "comment": "Malware payload (AgentTesla)", "value": "ee8919ff7b5f2a89b6c1984a6a3b7fbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216476, "uuid": "4c61c33d-7930-423c-9042-639d3ab1d5ea", "comment": "Malware payload (AgentTesla)", "value": "5074a2f201d924bdf62f0a58bca9cf0a5536af84b3b90bc6915a5cf36dfe019f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216476, "uuid": "4e9a7e58-0c44-4c9c-afdc-977be6d581d1", "comment": "Malware payload (AgentTesla)", "value": "cafb42ed9189ff950da2b14d7ab3aeab229d8165", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216476, "uuid": "4fdce712-9ea5-46dc-9729-a75884744fca", "comment": "Malware payload (AgentTesla)", "value": "e2a986c1b73d2d443a17386a90ea988244f45e513cfbcc246fa2ea0a81f06546ae6ec6be7ca38efd39792fc2c6543ba4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216476, "uuid": "b134abc5-484d-42ba-b4a4-4e2cb2c9d579", "value": "C5521A56A3C8A929F4BF033E6C7142515374B5D8E843DB0EDAD7A5660E233488D82F9D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216476, "uuid": "6f52f751-6e4e-45d3-ba87-40f6b01c6abf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216476, "uuid": "6b858002-a1cc-4670-b287-c136a8b79f67", "value": "384:v8ecw1OYNBaxLK9/r5Fef9GX1l/9hXL0xDJ:v8k1ZNGA/rq1Gll/fbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618216476, "uuid": "403f63ad-5a23-4fcc-97a2-46a7308c9579", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618216476, "uuid": "cbb09fb0-3e8e-4756-97ef-5b92e7f61820", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216476, "uuid": "c507cb0a-97cc-4eeb-91b8-30626f7fa5c4", "value": "KHAWATMI CO.IMPORT & EXPORT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1897c1-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207760, "uuid": "6f148c1c-3371-418b-9386-aa5ba9392e3f", "comment": "Malware payload (AgentTesla)", "value": "cb8e65968c1b1013327dfbf097bf43fa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207760, "uuid": "67a1a92c-9d72-468d-91d4-a7548fd4e2dd", "comment": "Malware payload (AgentTesla)", "value": "50e35637d4639c706badad8e6dad4586cc090bfcd624c906689ced35c4f5c1fa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207760, "uuid": "55b5bd3d-938d-4bcf-9f20-617402012f36", "comment": "Malware payload (AgentTesla)", "value": "96280b8df0830c1ff043a6bb0180a3c00c3d570c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207760, "uuid": "fbe7c65b-9cfa-4841-85b2-13d8bcb161ca", "comment": "Malware payload (AgentTesla)", "value": "0d84672cf1b2cb4b2253505856227b10b048b70513fca40ba476da2a2e5612dfc650bf2788682d3b59198f91bffc2e31", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207760, "uuid": "6717b43a-04db-4cca-9001-d4dcb095e2f2", "value": "38F1AEF4E1A8AF76F4D0FFBCB1E24A281B181A7C61B39A5D4A392395BC602034334078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207760, "uuid": "6377205c-4a02-447e-aa61-bf597350e754", "value": "192:CwER/mxeQdEppxSCffFYV9b/BzW7Z+HNp:yzQd73VlBiwNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207760, "uuid": "fd75dd7b-1517-4930-bcb4-99d313476911", "value": 7463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207760, "uuid": "10a79601-3659-40c7-bd5e-d78e7a5adb55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207760, "uuid": "0282f622-be70-40f6-922c-a520e9319b02", "value": "Purchase order and quote confirmation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06757c5-9b5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618209937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209937, "uuid": "507e3241-d839-4f19-95d0-f9eab35b8cc8", "comment": "Malware payload (Loki)", "value": "9934225e024aa00e6b880cf31ad3af68", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209937, "uuid": "dcf7a091-7838-41f1-b144-1e649ab00b72", "comment": "Malware payload (Loki)", "value": "50fb7f290e1ea71393fe99edbcabf97382e2fed6205c0a60e7d3e642f7c18f8f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209937, "uuid": "9199b83b-8b3f-4e65-802f-dac3ffccfb99", "comment": "Malware payload (Loki)", "value": "908214c2494c2b07cc06b4a1e5183cf4bc9a462b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209937, "uuid": "e5f097b5-d834-49fe-9def-110a7b4c7947", "comment": "Malware payload (Loki)", "value": "ce44a7de5fe8a284339a4af76f7c9fe5b50b95e7162ef7093fa8e6e0c8e83f56024a97dea03791a3d1a72caf552470dd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209937, "uuid": "f1a395ba-d92c-46c8-ae14-bab4ee7e7ee7", "value": "E1C423C7DC7C052AA878F77DDB2E2A398E5E450395E339A1FA51E13992B41F086BC071", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209937, "uuid": "bf69c29e-aa55-4a6b-b7c0-9407873e1770", "value": "12288:qWaY8+8e/JHqM1X6jaxswfyEbDrJc5BZwWdoe7aY2TjEwZbWYkGESPN:thJ6ja2wvra50A3WY7qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209937, "uuid": "dae23a8a-abad-4f1f-918a-11a0c137552e", "value": 583677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209937, "uuid": "0e4f296e-4c9d-4d90-a6e2-62bf89f2f9a1", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209937, "uuid": "bb737d6e-7705-42cc-a36e-8df4558ba32c", "value": "PO-4147074_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999b6e70-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207322, "uuid": "943cd137-8eab-4e05-9f13-2c599e71f034", "comment": "Malware payload", "value": "fd5b1ff6e69cd8d6d4a725826c14b36c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207322, "uuid": "46635d5f-e01f-4a7a-a587-472584f31b5f", "comment": "Malware payload", "value": "5107d1f37a37dbf30bb027a9e968095615aeadf8be60799b16cb123942936a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207322, "uuid": "d4ed1809-00c2-48ce-b888-5ebaeba86ce6", "comment": "Malware payload", "value": "4900f0edfab94e4034719043eb581ed412a585ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207322, "uuid": "fd471cc1-6780-469a-9c05-f82403478a6f", "comment": "Malware payload", "value": "c9e2a22809e395622ad124f1d93790cb751b708eceba0c1d35682734630129632f0019300eed3a9d6ad0724538b0ea8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207322, "uuid": "acf3a36d-d61e-417d-aba1-84adefe1e277", "value": "D5C423832F16425DFF8778B19E69D5A70B6327BAC02F97C6045510298F77B0BA3316CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207322, "uuid": "5b08a813-6e50-49da-bdbe-264980b86a64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207322, "uuid": "74ec1aef-a361-4d20-a25b-3035f01fbd84", "value": "12288:sy966wHmbOU2Vw3cXIA5hHVJxDn9OHBFgUNHgfcgMuwS2T8Xo2i10OlR:bkSiU263if5h1J19OHTgUNAfxFWgXh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207322, "uuid": "8a9a43af-3217-4d00-8d39-285c58861221", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207322, "uuid": "0f98050e-3d7a-480f-a749-31c07a915f89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207322, "uuid": "c655ba15-9735-4150-9bd1-719444d01234", "value": "PO#2593_img20210408_23432049LP27325 x 40Al Morouj Al Khadra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8933f863-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207294, "uuid": "ab56b620-bca6-4432-b7be-d335f819659b", "comment": "Malware payload (Formbook)", "value": "dd3ae15e952c239ae6d87c8374b3b460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207294, "uuid": "980cedae-8cd6-4c14-b6b3-1dffd14f073e", "comment": "Malware payload (Formbook)", "value": "513357be2837bb1211c3fe2a32d7e6cdecf75f6cf0da1c2f0d198a38e3cdb759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207294, "uuid": "6b468d91-b47f-4152-8dbb-7db2c421670b", "comment": "Malware payload (Formbook)", "value": "f8d9daceb3ff1dadabf9051a04bb4356c370fbde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207294, "uuid": "c44b00c5-a080-49ec-9b23-f2128651e05d", "comment": "Malware payload (Formbook)", "value": "dd35cb983467051649739508057917d1d33e1328f4a2da242f2e8a94371a39d622ca6e36dc39c150ed34159868444c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207294, "uuid": "f7bd8f23-f51b-4b5c-ad44-1a6471866122", "value": "36055BAD325076DFC867CD3289682C64FBA0B476430BD207A06715EDAE5D99BCF241F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207294, "uuid": "aa86af47-8919-4c52-b7c9-cac13eaa71d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207294, "uuid": "928e4515-9cbc-4cd7-adbc-4d17ee40b738", "value": "12288:QgmBkzuw0TQD6dNxvJ9HuRfJDv0CATOcZOd5ln4T7luAHdu0RReBqJTN/D7adhAS:BEAuw0O6FuRfmCAf4j2tTHc0WqZBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207294, "uuid": "62ccd8c7-74e4-4929-88f0-b7a8f72bb1ae", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207294, "uuid": "ff816860-584b-4b8c-a417-cad42f81b0c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207294, "uuid": "58720cd6-f0bf-49e1-beab-b70d9f4efa09", "value": "INQUIRY 1820521 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6ca988-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1618233316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233316, "uuid": "0ad82864-40a9-44c7-aebd-49fa8a4bfa4e", "comment": "Malware payload (Matiex)", "value": "4953a0238e781408fae3ee737bf14ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233316, "uuid": "6fbad615-ce88-45bb-886a-b46598346a36", "comment": "Malware payload (Matiex)", "value": "51688c6b77d1a093fc0d9efe21413f09d1bfef7907a726e8498e2173abb7c8d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233316, "uuid": "520186a5-b9e1-49c3-b726-3063064a7d09", "comment": "Malware payload (Matiex)", "value": "006a605fa48b26b27e859c031340344937858398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233316, "uuid": "248e3695-3e50-4a16-a303-1fe42afcb102", "comment": "Malware payload (Matiex)", "value": "893b7665836420a91e82d74c8eabc55be5a8e09fd430dc1d5ceb341689ff0df6f9a22fc43490c66f0af7cf079c6e1467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233316, "uuid": "36b156d9-015b-49e8-a217-e3ea3659a22d", "value": "78055AAD724076DEC867CD369A641C24EBA0BC76431BD207902735ACAE7D997CF241F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233316, "uuid": "a0a316d7-202d-44c0-b544-03ff10943a3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233316, "uuid": "d0bd634f-1163-48ad-bcf4-5adda187265f", "value": "12288:LDlXerqEw/rZm+ZoF2pYGIZv4LYSdSC3I7GwPP5qRzYjJsa9ODrmOzvZ1+fLI/LE:LDderqn/w+/pYFvRC3I7GPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233316, "uuid": "972172d7-7b69-459f-9532-c0de2733c8db", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233316, "uuid": "aa463979-8f83-448f-82b9-c22a11b1d880", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233316, "uuid": "6c0bee0c-775c-4ace-9cbf-fef35dea53a4", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77263ea5-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (FickerStealer)", "timestamp": 1618209411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209411, "uuid": "e351114b-6d5f-47e2-864b-bf9fe78bc334", "comment": "Malware payload (FickerStealer)", "value": "3a441719e8227b47c48b143a818fd9db", "object_relation": "md5", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209411, "uuid": "2f54c8b4-af70-43db-b060-3f0f499d7d4c", "comment": "Malware payload (FickerStealer)", "value": "5264cba383d033b281e0d9c097225f350fa4cb4aa910621638e79c8659ac4035", "object_relation": "sha256", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209411, "uuid": "b35ccd6f-b50a-4141-9b51-cecdd0045b2e", "comment": "Malware payload (FickerStealer)", "value": "a86e0f25041c2fd53fe5c9b0ef562dfd465beea8", "object_relation": "sha1", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209411, "uuid": "0d2235d6-c5b5-498c-ae5a-3a4cdaef2d20", "comment": "Malware payload (FickerStealer)", "value": "a6fff4a50fcdbe1228ce08cf2557483efb838b41dca4909b60c926dc066162cd61dfd4f1da84ae81c265337ed8e6d643", "object_relation": "sha3-384", "Tag": [ { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209411, "uuid": "ba320558-81d2-441f-9f6a-87fba7f3962e", "value": "AD858CC13B618886D1991332C157A5170334FD9C65AFF32E7EAE729902363BA7D05B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209411, "uuid": "7522ea40-6aa4-4271-bbff-6f9382137a27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209411, "uuid": "6fa4af5a-ea96-49d9-a043-3555af9537f3", "value": "24576:xKBzo+9amt5NsizszmOSV8YzEmN7a9solMJ+7ZXWL:x+U8hQNSV8kfN7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209411, "uuid": "3c57f420-74d0-4256-97ce-870266910573", "value": 1767936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209411, "uuid": "aa391264-0777-4f5c-b6ae-4461b4d58896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209411, "uuid": "b3aba9c2-ac9d-4d49-afe5-7c284b494f6e", "value": "IntegraL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9861bd2d-9b6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618217198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217198, "uuid": "66185b3c-f9c3-4eb7-b93c-d30a63eb2321", "comment": "Malware payload (AgentTesla)", "value": "a359ed5b495fe3402a0a482d83e62e10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217198, "uuid": "837b9ca7-aed3-4f51-8d37-ab06ddca2500", "comment": "Malware payload (AgentTesla)", "value": "52c312dacd64cd076b046cf580d108c0928b362f5be208f9be9c5f925866aa6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217198, "uuid": "b5db2b72-f9df-451d-ac3a-02e8ae0c0aa8", "comment": "Malware payload (AgentTesla)", "value": "2365dd1a13f37b5074b1197214e3fc7b0ea70502", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217198, "uuid": "28aee410-77e1-450d-af92-21e32438ad35", "comment": "Malware payload (AgentTesla)", "value": "7f60097f51c9662d0f76792ac404d70bb88ea37549ee6180dd70359283fa309477273294fc705fa719d762e36699a07d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217198, "uuid": "452f0cba-a335-46c2-bcf6-dff8cd834a5c", "value": "FCC4234EF61F1AFC6920588B6B7991DA9D0D2E37705224474D49C038ECDB32BB8E64F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217198, "uuid": "ac356056-a079-4614-9a73-816f3fc85f3f", "value": "12288:6PIk9W4GdJ+VhOdVsVgYNv+tgpqi/GDS9yuqYah:6jW4GdUVhOdWgYNv+mYp9SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618217198, "uuid": "e958c38a-a0a3-4840-a29b-f252561d3552", "value": 592876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618217198, "uuid": "89d16d69-422f-4ac0-be43-ab275cee0ac4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217198, "uuid": "23f9e378-022c-43be-b4fc-14c12eb0c766", "value": "Import shipment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0caafa-9bc2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618254330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618254330, "uuid": "96afc926-2adb-4970-9886-c47de566f2c1", "comment": "Malware payload", "value": "5332ab9bf97b3776ca2f86423a35513e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618254330, "uuid": "06cc46db-0928-49ed-849b-3fecca4bb998", "comment": "Malware payload", "value": "534b5a5667fd5576854658e36f0ae8c142ab2fa786770ee1c9656d9d00759e65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618254330, "uuid": "4a8c1e5e-45f4-42e1-8393-28d22bd0be05", "comment": "Malware payload", "value": "6d54b89d9f945b5f24159a6fb00feefcec25aa42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618254330, "uuid": "f2ed60e0-3465-42bd-912d-2e5304dccb57", "comment": "Malware payload", "value": "13c1931f1963bf3199f016af004acbb7d6c9579a6e6faa03617be61c6ef12482f3813b1dec3de4e9a2a0d14ba2ec8ab8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618254330, "uuid": "8505ca78-51ce-4bbc-b602-a5c94269ce47", "value": "69442308AD4087A4D195E774896F9B929D32B8900B89B29DE43FEC26F1B3775EC1E41C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618254330, "uuid": "d1d13516-6db3-49fb-9448-f33ad59530d1", "value": "6144:JSVFJPj61cWGQ6zkpsIpddodW1AxB+LQPCmxDKz1:Js5mHT6zCbFofxB+rmMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618254330, "uuid": "95f3fd15-495d-45a5-b432-b930f0da09cc", "value": 254830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618254330, "uuid": "0becea89-b0cd-4da4-a58e-bdd31f2d6d6d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618254330, "uuid": "d46461a9-4cee-4230-934d-4aabe6cf6a05", "value": "Installer.app.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e037e81d-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230203, "uuid": "bd6ac474-742c-4a44-825d-6bb9666b636a", "comment": "Malware payload (Formbook)", "value": "56d56566623a2bc942141b56f9dd3da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230203, "uuid": "9c5ca35b-2ec2-4f74-a723-8b1e2cd3f279", "comment": "Malware payload (Formbook)", "value": "5397f0168be76c7e5efee936d341eb359b9015af5e77631129dc0664105e9259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230203, "uuid": "a8a8176e-1f17-4975-a02e-9c31a985231a", "comment": "Malware payload (Formbook)", "value": "bc76bd9c064a7df36b84d5e08f266c8d4d9819ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230203, "uuid": "f661ccad-a239-49a2-896e-08a6675a3565", "comment": "Malware payload (Formbook)", "value": "1f07c78c615b7e1ed19431b9d2150b0cca8f8641dadd626a02464955695c6076454cce94d842dbeafc9d01517795bc8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230203, "uuid": "8acb0f33-fbc6-4df8-bce8-1193d0fb5acc", "value": "C8A4B025134C7DF5E28771B646C66CE14A6CB9703F2FC8A3F7835E4A94289C0E5B478A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230203, "uuid": "946e6c08-3512-4b91-a4b6-893ca2b8bc34", "value": "896af7d86e4ad5191fa88fd4589e505c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230203, "uuid": "91aca77c-129d-4b0b-8bc3-4b1af8f03829", "value": "12288:2Onh/74J2eipNdrLCjD6HBTLaQqP+BfWbMto:2Os2eipNdrLCjDzQfWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230203, "uuid": "f17d5bae-42c8-41c5-9a3c-5298bcdedeed", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230203, "uuid": "ca652fde-602c-47c1-b276-a63765898350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230203, "uuid": "d42164d6-3cfd-425f-b025-05a98a01191e", "value": "Design Template.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bb4846-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618208120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208120, "uuid": "59e0de22-4913-4bf4-8542-057a303b16de", "comment": "Malware payload", "value": "6207e2df0152374c414e1ee99f542c65", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208120, "uuid": "f15954bf-b5ad-4578-93b0-941ee586c377", "comment": "Malware payload", "value": "544ac4195d8b23df9768ca5d3fa2afe2d43e7f3ff2001c6eca07f8a68fbc2f7d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208120, "uuid": "2c7e0de4-87b6-4abf-99c1-238ed24ce913", "comment": "Malware payload", "value": "1c00f3b79d831e0c32e8e0a98a04d83a07c53083", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208120, "uuid": "1619103f-4750-4429-a6d1-6b6501351765", "comment": "Malware payload", "value": "0e493942fca5ac7e20837358468dc49894ffaf50789c5dbd09b1c62102da90b303524e44e82198206f91392eaa16e78b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208120, "uuid": "29eccc71-0228-48a9-b4ac-102bc0af067c", "value": "0552F9667BDCC27DE0BE477EAEF3CB566234B64A1421DB5C098462852E7234E0582F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208120, "uuid": "0b21e12c-d89f-4e19-b9cd-108a51a2564e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208120, "uuid": "c3bf32fb-6084-49d5-9286-e9688f6128b2", "value": "384:18q7tEw2I4xACNKmfOrX07gIgnMzXmXjXBCxvJ:18qBlbMqX00FnuWTRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208120, "uuid": "ed36562c-d666-47ea-ba2b-0f5377d07401", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208120, "uuid": "1605977d-5914-4a5b-b171-60d7ad070c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208120, "uuid": "45af80b3-3f8b-4575-8765-fd5c684061be", "value": "89736782464672.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f743ffef-9bb3-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618248281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248281, "uuid": "b7bf0720-dbe6-4a82-84de-98b69b5598a1", "comment": "Malware payload (Vjw0rm)", "value": "6ccdd7d229cefd339edc49c188acaee2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248281, "uuid": "64fb2010-dac6-4b55-aabe-4c8970e6a78e", "comment": "Malware payload (Vjw0rm)", "value": "5674ab6d92163937454d0dc5e7dfd67701517f56102faf0a3e07e3bc6ef3ee10", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248281, "uuid": "77f920b3-bd91-4731-8609-a1a5762f924e", "comment": "Malware payload (Vjw0rm)", "value": "b85ce742e8fedb82a53ecffd92aae5b8284d4bc9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248281, "uuid": "5cb5a46f-64f6-4257-9d4e-527f71d90d80", "comment": "Malware payload (Vjw0rm)", "value": "992d56bbbab1c24e13475e0c4afb814b38f7dc0fbeee39dd64a43a644f68652ff4dd745d54167b3a9dfd0d72e1bddc5a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248281, "uuid": "1cf72d76-578b-45bc-bafd-4802c7faca0d", "value": "C51200E1F74E905F53F21264157A2C089CBEDA7252F850F5FA7BA464E43492C839DBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248281, "uuid": "156aba34-dd47-47c2-b624-27acbe37f94c", "value": "192:Q813lF1jA9A9gz/o2QUNLSlTegskME/Wrm7p:Q813lF1O8bJsE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248281, "uuid": "eecc9e87-caed-4cc6-b084-6d4727005aaa", "value": 9328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248281, "uuid": "2dc7b701-2fbb-4bb0-ba86-40dcfa3ed07a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248281, "uuid": "d73c1735-08c7-4baf-9110-e0fe79850488", "value": "ZXHNWASVMN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b0925a-9b40-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618198537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198537, "uuid": "9198dd61-b1b0-4f37-80c1-dc5e1f7dedd0", "comment": "Malware payload (Loki)", "value": "1b96ec124710553c88e297c6db84f979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198537, "uuid": "802a1702-b287-43d6-b846-daeb32f76f68", "comment": "Malware payload (Loki)", "value": "56a9ed1c232278922520f8ef09817400dd9ce0e8b65ca4b833252c987c01b99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198537, "uuid": "7e8df5c6-4b6f-4535-a29f-fede74bff20a", "comment": "Malware payload (Loki)", "value": "c25c8149a09a8fa43ab7c95b3772be15cdbcd049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198537, "uuid": "faf49a2d-e685-480b-bc70-06189cbae69c", "comment": "Malware payload (Loki)", "value": "866b74ee6cfc20700abd954452c1f5dc75caefdce81e1d676f097446dfe0d73ab578b2641ebbc4ae41b3e6eda382a560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198537, "uuid": "1e63aa50-bf43-497a-bb6f-13d5424e050b", "value": "6A059CD19E8ABA1EC42E72B0315090FCD3A32D6705DDA3E3ABCBFDD6879358501916D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198537, "uuid": "1d1222be-1af4-4457-ac8c-24a0943b834c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198537, "uuid": "ab336066-1f5f-4b41-9e1c-dc6e3bd2c570", "value": "24576:X5pY2irWh+Mh5TzfWa1kAzGyvKdZrnaCfLcK:/ph5d2AzGrzLcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618198537, "uuid": "ebb9b025-0f05-4f5b-999a-3ddd0522b8df", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618198537, "uuid": "77902f47-d7e3-4243-842f-7c9c5d75f1fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198537, "uuid": "2e801ff7-696d-4ac7-939e-c4876a1af309", "value": "quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c543bf-9b77-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618222182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222182, "uuid": "05092f88-3b7d-429e-9bd5-2cf11204b91a", "comment": "Malware payload (AgentTesla)", "value": "1139ce34509f029fc54d5a32d7a92ed5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222182, "uuid": "5bc81c90-117c-4763-b903-97f85b5989e5", "comment": "Malware payload (AgentTesla)", "value": "572db7948ffd44941517fa5b6d9d39f3b39bc7b0266c3af8cdf1df4549a894df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222182, "uuid": "3b5374cc-6f64-4961-b52a-d19e302c01f8", "comment": "Malware payload (AgentTesla)", "value": "375d2c39ae75ba10a7ec59c98f415ae9f12b6f55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222182, "uuid": "a44eb1b0-d95b-4af0-8b01-b2823207fa3d", "comment": "Malware payload (AgentTesla)", "value": "6e9e6ab31e02b128d2d22fcbfd0883c5d9dc94a4c373cbe2ac81c10733a02065dd25c078eb0bbd6371dac4677cb2045d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222182, "uuid": "43b8e88c-6bc2-4847-8e86-6420eb0cdbad", "value": "39D4239BAB964ECBC744C85E97E316B0C61E0908C06A97EDC5491F238ACD94EBCC7771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222182, "uuid": "6810c7f1-bd9f-442a-86b0-737b18ed4b3c", "value": "12288:3EXezUFDjlam9pxprNFdf9NftENqN0//GaeyZj90oiy/51+Hh3IyH:UOzUF3lxv/Xd3tUqi//GCZx0a4HRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222182, "uuid": "d6c8266a-3359-4dc9-8182-6f61ec602abb", "value": 619867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222182, "uuid": "04c6c36f-c7d7-4e53-80c0-55fcba5f0cb4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222182, "uuid": "b3cb3484-4c4b-40de-a55b-dfdd25161563", "value": "CTM BREAKDOWN AND DENOMINATIONS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3426b279-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1618206292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206292, "uuid": "e2c41507-709f-421f-99cd-12b215f0067b", "comment": "Malware payload (BitRAT)", "value": "7960f9ee86312c4f88ebb646c885cfb5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206292, "uuid": "24ee2fce-a2d4-48e9-b6b9-864518127e8e", "comment": "Malware payload (BitRAT)", "value": "5750e4d860e46a8bb05d73b6e3694470db21c1c1dd6651ae00eccc7adc90cd0e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206292, "uuid": "a98600ac-a96f-4ef5-8845-d16bbbc43254", "comment": "Malware payload (BitRAT)", "value": "e40181a198c2467322442f83cbfb7529c1763074", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206292, "uuid": "45a2caf9-c3e4-4f07-b5b0-fee556128f8d", "comment": "Malware payload (BitRAT)", "value": "aab1bc339ceffb2702296fa0e6cddbca28ce7a5dfdc888edb33338f68d4000ebd4d10d4eb7c7e1bda41973db463c0df7", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206292, "uuid": "d332fb8f-91ef-4d71-87f8-c2db3fadcbb1", "value": "F595225022644765DFBD2BF62069D08023B674AA3C5BE20C4D42A5ED2EFDB1D06E7DE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206292, "uuid": "6285b521-b811-4e6a-a2e7-cd5c174e76ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206292, "uuid": "c1f1d1bd-5acb-4850-b5c7-ff9cf1d81659", "value": "49152:04iOVHw3VopL6AiDRN76UbBHIkba63AqwCMMK:1iOm3VopKD36UblIk3AqwGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206292, "uuid": "5e4a936b-82c8-4c01-8673-26d01eebfa87", "value": 1979392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206292, "uuid": "e8e4969c-0a2b-4f02-9264-9dec39b35844", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206292, "uuid": "70df1e49-c360-455c-babf-fc23bd5f0ddf", "value": "svchost10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32a4963-9ba3-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618241322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241322, "uuid": "0f7afa7e-f711-42e5-b64e-3a01f5d73715", "comment": "Malware payload (AgentTesla)", "value": "786210489969aab93222549008adb73e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241322, "uuid": "ed43c493-5086-4dc8-8a46-411ba82642a1", "comment": "Malware payload (AgentTesla)", "value": "57b2a44351febaa40160b21423b5f084f15802290e82910cd3d94331eb3e3791", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241322, "uuid": "65244de3-34b0-4a2a-b2ff-29a12da622c3", "comment": "Malware payload (AgentTesla)", "value": "6598c58b4b91da0755c685fe0d5cf8050c088c1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241322, "uuid": "6682e347-83f0-45cc-a7e2-c810156f38ed", "comment": "Malware payload (AgentTesla)", "value": "3b99eeae131c7ab8f0ab0d91f8b03633950509f1cba34a7a5365e2b61c45424ee7b83091dd0cb2b2f5c770737f72ce66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241322, "uuid": "20e401b7-2a3f-4d6a-8fcb-d417471dc0e1", "value": "F5E4F111B799CB86C83A43F75472900317B6F2DE7C13DFA80D44A1DA252AB0C5EE9E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241322, "uuid": "be9509bd-5ab4-4855-a9b3-3a38c5721606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241322, "uuid": "8652d222-310c-48ef-9539-3b9e37a4d27f", "value": "12288:G6ffUFTAfMH5/0hVM6yRwlblobg+bisLsgupMnywbNlQG2:G6nUtAfMH5/0hVgelblig+zBup6FNl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618241322, "uuid": "3c6dc925-c22e-425c-9adf-7d51127562d4", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618241322, "uuid": "a3d21e9d-63fc-42d0-a06f-712cb0a33732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241322, "uuid": "fe17405c-67bf-490b-8d7d-64004ef6e40d", "value": "PO Number 09211.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9688e9-9b46-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618201418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201418, "uuid": "7f78dfe8-ce40-4881-8963-4757c715ef04", "comment": "Malware payload (Loki)", "value": "8253ed85fccbb96b8d9d98accd3eac24", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201418, "uuid": "48446e31-1599-4a33-acb7-221e1cb2d13b", "comment": "Malware payload (Loki)", "value": "5879679a6ae769c77520925f95256c9eb6ee0566ec6d343ca267a402695f0f86", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201418, "uuid": "ea869325-3320-4bea-933d-5d6a63cd4e6e", "comment": "Malware payload (Loki)", "value": "c24d409b3a874f7d4dc1f219f36e642f3dadc9d6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618201418, "uuid": "a845bf37-c407-4358-b618-62d81a38f2f2", "comment": "Malware payload (Loki)", "value": "637215486ac026d2548d73c648b91e624ea9b2bdac20e6ac7793b97e1e6f1928271eb971dede022cdd03d36b76522d5b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201418, "uuid": "556dbd28-191d-43c6-87f6-b148de5b6973", "value": "E5A42302E385FAEA504D6EEF09988438C05FB3E5B084A8D4C7A0334F6BF669DD5994DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201418, "uuid": "b288a49a-9ea7-4d65-a690-73fb71ce236c", "value": "12288:tmvqop5yAxlAJFEu08JFVlNmibP7FVm5MeZn+O:+n5yslAJzF0CxVm5Jh+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618201418, "uuid": "1b1c73a2-fa72-4a96-8c25-c1512237e63f", "value": 493522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618201418, "uuid": "9b2ff544-8974-47fe-91c2-328acb41027f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618201418, "uuid": "b12daa6a-903e-43a7-94d3-db73143001fc", "value": "PO-4147074_pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5063b997-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208058, "uuid": "80e64648-3248-4525-8642-d5e289a047c8", "comment": "Malware payload (Formbook)", "value": "3cd76d38ad07c345862b07d90186851e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208058, "uuid": "a02de483-427c-4e68-990e-ccf1a371e96a", "comment": "Malware payload (Formbook)", "value": "588692919a751e9852cf32e0b1da42c347f2ff99a2afd2378c6a7573d7a532fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208058, "uuid": "27c473fd-ccc1-45bf-92f5-37237b294e65", "comment": "Malware payload (Formbook)", "value": "e3fc0973898eee9723b7b92828ffbbafaa0b5456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208058, "uuid": "28ee1023-be04-4b1c-ba00-d3ba4069055d", "comment": "Malware payload (Formbook)", "value": "a7c9bc5186f230e2337c85cb648962e16805c6e1c7656088f7e2055b11c8714506282753deccec3bfa87fbddc4f87daf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208058, "uuid": "7576dd4c-f2fc-4718-b26e-8dc3ee2eadb9", "value": "2CB4121BF623D8DCEE5331BA6AB69D221F21746B9426594C108DB3257E53323406BEF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208058, "uuid": "828831a9-cd1b-49ac-aca8-9624c90632b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208058, "uuid": "0c6898a4-3ccf-409c-b4ab-419b44d4590c", "value": "12288:9MGTkPvCLhm6nDabAKCcXjcgMuwS2T8Xo2i10Ol/:iGAP+hnDCAKbjxFWgXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208058, "uuid": "b0051a2c-99b3-4c00-83b0-fc95b8c138ee", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208058, "uuid": "67c39fba-00fd-44a8-a8d2-557c95ab5c3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208058, "uuid": "a39b433e-dc7b-4a2f-abe1-a2929788c948", "value": "PO5411.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ee8aa7-9bb6-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1618249220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249220, "uuid": "0f43336f-f112-4337-bdd7-5346173e5d0f", "comment": "Malware payload (TrickBot)", "value": "39ff633b864d6c88b231126cb9062d38", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon169", "colour": "#5A8ACE", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249220, "uuid": "40b3503a-1bd7-4471-af24-3400c100966e", "comment": "Malware payload (TrickBot)", "value": "598983908f0e10ca7085bd6250ff085f858764be5915bca128999f27968ac010", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon169", "colour": "#5A8ACE", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249220, "uuid": "e6e750d1-43e8-458c-82dc-2a8a1acd9347", "comment": "Malware payload (TrickBot)", "value": "95c25f893719a7634ed161d1ef0d8011e6a12d91", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon169", "colour": "#5A8ACE", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618249220, "uuid": "ffba55ec-e0e8-4874-9c6a-925b0c542e45", "comment": "Malware payload (TrickBot)", "value": "618ad640140456e515ed7b740a3ecbe09cb17901b3de77a1980b6bbb6008768c2f975ca43681c0cd991baa81eb54c92e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "mon169", "colour": "#5A8ACE", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249220, "uuid": "be97b18f-bd9d-427c-b6d3-dac6c9e80ee3", "value": "E6A4120405089055CDFA49F02F8A6AEFCB6455517ACECD2F3A5B34CE8F4C475A1EBA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249220, "uuid": "113f294b-3f30-43c6-8bd7-379635e2f0c1", "value": "8948fb754b7c37bc4119606e044f204c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249220, "uuid": "5213705c-f504-4302-bfaf-fcd6490d0453", "value": "12288:MsuPCxjfOo9faM570VO8lFfLDBHNmFKqOU+WxC8P9:XugP95gV1lFfLDdQp438V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618249220, "uuid": "076c3e02-4c98-44f1-ba00-878dcfe3af6a", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618249220, "uuid": "e6536c63-3fc8-4366-8bbb-398e70119dcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618249220, "uuid": "b6b19edf-d181-49c0-9adf-97ac9a2739d1", "value": "m169.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a737174-9b85-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618228315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228315, "uuid": "53c919f5-198e-46cf-bd66-d4d70b44a985", "comment": "Malware payload (AgentTesla)", "value": "2ef55b1fc8a71f26898afbd5b80979e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228315, "uuid": "f2d81711-bdfc-4e20-a4e1-9efd113c5c8c", "comment": "Malware payload (AgentTesla)", "value": "5a82c01b01e67439af7d84353cca82079e1cc4773e88ad2f4659aae05bf1609b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228315, "uuid": "70217644-1f62-41fb-87ea-cf08890c8d18", "comment": "Malware payload (AgentTesla)", "value": "25dc8c1b98e144e42e8e5bd1fa13f9e82c20021c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228315, "uuid": "fe78b7bf-3448-43b5-8128-0350a2a81bce", "comment": "Malware payload (AgentTesla)", "value": "6f0f3d9dfbcfea3b243da88765af82b02212127b709dfb5246a9e1d01452fb9ae6bea72d38790deb41301034bfca3ed5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228315, "uuid": "f8bd203d-b4b8-422a-b2a4-38006483217d", "value": "C2E447172ED4CA8DF0E81A3E55FC11123F63E882091E9FC794DBB36D09E1A42F566A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228315, "uuid": "14b050e0-ba66-4a61-8196-3c02ee93d692", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228315, "uuid": "f12bed2e-d9c4-4e90-adbb-ed7cf56c3711", "value": "12288:O0NzfI5tixQQ/bj0zVV05dUiJEWj97v3SDP4M4lwv0ZYnKJ/:w+xQQ/30zH05dl7PStAwvqYKJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618228315, "uuid": "86b15d84-aa6d-4abd-97d2-3c866b203ec1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618228315, "uuid": "13df5d53-0569-486f-a08f-4994cae5ff4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228315, "uuid": "24b196a0-50fe-41ed-9b88-88a7afff1fa2", "value": "TRANSACTION_INTTRANSFER_1617266945242_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4340bc44-9b5b-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618210183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210183, "uuid": "c8387931-13db-41fc-ac1c-285f25d83a89", "comment": "Malware payload (RemcosRAT)", "value": "0059a100d5296617b9a57ff7cb744fe3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210183, "uuid": "28f0fb33-f28f-4dfd-b49b-5c519129af0a", "comment": "Malware payload (RemcosRAT)", "value": "5ac61a193563590e5e5e4f4833a4e085e9612616f47e8092fef7044dfea7303e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210183, "uuid": "05d93d7b-8f8d-4671-b0c9-689120ab1f0f", "comment": "Malware payload (RemcosRAT)", "value": "ef4741db9ecee9b63fb11bcf20a7c20e06bf8324", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210183, "uuid": "1ae3e312-2e73-493b-b368-1a4defd959cc", "comment": "Malware payload (RemcosRAT)", "value": "6fc95d874940c883e667ccd25e7671966298f1c5e72ca06458ee2b458f2930f406e67c06411493544d271ad81d52720f", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210183, "uuid": "2790031c-4a7c-4bed-8e7e-bc51d2661445", "value": "65059E22B5D15433C16E1A79AD2B96E89C3ABF00FA74DC4937FD1C084F393917A652A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210183, "uuid": "1a343105-9732-48d3-a884-ad90e7e02344", "value": "12288:WjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c07KRmp:WjMmMH8XEgfqFDd07K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618210183, "uuid": "e4d192dc-5690-4bbd-a8ce-0f3990c861ec", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618210183, "uuid": "ceed6197-0ba3-4942-bc34-8c6812fc5748", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210183, "uuid": "e4681bc5-b606-44f3-9a1a-9168b20cdece", "value": "Urgence RFQ_AP65425652_032421,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e624e1-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207903, "uuid": "b3cc34f1-38f4-4984-a574-26c6a27c3ab7", "comment": "Malware payload (Formbook)", "value": "cd70300691bc9f2a261dc6b814ea31a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207903, "uuid": "5f9887f0-222f-424f-af5a-8136805d78db", "comment": "Malware payload (Formbook)", "value": "5b578a81fa5276232529484ff00db9fca64a7879ab4a7abc652c9d0d3e1461ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207903, "uuid": "da511c16-4166-4f76-a894-340307b6fb5a", "comment": "Malware payload (Formbook)", "value": "255a24ace53039f262cc74bcda27541a4c3eeaaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207903, "uuid": "f736ce3c-56f6-4e77-9eb0-43b61ab1eb44", "comment": "Malware payload (Formbook)", "value": "5c516ad13357bda5bcaccef02d4db777f4dcd3ab08bb8792d246860c21d4b04898397a6669273ea94dc807d14be84972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207903, "uuid": "34c555da-2326-411a-8b1b-c7497f7cb2c9", "value": "8AA4D12632D51BA5E03CDF3592F4549813F1A60BEB22E71E7D8911DC8E12F9B5623B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207903, "uuid": "d804eeb3-6d58-4360-8e45-836993168e84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207903, "uuid": "1625bd1c-93d1-4236-bff3-d256ff275e48", "value": "6144:p+WMzqqB3/NB3QJXPp5owioG2lHBRsuUYdN+fDCjTqTpWxV3C+7Gwh11jNrrh5:wTzqqB3PQhPp5owLG2lTmYfGTubbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207903, "uuid": "23404f17-ac26-4d37-b767-687188b99d24", "value": 478720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207903, "uuid": "5ec44f13-c8aa-4212-8b71-796728f5cda6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207903, "uuid": "c3d503c4-b27b-42be-af41-3308ddfaab86", "value": "RFQ \uacac\uc801\uc694\uccad_\ud574\uc131190918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af39bc4-9b9a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618237362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237362, "uuid": "96954fe1-8929-406e-98b7-7ee7cdfa2449", "comment": "Malware payload (Dridex)", "value": "50c8bc979968ac02715f5ea6d10729c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237362, "uuid": "0683afba-945e-4043-96ad-b46761bdeb01", "comment": "Malware payload (Dridex)", "value": "5c159f9d7d8802486c1fb85d769f6eb040bdc7be8dc646cda3fe776ed26d3c70", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237362, "uuid": "e7149414-3bd3-42da-b9cc-75a0220f4778", "comment": "Malware payload (Dridex)", "value": "47faa1d2f65fdb7a8296671de174f53b8b0d3c2f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237362, "uuid": "1f7d311e-7d8b-402e-b296-dedd56810794", "comment": "Malware payload (Dridex)", "value": "f28b7932d0761fc185ddac0ae66e80b7a6361793ced3da92f515fb6ea6cdc9c11808a0fbffe4c9d33b424c7509a1ac8b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237362, "uuid": "681fc51a-9769-4796-9693-9ffef0d2c23c", "value": "E6A39DDDCC53B4C6D6148FBC8A0971C514F4C4B63A2FB10A6989A26F0D41FAE198E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237362, "uuid": "e04832d4-b5ce-4dc8-91e4-8ef9de762459", "value": "1536:PRI/KKxQe72hawT0DausD9Byrty30wEGttZv9xof46:PRI/KKOkMHfD9ByrtyOG7ZVxo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237362, "uuid": "7bfe3033-c4d9-4b42-a2a9-b662b64f018d", "value": 98209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237362, "uuid": "3ed506a6-9e51-4167-902f-963f4fee97f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237362, "uuid": "a25a8746-5f29-4c49-876f-966d77d57cf3", "value": "documents-1982636004.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47f4c9c-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207823, "uuid": "a08e2197-cb15-42cc-af72-fa606388c0d9", "comment": "Malware payload (Formbook)", "value": "9fa479c87543e7dd199296f7029991c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207823, "uuid": "b181795e-f3ca-4520-83fc-e26c253791ba", "comment": "Malware payload (Formbook)", "value": "5cb8d74227cc43368e24ef8f94c5ae38a2f2c259a1701b1efa4f6b5042e4544d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207823, "uuid": "6e3ad22b-0b1a-4935-bc8f-92d94fd38d89", "comment": "Malware payload (Formbook)", "value": "649bf55700b6828989dbcf4c5d792ba93fa5b2e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207823, "uuid": "8fba335b-595b-4654-857a-81f5f74fda00", "comment": "Malware payload (Formbook)", "value": "e126cb0f592df518e39b0aabb83932f27efab5c84b07d732e18ad5410afde8465b6baaae4f0572a43be0a8b4c3e627b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207823, "uuid": "907caf04-8b8e-45c7-9ecd-4774a5471821", "value": "0C1558319F694519E42B2F77A214473E3E587C33BAD5F1EA3A4AA368F1A1D01D7B0113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207823, "uuid": "bcffce27-411e-40ad-892b-901f08273e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207823, "uuid": "d31574a3-7e09-49a2-b02c-ddfeb8ed09ee", "value": "24576:LGuAeBVuO+r4mWRvxb58rvkYAm7bZxxpb:bAef+0hurMFiZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207823, "uuid": "0eaf9892-a4ee-48d1-8f83-64a2a8191d25", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207823, "uuid": "2bf65383-30ce-465e-92a0-ee2a7f482a64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207823, "uuid": "553cc522-83e9-4d3c-a9b3-99e86f0f1cc9", "value": "Portfolio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552bce23-9b84-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618227823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227823, "uuid": "48c6afa5-352e-46c1-8ddd-08b1c8f0a5f4", "comment": "Malware payload (GuLoader)", "value": "ff684bf547b6f692c53f80779dc5ee7b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227823, "uuid": "b9d2b695-1e62-47f9-8120-1f99d2943140", "comment": "Malware payload (GuLoader)", "value": "5cc3fcd6bc68db6107493ae5a1d9adfaa4cc210195c2c5f05d3059cd35ba2e09", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227823, "uuid": "7c5255fc-0fc0-4115-b2d5-fff2d2caacab", "comment": "Malware payload (GuLoader)", "value": "fe4116a2cfa9cadde500c900f605742d5ddabf10", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227823, "uuid": "061a1e25-5012-4be6-b4f2-e7b963efc775", "comment": "Malware payload (GuLoader)", "value": "e1e5692ac7c210fc5fba2e30bbec1d77d2e93dbae9d3925ca4c39aa2696189ef8720c2c7de970f2249f66b9cf353d437", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227823, "uuid": "cd7520b8-65b7-44a5-9d32-6a12ecae845c", "value": "50836DA27B40E17CCBA24271F2B4169881737CB42B598F0BF1CB9D6E94779DBE840356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227823, "uuid": "5fcab804-e97b-440d-afa0-46109227bb40", "value": "03caa17dce14fbc05445954edc0329b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227823, "uuid": "5561af46-e0c1-4d54-8c6e-77c68c5a2c66", "value": "768:glTzXt3zSxhjTphA8Es0svVd1ZZv/Nyr61dVWHCuMvdvckklVGDIvoK:0t3zSxbHv3nZnn1dVWiukdvr3Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618227823, "uuid": "0a66d9b6-fef3-4e20-bf61-78858c553bd9", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618227823, "uuid": "c3950303-b755-46e3-89ac-102bc8f127f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227823, "uuid": "c7b75dc1-cf7f-43e7-9373-ed0181fe8b54", "value": "Anmodning om tilbud 12-04-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fa420c-9b4e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618204821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618204821, "uuid": "3bc258bd-4dc5-4378-8d9f-33d7c1d703a6", "comment": "Malware payload (AsyncRAT)", "value": "46aac6855269931ba2eb01fe1d6dac2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618204821, "uuid": "c08d575b-59cf-432e-a8a9-55b2d624c99b", "comment": "Malware payload (AsyncRAT)", "value": "5ccf7ea0d5d8703fc31f00f2e31481d6c2656949c17ccc10d0e59a84977ada6a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618204821, "uuid": "e34da902-37a1-4c2d-8a22-44618f96e453", "comment": "Malware payload (AsyncRAT)", "value": "012fba10815ed036922d965c2ee4b444f3ddc3fa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618204821, "uuid": "14c531e7-d76a-4c56-9001-940df67bf4d9", "comment": "Malware payload (AsyncRAT)", "value": "829598dd2661be6be8ec254acd40861c88c2c79ba95549084d2e88b5191d743d2d90ca7efe76545148edbb6d6ace115c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618204821, "uuid": "dbc52be1-191f-44cb-8ac7-777a2a48fedb", "value": "8F252DE5B194F6B5E82106F8ED562AF2C663AD07C008D74F90D9BDC13A76392483F91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618204821, "uuid": "c02d6431-5702-47c2-9422-c35f33819672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618204821, "uuid": "d7d70feb-f483-4601-b776-e089aad6acb6", "value": "12288:YQmIIK2eESbRwKky4UboWD+SzFEZhihfIg94+BrA+ZIK1eES:Y4IVURQyXDFEPiFIO7II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618204821, "uuid": "03cfb0be-d9f9-4bbe-8961-c3a6ca49cd9f", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618204821, "uuid": "61810806-c0bc-44fa-9af8-a51f09e4074d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618204821, "uuid": "4ff59b2a-a387-469b-8608-fe6165d21088", "value": "46AAC6855269931BA2EB01FE1D6DAC2B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3b91a4-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207517, "uuid": "43435a56-f54d-4d6d-b208-4019200d2c88", "comment": "Malware payload (Formbook)", "value": "e56f1640fefd7a1717d02a44d21b9e76", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207517, "uuid": "ba9a620a-261d-4065-b038-c347b205edec", "comment": "Malware payload (Formbook)", "value": "5d1881e0778e18a4c309b2440556896c5978ea7dfd2692386bd01a65ad781fde", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207517, "uuid": "9dc3b8f2-8a4f-42f3-b648-a9f930de7d5a", "comment": "Malware payload (Formbook)", "value": "6584c2a3b65e7fe05be1883505692e61851237a6", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207517, "uuid": "be3cc8e9-318d-475c-8d3f-5fc9371e16ad", "comment": "Malware payload (Formbook)", "value": "34dbdc8d31874163d302d795cdc592f05a460bb17a79697782ca9d72445d1ca974fa959db8e4348ec24289afadf6ed10", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207517, "uuid": "4704ba87-5b3c-4c1d-b932-21c3b00b1111", "value": "95D42364AC837122034D0B39D576925F2FAABA60D89BD4506C7A483F1EA2EDCD54F4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207517, "uuid": "f1e16207-8dd6-41d8-9c08-80a4aa914f97", "value": "12288:6W6dA8DpprqX7+z9yAPE519pmp8vXD3XGeXxwHRob0+gt/tyU5ouxcSt:6xdA8i65ve1SunnQ9nyuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207517, "uuid": "dfb66085-f86e-4231-b04e-31c3dd43544e", "value": 628583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207517, "uuid": "e6282686-bdea-4719-a3e5-c267066c8357", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207517, "uuid": "ffa67aad-43b8-4285-9f2b-b776f1683eb5", "value": "\ud55c\ub77c\uc0b0\uc5c5\uac1c\ubc1c(2021.04.12).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a452f3db-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207769, "uuid": "61569eb8-bfd4-46f2-a0b4-cb85cd5e64ee", "comment": "Malware payload (RemcosRAT)", "value": "b03b367fc6e9f6cf5837d595608028b4", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207769, "uuid": "b5f70e4a-038b-4b9d-8318-2c9a7452c5d7", "comment": "Malware payload (RemcosRAT)", "value": "5d5dfc5c81ae719f80879a2afc8bf680feb30f2013d750fa878eb4b092fdab46", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207769, "uuid": "c9afc222-29ab-4196-8ce6-1f5ae9bd3525", "comment": "Malware payload (RemcosRAT)", "value": "f15724693cc63111e94eb7927ffb0b90ce7331eb", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207769, "uuid": "f31adc49-f07d-41a4-90fd-65ce417487f4", "comment": "Malware payload (RemcosRAT)", "value": "a7069d041bb3772d3afc3730593c1e302ac29391dc9965c65bad839e30943384908798906cd6075fdaa251e173051e18", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207769, "uuid": "05bc94a2-1523-4229-a770-cf83a7bce2dc", "value": "B593BE41B50151F5EC2C4230E87359DA0BB53D2F529135BE63FDFE2928623834A6BD3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207769, "uuid": "1b97376d-2266-4daa-8974-2a80ac84d11d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207769, "uuid": "19572d97-8972-4fa3-8ad1-71289acefaeb", "value": "1536:u9OwKKbi7DiGl6UysCoNcG3TO6gv2I/SX0Bxi2Y:QOzKgZl6UqoN33T4v2CXi2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207769, "uuid": "923fe95a-db19-4717-9a9d-35ed12f60c2a", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207769, "uuid": "a4202a00-6403-4f26-946c-a00483c9377c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207769, "uuid": "550e5170-94a4-4c23-bfbb-9d5956262e4a", "value": "Cobro Juridico_07223243630_5643594_539661009070075_49874359_5059639084170590400_7272781644_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce5453d-9b98-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618236694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236694, "uuid": "706dd82f-18c0-4678-ba2b-67e75fb1a744", "comment": "Malware payload (AgentTesla)", "value": "34b849047346eb54c22d71d0fd514eed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236694, "uuid": "9c8ba600-c526-4f57-81aa-44c200043b0a", "comment": "Malware payload (AgentTesla)", "value": "5def20f9a9f1c413c8bc154ba4a53d7d9a6cfedf4a8a84a342354dab99b12e3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236694, "uuid": "c9314cec-98f1-4dee-b83f-beae6928ebc8", "comment": "Malware payload (AgentTesla)", "value": "da11f8037c11febf25115745a2b6e4b3066b3b5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236694, "uuid": "f94bd43d-74c4-4868-a1fd-cd21908b904a", "comment": "Malware payload (AgentTesla)", "value": "b544ad0ef2eb2508f0f02d58e2db445736ce2fe5fe6f13c541ccc162595381cdc2c41ce43e974e6e3c6206178b8f92bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236694, "uuid": "3a067df3-3482-4eac-a871-2a51e512845e", "value": "8E05022927B4DC13C97E1B7960F1610457B1F020BB63DB1ABAA8146D1F73BD28B6B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236694, "uuid": "ef0955ba-765c-4b4e-8415-96fe8c74b317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236694, "uuid": "6f861f16-c42d-439f-8515-97555ddab632", "value": "24576:630VDk1kLflZ2SnN87/AZdfzpW5yIb+YxG4jbuTsHKWYTM:60VDkmfySe74XzIbI4qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236694, "uuid": "084f0fdd-12c2-4282-95a5-fc783a9bda63", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236694, "uuid": "6d4afe94-0c0b-4c9b-acca-757054ee51fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236694, "uuid": "7709539d-06f8-4f9d-a40f-19c334f2aba6", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdce3fa8-9b70-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618219435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219435, "uuid": "7ee46be9-35d7-40a8-b3a6-456fe36b9995", "comment": "Malware payload (NanoCore)", "value": "f5921b095b5db6eaa0cccb1cc9874a5b", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219435, "uuid": "7bb95ad0-38ba-430a-aceb-fc8baacfbf24", "comment": "Malware payload (NanoCore)", "value": "5f5ec4a144dce14821a36549141718418145e253974eaae902c8acc73a514839", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219435, "uuid": "4ee3fc54-177d-405d-a596-830f5f006490", "comment": "Malware payload (NanoCore)", "value": "db7fec49af3b772abf7ffa409fa186860447f375", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219435, "uuid": "fd8145f3-9eec-4932-acb2-8a1bff993ad5", "comment": "Malware payload (NanoCore)", "value": "481d7cde118216d8c48df996743b53b9e8b74a61503aa7b82b04b0ebd0a3bb0a2e107f7f74484687964142b160c4a2ce", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219435, "uuid": "491cff95-e589-47ad-8db9-ea99931c264b", "value": "40C52324ADF70F22FA2F19F0404C9569D6B19C690518499EEA3B723074FD971ABF9338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219435, "uuid": "6b9437de-edd6-48a6-8c9d-04cb04b09214", "value": "49152:ovj50M7X9ZNiPiuAxZwK7ddnMv8hLbtegBDhTa+qgsPsL6tDVPQ5:ovtJTiKuKdMv8tPvFqgs0u5pQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219435, "uuid": "97ab2f56-6964-4356-a5e7-32396ccd12b0", "value": 2592768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219435, "uuid": "6150329c-2756-4784-8594-f3c76e9e5df4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219435, "uuid": "7e599a77-282b-44d3-ab03-cc269d475fe9", "value": "PR0078966.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82b1421-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Arcane)", "timestamp": 1618225036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225036, "uuid": "e34f21e8-61ba-496d-a1d3-699f778f3d11", "comment": "Malware payload (Arcane)", "value": "5efd335c35268a27b027523a4d9e8558", "object_relation": "md5", "Tag": [ { "name": "Arcane", "colour": "#73B19F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225036, "uuid": "4a68475f-e343-4b27-937b-39b01eeb91ca", "comment": "Malware payload (Arcane)", "value": "61097d05c78d0654fa42c1a404e96526b06c657df602a8a7a2ac58e1a60b52db", "object_relation": "sha256", "Tag": [ { "name": "Arcane", "colour": "#73B19F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225036, "uuid": "b74be1a1-f1df-44cf-9264-cd5552a5e593", "comment": "Malware payload (Arcane)", "value": "ce7d1eda415f7f96bc0d1a756ad3db862751d1d0", "object_relation": "sha1", "Tag": [ { "name": "Arcane", "colour": "#73B19F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225036, "uuid": "14e7f069-8aea-486e-a626-863e7c328a8f", "comment": "Malware payload (Arcane)", "value": "5a6670e8cd9097dba6a3e70a127d5c4a22ad4efa406c0d59e24ec06a72e1fdd4be83232dd83fdcaacd1124e52a8f66fe", "object_relation": "sha3-384", "Tag": [ { "name": "Arcane", "colour": "#73B19F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225036, "uuid": "d0c337ed-c622-4fb5-bde5-709b8397e4f0", "value": "0E143A563A484B01DAA824B6C0EF543807D1EDD76732E78A3F98378E1E85273BE5178D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225036, "uuid": "a6c9b80a-6d64-426d-9969-5fcb09f40c43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225036, "uuid": "630252ed-254a-48f0-9f51-e4261a644e07", "value": "6144:sPyeobsbRbTOa+NYHx9d7p02quPwA3qA2hYz:saybTO7U7p0nuPwNFYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225036, "uuid": "a9106cba-b5d8-46fe-82a2-77ed0e17129c", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225036, "uuid": "6fb82da1-b7b7-423d-8ff8-651c4644a6c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225036, "uuid": "19051721-e3cc-40d3-bb47-33cb80bf9e69", "value": "SecuriteInfo.com.Trojan.PWS.Siggen2.28981.28903.1201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c199e143-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207818, "uuid": "9006e8f5-ef5e-415b-aa4d-737ba56d9b59", "comment": "Malware payload (AgentTesla)", "value": "ba184cf13a7c7e3ce431384314858540", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207818, "uuid": "82617f0d-7676-4021-b5f4-1ff2ba258641", "comment": "Malware payload (AgentTesla)", "value": "6243307374b055c14d7415bb86fa6a61925eaddbad5bebc96e509a35641c09d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207818, "uuid": "8aa94141-a66b-4217-b2d8-ea44a933a0cb", "comment": "Malware payload (AgentTesla)", "value": "cabc05f604c5fff651275b06c9018706d909f824", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207818, "uuid": "e8550790-ec75-41ba-b750-b55ec39c4f80", "comment": "Malware payload (AgentTesla)", "value": "55165fd6600c883584a48fccedd1618aac1ad57301233b93305c355037ac6b9e20092b7e8938d2e2e93d49ae2094ad70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207818, "uuid": "ffcf711e-85f5-40db-878c-845cce62fa32", "value": "DB52284093D487B4F27B43346CB1536157B1AEC64822CF2F5D8924AA9A3335346D2FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207818, "uuid": "90dd9f24-7cf4-43e1-a632-c697e8fe62d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207818, "uuid": "dd2e73ac-e1bb-4c84-a6c5-67a2c69adabc", "value": "192:NM8eH1J8rgXrSKJ5s4u7LL511XV2pXA66yDVWlQWxXP2EG97rlvJm:q8eDM8SMw7LL5HXny2XpyxvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207818, "uuid": "487a3b00-d0c2-4372-aefa-abf6e88268c3", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207818, "uuid": "8f9fc449-93a6-4f51-814f-9e65c5e9026c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207818, "uuid": "121bef7c-5276-4a72-8038-b956d0619a49", "value": "Re Confirm\u00ffthe invoice\u00ffthe payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e674a94c-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207451, "uuid": "ac9ee5bb-b3f4-49f9-ad13-8202a3271945", "comment": "Malware payload", "value": "c4c1e35e86c58c6b31735ca563e5bd52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207451, "uuid": "e327ef3d-5722-49fa-a564-45c24957a255", "comment": "Malware payload", "value": "63a37a6a5dbce3f177d813e0ff11f23203b56236dad2350393fb260c0d3e9df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207451, "uuid": "78a7a6c7-1094-495d-b932-852a18b104eb", "comment": "Malware payload", "value": "bd7cc5f562c0746efb66b6e3811b99357f0fb501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207451, "uuid": "2fa05885-8028-4d16-87ea-4a3d3fa6c6a0", "comment": "Malware payload", "value": "301f49f13b245880f726d365f9a66cd72e7ff9a715423d02c04f9b80f1c92c3fe7fc07f6f11a3207d07e375ffdcb41d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207451, "uuid": "dcaf20b8-bfe5-4fcd-a5f2-a62aaed641d7", "value": "9CC2AE4BD7DC803AE9784B78BAF3884673BD3D122031AE1F619AF0651F537485AA0353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207451, "uuid": "8f5a862d-11fc-444e-a924-0be62e139fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207451, "uuid": "d10ac727-f7aa-4fda-9924-3442755cbcec", "value": "768:f6AbTqKKHcYXumzoVFvzOCo37cJXL+JmW:fj0HbXkdU7cJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207451, "uuid": "7e6f4496-c3a0-4ab8-8b94-a43c7b14243f", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207451, "uuid": "b448f1d8-5ea2-4cde-9d28-d28355b2c588", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207451, "uuid": "2727592b-373b-4b29-b160-00617f8be307", "value": "BL2659618800638119374.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae3c352-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1618207297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207297, "uuid": "e650bf6d-1769-4576-a8b5-9099abb13680", "comment": "Malware payload (Matiex)", "value": "ac23f6dc4cf45a1d6595d3ba38e605e3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207297, "uuid": "9d1c2181-e7e2-48ee-b5de-2a1abcee617c", "comment": "Malware payload (Matiex)", "value": "6436220f58f40c5bb71a22f8cd94cfa47925ff16f49d4d9d6d3f44b8b6b15cc0", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207297, "uuid": "9be32012-7f84-4854-8ffe-69bf1654a6a1", "comment": "Malware payload (Matiex)", "value": "b204eba0b0ebc7b8cdfc41d9e41833b974c919a9", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207297, "uuid": "4603e624-e5a2-4e3e-be31-8f59536f9f37", "comment": "Malware payload (Matiex)", "value": "f932a6771986406308ccc3f49f3efc7183872c43663be1ffa57ce41a9e04b209bc130631c87972abbcf7eb1e03214ef4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207297, "uuid": "c12de4c2-f7c9-4455-878f-140f0d46a416", "value": "B2E423E8CD66D2FAB013498061791E378F6F9CBB95993CF0977F2C28216D6361B22345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207297, "uuid": "8aa1ffef-e516-4099-a140-bfbe6a032baf", "value": "12288:JXXtGekrhI6B+1lH1zRn83uJB4lVfYzTbtYz2xKTgTqpItMsqNdIqLLWhCb:mThIV1lVt83uJB4PfYvOFTGoJD0cwCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207297, "uuid": "3512838d-2fd4-4398-9d0f-1b414be50821", "value": 691173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207297, "uuid": "59bb63f0-8e19-4f92-9cea-ee6656703fb8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207297, "uuid": "581f73c6-ba90-412f-915a-34b3f9de5e1c", "value": "Purchase Order.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d4acb1-9b98-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618236466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236466, "uuid": "5048a7a2-09ed-4a78-b6cd-41b7c4c2682d", "comment": "Malware payload", "value": "b5798b97b3fc372f4640c25114245f9f", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236466, "uuid": "6f64bcf6-f61f-4e01-b387-1676b093542e", "comment": "Malware payload", "value": "643b0269b08f69b0ec11e6b31e0215ab7f984728f51c6cb3f4d9c98612343f14", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236466, "uuid": "29052b70-10cb-4aa7-ab26-9ebad36cd7d3", "comment": "Malware payload", "value": "73c7215327bd912b9132fa075b663de83614b344", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236466, "uuid": "57858415-3751-4ad0-bd35-8202c109b067", "comment": "Malware payload", "value": "0a411342f4274c0c0790609730d7c0baf7c0c340bfc79d4bfbbee6dd36bc3e2484149c4877675ea9d35bebd26fc26ec8", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236466, "uuid": "dd39d20d-998e-4bbe-813b-503590c6b718", "value": "5782170E6AE8C512C47D4BB994F413304B3966664953F39D1CAC93DB1D277A089F3A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236466, "uuid": "bdb1826e-da27-4532-b74d-858518688cea", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236466, "uuid": "68995128-3473-4e8e-b0ab-2b96f2049e69", "value": "384:815qi1kNlgH78kSN7/mEMXuwyxO0zbI5Y6hVT7w6jkC:M5qdrHbKXVyLbifTT0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236466, "uuid": "35eaf9fa-5307-4e86-86b4-0a0fb046276f", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236466, "uuid": "c990d8ff-8f00-4019-aeb1-bcba9c6089de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236466, "uuid": "5cf154f8-ddab-4daf-89be-3d63c1ae02f5", "value": "8fefbea2-cb8f-4378-ad45-83cc4b6c882a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996394ec-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1618209469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209469, "uuid": "4ded733f-6ada-4594-a8a6-78c7c94a437d", "comment": "Malware payload (Smoke Loader)", "value": "6bf0c6ccf573c460133526c35e98bfe2", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209469, "uuid": "32d1bb5a-bc8a-4515-af6f-aa97739f68b7", "comment": "Malware payload (Smoke Loader)", "value": "643bafce44fec576424c48dbef72072a1d27d33b60e25585d39bdbcffdca22e8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209469, "uuid": "6558c3be-e946-4dec-be2d-bb6cb6fd3b6e", "comment": "Malware payload (Smoke Loader)", "value": "c0da68b5d658e8cae09d040afe556c602b04054a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209469, "uuid": "c95969b1-24af-4274-9c7a-f36a712ca047", "comment": "Malware payload (Smoke Loader)", "value": "b50dcba21ff07172940f9ea5617f7caefdf812aa62db558ef13f4522d10dec462d517b52d01029dba41753601517beae", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209469, "uuid": "08b1b112-14cc-4688-b5a1-235f93089171", "value": "2054AD1173D0C033C05325798515C7F95EBAB9712A76AA8FBBC80ABD4F257D2A72630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209469, "uuid": "824f924e-cba1-49eb-aeb5-f116364ee399", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209469, "uuid": "08b8bb57-0cde-43c1-ae25-7ec864562bdd", "value": "6144:Or3BkwALiJZMw0zOVjx/gbnD1yTLCmPHzsB:ABk11OVjx/gbD1yNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209469, "uuid": "59046595-16e1-4623-be10-c5b83c001e6a", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209469, "uuid": "db2feb16-c127-4543-a29a-c7f294439752", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209469, "uuid": "4f369370-c58c-48d8-8ea9-3dde424744f3", "value": "6bf0c6ccf573c460133526c35e98bfe2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1a6764-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618242197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242197, "uuid": "42a0d6ec-0f35-47a6-b0fb-d8f9c47eaa4f", "comment": "Malware payload (AgentTesla)", "value": "99cc2ab964e6469b1b0d776b429cddf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242197, "uuid": "668639f2-754e-40d3-b1a0-e50af7a2c7aa", "comment": "Malware payload (AgentTesla)", "value": "649105b741f01b51a9847e93d24d0024d854429a1de1144738a7348c57a1931a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242197, "uuid": "c5e7d5e7-0c39-44d7-b65b-c15da38b780e", "comment": "Malware payload (AgentTesla)", "value": "51d202b5d19a948f9a72b106daa4016454b727e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242197, "uuid": "be4a97e3-d7a7-406a-b249-4d5756f971af", "comment": "Malware payload (AgentTesla)", "value": "83c8f9657cd5c5827765c49b662e9df6a8ffa8ab91af23926ecb4495627915c20bd55f2400fcca3cdce08531e54d9aa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242197, "uuid": "affd12e7-82bd-41e5-b53c-c6836da3f1c9", "value": "2E05E12133F88B18E0BEAB355930914807F2F906DB31D60E7E94559D1D72B82C677BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242197, "uuid": "006f9b69-f342-4bc6-877a-59b6933e2402", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242197, "uuid": "e8e6170d-5923-4062-9c6d-dc8d54f270e2", "value": "12288:AQHv58A/E757RSInBDI0iNsVsNsXXWUyXwcqwf3PviidsSrGK+QEsFsvcusK:fWOE1YyBMkE+mUyXUwvPvCSClsMcuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618242197, "uuid": "34791783-f855-4e3d-ba9d-acade8aa37d1", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618242197, "uuid": "cb8c5145-7f60-4255-986e-ec0fe59b2774", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242197, "uuid": "45cda6fe-d98f-4199-80fb-592c3170e3ae", "value": "Arrival Notice - S21012801940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d7cb70-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Nitol)", "timestamp": 1618214566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214566, "uuid": "a4c94965-5d1c-40ed-bf85-af28e394d665", "comment": "Malware payload (Nitol)", "value": "0a4542a1f003c4a5ebd4e010adf96fb6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214566, "uuid": "e2bbd399-57e8-410b-8a4b-5e5e5b245d00", "comment": "Malware payload (Nitol)", "value": "670cbec5ce5da74626a778fcff3bc15b62fc0608750eaa512c5ac8ba4c5d7a87", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214566, "uuid": "c14b0373-88db-4ea6-bc80-951e32e1ba86", "comment": "Malware payload (Nitol)", "value": "431f7cffb31ea416c41e266b728097641b19cba4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214566, "uuid": "a97cdbbe-adbc-44c2-a08d-283b7b42fffc", "comment": "Malware payload (Nitol)", "value": "1101d2b40c219932b249569f0e8407e509c2eea8bd70cf46328daa61b4d9caf603877545e904fb3ac9d96add9c69838c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214566, "uuid": "4d771463-31f2-41a7-8f22-7b6734019ed6", "value": "C4853385A393501AC5F9A3735F0FC0BA95A35039342CEEDF5E3CAA069739115BD089DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214566, "uuid": "54aea2bb-b4ac-49bd-9baf-f7bc678bb28a", "value": "35e5deef8315e036b994d2511693a429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214566, "uuid": "6a3a438b-9c7d-4ab8-89fb-1d2a631bfa27", "value": "49152:5FWI+EBuUpxaTeaKs1hTCxeX5birtOj+msBiuVTUxsk40XuruYO:rIUpcdb3TBX5biZU+7o7zpuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214566, "uuid": "ecfca65d-418f-4d25-bdf7-bd636537aab0", "value": 1714176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214566, "uuid": "e9c3c7e5-f1e0-4716-b579-6dd88a6a9a95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214566, "uuid": "119de00f-8c1d-42f5-baf1-8d33b7a72550", "value": "0a4542a1f003c4a5ebd4e010adf96fb6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987cb9ef-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618209467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209467, "uuid": "e4c34f49-bb83-47d1-a55c-acb30f84f025", "comment": "Malware payload (AgentTesla)", "value": "0f6b4de287257c7225db0c90b18e25cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209467, "uuid": "1fe3139f-b398-4d44-8f0f-0799f5d0813b", "comment": "Malware payload (AgentTesla)", "value": "6738e4c2eaafa65f722310d74147adf5b61bb623a81f246da504edaa38776a61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209467, "uuid": "cb26ab48-ebcf-4a21-a49c-7dcd46f1b6a3", "comment": "Malware payload (AgentTesla)", "value": "39e825e1a12b5ee70a4fc46df1e6f6e17e22d249", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209467, "uuid": "6a5c7c10-75e5-4700-bd6b-4b5da588ef72", "comment": "Malware payload (AgentTesla)", "value": "da5af50ca2975df8365e069cb289ed53a75b2e12d39f6b5eb29feea8655fcbc8e3926f8e94f10f1683d847c264a5766c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209467, "uuid": "a30972d8-8e2d-4bb0-ae02-aaa529499543", "value": "7345336BE8C4C71407AA2416189A614063AF35E62FBEF1E6D41F1931319DBE7F1C8763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209467, "uuid": "cb3696c4-92ba-4a25-82b9-de3ab38b214c", "value": "24576:9RndTnNiGPFBxy2fINsVVeBgUqp5PFSNxkcT40+KJ0xzt3/QXKk0J:vndTNiGzxyWB2Bg3pZk9T40+Zxzt3oXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209467, "uuid": "9461ef1e-74f0-4560-aedf-d92775ef2d78", "value": 1235145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209467, "uuid": "f81730e6-2d66-4089-864f-b5532c6f22b8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209467, "uuid": "314b135c-580d-4f24-9c9f-6fe3b4efc2da", "value": "AWB-18267638920511_ES.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4046875-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207849, "uuid": "93ece2fb-9421-418e-8e1e-68878152fbda", "comment": "Malware payload (AgentTesla)", "value": "500050eb23d20baf8c000ed51c99ebff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207849, "uuid": "5fe4bbeb-38e4-46f7-bb3b-44ea4a6216b9", "comment": "Malware payload (AgentTesla)", "value": "6739d4803fcbd9277f679c6d1c3b0d61b3b8b9406427e661e003ac21d8ba2b90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207849, "uuid": "20c33fd0-4bd2-43cc-98d6-9a4d139fe013", "comment": "Malware payload (AgentTesla)", "value": "b32ca040bee2fb733ed22205ebe78ae422a1f58f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207849, "uuid": "4d395563-f1dc-456b-b18d-5221dbdce6b8", "comment": "Malware payload (AgentTesla)", "value": "07c657e8fb267955bec2794899ba6c681f341437ba560b28f8fe5d28b9beb73402c4d7b0862f5b2ea8e68047e3384740", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207849, "uuid": "15f151ef-1f75-402a-a4eb-56eec173e2b2", "value": "2AE4F11037DACB46C97A8BF65432940347B5F0EE7853DBAD0E4590D9242AB0C9EE8E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207849, "uuid": "f0cd2533-d948-4b7b-a97f-d5ae28ff0982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207849, "uuid": "b4c5cfb5-2195-417f-95df-e6d932245305", "value": "12288:/9Wej2JZXPltQH+7TpS7SUp8Tr2+DFuY6Koo/Tax3P:FWejYfQe7TpS7SB/2+D3oki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207849, "uuid": "9251d032-2094-491f-a5be-6c9f85ea5928", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207849, "uuid": "23db77ca-52dc-4489-8cf1-492513f22fb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207849, "uuid": "db44014d-4f3d-403f-89e9-3fe848b3dab3", "value": "PO 9506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca611dd-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618233660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233660, "uuid": "b5762dca-5323-4c6e-a011-d03d685b1d43", "comment": "Malware payload", "value": "a09ba94cfa3549f69f4cd9639a5c149d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233660, "uuid": "639fd3db-01ba-4af6-a562-2d99f2a4e2b5", "comment": "Malware payload", "value": "674a0ab368e3c9423f11e45f883d5f11dbcfa7d2cb5b165a6632b14206700c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233660, "uuid": "682a77a7-40ce-4bdc-a7fb-2e411c5fe5c6", "comment": "Malware payload", "value": "7e8edc46d16d8a95233ec54342aa4db38ddabc6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233660, "uuid": "e918bed6-a448-444f-8dfe-d4b99d8b34cc", "comment": "Malware payload", "value": "1fba6994bdf631533ad15fc593dfc18458ece62598f8046f0a5e2921099735b331ba8d26e5621d5ea249c36350bce7b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233660, "uuid": "96b47a45-b655-42fe-b933-373655f58508", "value": "25C4F12406988956E87D1BB958B0D13113B0AD21A633F71E75EC2C5F7E737E28A6F381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233660, "uuid": "9b30e815-bb34-4d90-a181-6f0f08bce1b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233660, "uuid": "59a8064b-05c0-4174-b303-93bb958fbc7b", "value": "12288:c4enqAUhJ+JSqeuni30Ioe+my4XkdxjXcHvGZKy:ANST30IoeY40dxjT8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233660, "uuid": "e8d14ea0-42dc-4f44-8440-7749b4c347e3", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233660, "uuid": "ea6ca6ad-8813-43ce-9de0-4e2fb78b30ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233660, "uuid": "120cef55-20a8-4653-bb16-ab4f4663ffb0", "value": "PO#53466 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c88c6-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207279, "uuid": "e349c114-f689-4612-92d9-3665a199dbde", "comment": "Malware payload (AgentTesla)", "value": "c40e645b30317b81a43e2531e07d9ed4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207279, "uuid": "7bee6043-b24a-40b7-9ebd-7f2782d4b1fd", "comment": "Malware payload (AgentTesla)", "value": "67fe1cc43fcd117262026aec209c14f658d4d28a0a0d63a4162d7e21d528f322", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207279, "uuid": "0938dfce-e1a9-4ced-8718-b57e3f2f405b", "comment": "Malware payload (AgentTesla)", "value": "48e38b5f5f1a8b1e7a162a4d5182c143376a1302", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207279, "uuid": "6487a429-0f1f-444a-b429-601f0d014a9f", "comment": "Malware payload (AgentTesla)", "value": "c1c604ec120f4b86658e37c943a36b3b87e1eb9c231de56c64c40aae6dc367e29f08c9935d3490dff0020bd8d074c5b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207279, "uuid": "a5e19439-3091-4769-bcd8-bbb9752c2f5b", "value": "30159D987604F5CEC4578D32C9545CF09610ACEAC31BE243A0573D99B93E68FDEA68F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207279, "uuid": "a37c17a4-acf6-45df-aad1-454d9f710a74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207279, "uuid": "8586f579-f2b1-4ccb-a453-4dcf650ff94d", "value": "12288:iz7DN/O5bWxTNJkfuI40ooSiUrCVcK0fCR9rc+qrQmjiEYZVpPug73Ad/:yB+WYyQUrCVcK0fCRi+qrQMiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207279, "uuid": "126fbac5-360f-4bdc-986b-967bb9b490bb", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207279, "uuid": "e6ed8b67-e292-41fe-a800-8f5ebcd495e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207279, "uuid": "abfb7c95-6a8c-4889-82d6-9f78a6e53052", "value": "PO 9506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b03b105-9b45-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618200774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618200774, "uuid": "190429cd-9350-43ec-8a62-038dd96880f7", "comment": "Malware payload (Formbook)", "value": "ece2f27d71186f95680b3d845e4f3b11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618200774, "uuid": "5c2cd78e-4659-4905-b436-7c2123b3fdc9", "comment": "Malware payload (Formbook)", "value": "683ff12294f8c61b8995df0f24fb17ce307aafe9308351282b3e61d69fbf49f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618200774, "uuid": "79d8f3bc-8222-44ed-a114-30ee6e82836f", "comment": "Malware payload (Formbook)", "value": "73ce0ff96694e8b4143b8e31665bc1353ae4114a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618200774, "uuid": "746d95d6-eef9-446b-86f0-029100a992d0", "comment": "Malware payload (Formbook)", "value": "90a612409ee4cc085fcbeae62ce0bc2d009375ec051f3c397ecee9ae731827a0749b4a3b96d3af1e18c0eadbcc7beab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618200774, "uuid": "a67f8915-da3f-4f23-bdb2-00981d72f92d", "value": "3BF402116284AB9AD4EDF6B4EC31D7000FF5BF4AE666DE0F3ED0709809D3B9B6641621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618200774, "uuid": "c87cc33b-284a-4781-95ed-cc3a56f85ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618200774, "uuid": "a259cae0-da72-4e4e-935a-c2b4f3c97046", "value": "12288:elIckUZwrq/OCIst1K+qdTpKuPsg4hxfy880cNxqy2K:eajqt1K+kTprohxfM0oqyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618200774, "uuid": "777431ac-1f27-4f3b-b746-1afc8efd7ce3", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618200774, "uuid": "b8201e95-16a5-4031-8ea7-9b4634b4a176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618200774, "uuid": "f1c8e4ae-b844-41b6-830a-f870e8951f89", "value": "Swift002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1619446-9b50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618205724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205724, "uuid": "4189b2aa-3141-4508-a980-dcfe64352dc9", "comment": "Malware payload", "value": "7ababe788e4370fd87468b50928fa33a", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205724, "uuid": "52fcd1b0-c151-4a62-a291-75edd482dbe7", "comment": "Malware payload", "value": "6900d3935c3ff68e1978f6e575953e18c74539ce3df80f45d9f4525aba39d4f6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205724, "uuid": "7217e4dc-eb9d-4501-9e01-736b8f0a777a", "comment": "Malware payload", "value": "71a1ee8aefc5599a4c528660ab4156f9929ef76a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205724, "uuid": "fd7c8bef-3596-48a6-993f-713d6c6bc1e3", "comment": "Malware payload", "value": "7cb236355ab6da1c5f1c464b39439ad3f5d794e097c2b8d0ecbc24524a0fd193c7b5494d55ad41eac7a31dc573c157f5", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205724, "uuid": "08b63ad0-7325-4a61-bf35-de4c7c6a8909", "value": "B4B53359F9D1DF6ECD1D11F0E25BF4BC8A556D21B7A04D4A730E32B8323B92462C2B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205724, "uuid": "dff7500a-3172-4f2f-b2dc-7a8ec31ed1f8", "value": "49152:5boswT7GikOWM+S7gCwZKD+9c3PTsN2bccSRUuwvnz+8vJv93dGhf/r:usmGtOWtS7gq69QTnjvnz+yhdGhfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205724, "uuid": "76f24fad-065e-4a9e-b361-668901d56f54", "value": 2464768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205724, "uuid": "bbf2bb59-5445-4917-b0e0-58a2a1c30b76", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205724, "uuid": "cdca8c15-757a-44ba-bfb9-83576fe6ed53", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b53092-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207906, "uuid": "09e57ffe-3648-4a68-a9f9-3cb71a0a1a10", "comment": "Malware payload (SnakeKeylogger)", "value": "2271191054de35c9ee0e34bd905a01aa", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207906, "uuid": "33955ab3-9471-4843-8e41-bd75a1872872", "comment": "Malware payload (SnakeKeylogger)", "value": "6902a1cdf46cf8e3b0932ec33040f6b1302d932b36b44f89ec9b4cc36252730c", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207906, "uuid": "0bc63554-f232-48f1-9c29-0fb195858d78", "comment": "Malware payload (SnakeKeylogger)", "value": "9ea05b52f9b5cd808b4dde68f3be1c176cab1934", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207906, "uuid": "5b985099-d490-4870-95e6-701827c634e3", "comment": "Malware payload (SnakeKeylogger)", "value": "e91a830e0318d923db9ad9ea7d7dd57b66ef9de1b828bc9996c8a324ebe4513e72406574ea3f18cd820824f5684a8d22", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207906, "uuid": "dc952f3c-02db-4413-af25-bfffaa5b98b4", "value": "9E558B726B704249CA240AB4546248031676ECF96833E7FAC9FCB099363775FBCA1D66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207906, "uuid": "fda2a8a8-2b96-49af-aa06-04297881410c", "value": "12288:rFJbDBJXrU6fzJAd6Xy7NS0KH7FPI4qWtGpLY0mYwv:rTjbBri6i7Nc1I4popE0m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207906, "uuid": "b7b49936-892f-421f-bffd-f8f1ddf92a19", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207906, "uuid": "93f9d1ad-1e6d-497e-988f-0ecb6575708c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207906, "uuid": "17c162dd-4a3c-45d7-bdfc-22df624d5141", "value": "JSTCG21040600210.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf04e07-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208238, "uuid": "913b6281-2047-4dd8-998c-b59790d4cd1d", "comment": "Malware payload (Formbook)", "value": "8509a1f5a64d8e2bf1a083c303db1863", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208238, "uuid": "09cdea65-5fd3-4821-bde1-3fd6648d6dc4", "comment": "Malware payload (Formbook)", "value": "690c55213ecd2abb6a8764616a2e81528ee83a5b22626085793968965561a465", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208238, "uuid": "86b5740e-68a0-4347-973d-c1920f2adf09", "comment": "Malware payload (Formbook)", "value": "bce103a2792e714fa557c08760053e48d5cb8c2f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208238, "uuid": "8cef5f05-411a-40f7-a778-bab000e52b75", "comment": "Malware payload (Formbook)", "value": "bdbfc4a96cdb8fb76858a9e89147f380f73f86cced7289c8a0ca6fd77a38917edab34d38a3697ed617a955b283554c4c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208238, "uuid": "5a405b4b-3d73-4e0a-8c26-ec5ae777505e", "value": "442423103CBD1964BF394D29DE3AED89694607B16E70F0798325C0C7AD9FCFA5B58029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208238, "uuid": "99af75b7-f6ae-4598-ba53-fa77668195ff", "value": "6144:VY6G1nUVROqaIK6bQnOfvd8tW164WYgsoO+DdqdXPaHzb:vG4pK6bR3b16ZYsGXPaH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208238, "uuid": "26895377-1380-4b8a-9dba-781a0660c0af", "value": 215700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208238, "uuid": "e8dee9b3-a09a-4875-814a-132cdcf3bd95", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208238, "uuid": "29f6dd73-566c-42d1-aaf8-ad8b5c21fa8e", "value": "Doc94729.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5731a1f7-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618209358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209358, "uuid": "c0e22cfc-6d10-490c-a54d-f3aa9735b0a6", "comment": "Malware payload (RaccoonStealer)", "value": "bcb963922cded32b86e95b1f17b284e7", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209358, "uuid": "e8de8798-d498-4149-8b50-20ad876d7632", "comment": "Malware payload (RaccoonStealer)", "value": "693353c431f2ba4f4ca0333c13962db98f9094c0f9d902c1302e5ef1d43a5576", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209358, "uuid": "a528ce1a-df47-4095-9fa5-dee552e8ae34", "comment": "Malware payload (RaccoonStealer)", "value": "586f6eb1e013f542f004273b82b3319357d9a9cd", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209358, "uuid": "b4162a3c-6dd6-44d7-8def-be97543db646", "comment": "Malware payload (RaccoonStealer)", "value": "ed901013ce64b0a3f7ad66632127168744b9275cf124b485e853a1aaa2a2627429f1264a67e0f6a67bd53501e7b4a2a4", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209358, "uuid": "22b00d48-eb1b-4b1d-9c01-262095b37829", "value": "59C4F11073D1C033D54225758525C7F09EBB74365AAA998FBBC80BBC2F257D1B72A38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209358, "uuid": "59468113-159f-4a4a-8feb-eb490cf648bf", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209358, "uuid": "2b190260-344b-42f5-83b7-b1804479ac3a", "value": "12288:0lEdDEokeYkljnDwEkK5OgjTZ6xDTiLT8o1SihW4hW2CEfD:0m6wjnDwM5OSTZmiLgoIethhCED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209358, "uuid": "b9ef1649-3fd4-4b0d-9890-02592ef55032", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209358, "uuid": "ff3d58c6-75d7-48f2-a13f-76c9920f5b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209358, "uuid": "43bb78c4-facd-4097-83bd-316c45e67832", "value": "phantom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54be6e2b-9b95-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235123, "uuid": "0b3e360b-2f74-4669-a177-9f6657eeaf4e", "comment": "Malware payload (AgentTesla)", "value": "d0ff44452620c5a7fa184e7175ee1e40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235123, "uuid": "fddee719-eb5d-4011-b3fd-04556ff9529d", "comment": "Malware payload (AgentTesla)", "value": "69b330c7d552a8dae752385390af2d64a7e72519888059d7843e75bd4232b313", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235123, "uuid": "9d932896-69a8-4123-935f-243ec9c8afa1", "comment": "Malware payload (AgentTesla)", "value": "e9ef5b60be9dd4986b43f421ac347316892897a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235123, "uuid": "81c073fc-9d7a-4b68-b9b3-3c79ec611383", "comment": "Malware payload (AgentTesla)", "value": "d2e55730edae3735eaf1c77bd72265c793981fd9602881d4afd40c2cda598b37450ce081a3d94d4f8525e52fc3aceea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235123, "uuid": "d26a8ab3-faa7-42bf-841b-027e37087798", "value": "0B157A477EC0DA9DF0D84A3E19FC10227FA3D886591E9FC699CBB3AE05D1906F524A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235123, "uuid": "83071496-665c-4f57-8c71-680c253db894", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235123, "uuid": "47753caf-3156-4cdc-a2a1-8da6330da1d0", "value": "12288:syfdlgPHytAVnkzHXaPKxKAFU0NlzXi1PiRkPtzOSVb+ltK9WhUHbT/49YKg:syfdliHy6wPFnlzXXR8zBsPxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235123, "uuid": "a0211afb-5813-473d-a059-0166e5d798e7", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235123, "uuid": "47fcb17f-a51f-48c0-9e9d-68906edb9583", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235123, "uuid": "204d88c9-75ad-425d-99b8-c29602b09687", "value": "SecuriteInfo.com.Trojan.PackedNET.645.1649.26006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d15c8b-9b6a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Phobos)", "timestamp": 1618216553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216553, "uuid": "8dd1d4b3-6e63-4203-a748-8e2648c15dad", "comment": "Malware payload (Phobos)", "value": "a53e1725d0d8f8c4616c625e113d3426", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "POLSAT", "colour": "#A07B98", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216553, "uuid": "bd129c0e-2e61-4692-a14c-904d0c27aada", "comment": "Malware payload (Phobos)", "value": "6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "POLSAT", "colour": "#A07B98", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216553, "uuid": "cecf4df9-6767-477c-a00f-0dff993e51ae", "comment": "Malware payload (Phobos)", "value": "733ec0a491555e4563839ef273b66cb94f0c4163", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "POLSAT", "colour": "#A07B98", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216553, "uuid": "2c13908e-13c6-4554-974e-5e4b54b7992d", "comment": "Malware payload (Phobos)", "value": "1d382741e3d32acd0cf5a0424476eb007df07852e312c5514c48a676a9b24287f73490790d7a2e942346e3b576050326", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "POLSAT", "colour": "#A07B98", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216553, "uuid": "52eac2d8-09b5-4cc9-b47a-c053b77ff991", "value": "4253CF5AA0A980B2CDB14670293A2F5F5EFE600540B488874F3D8D9B7FD5172D73A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216553, "uuid": "c344b4a0-0247-49d7-a8b6-1d1fda0296ee", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216553, "uuid": "7ea3a883-273c-4e2f-9b70-f70c383384a1", "value": "1536:kNeRBl5PT/rx1mzwRMSTdLpJS2gKBiEyfND:kQRrmzwR5J7guMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618216553, "uuid": "b4ca7e6b-d251-4733-95f8-e96181fad6e5", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618216553, "uuid": "2a3b411c-25d4-402f-b18e-0f2539df91f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216553, "uuid": "85041677-3589-41ac-b374-700510584011", "value": "6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade2743d-9b90-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618233125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233125, "uuid": "2e5608b1-089a-47ae-ac13-c6f3852b8b63", "comment": "Malware payload (AgentTesla)", "value": "2e7a3295f9c7ff154c77780ab4d84ea9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233125, "uuid": "e02a86a0-6e95-4066-81ba-6246aab68e56", "comment": "Malware payload (AgentTesla)", "value": "6b986278b1ba2a036b1918132b403c9c5e4e3454aa4691d7b85c5f840df85aa7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233125, "uuid": "9e5f27c6-8453-4acf-9371-a0e8d0d19170", "comment": "Malware payload (AgentTesla)", "value": "4b08d81f5eb27b3b5e86e4c54461a9e797ad1f9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233125, "uuid": "77fca50f-0f0f-4133-97f6-11df2db6ab89", "comment": "Malware payload (AgentTesla)", "value": "673f6b3857e6f250db9938530c8e5f752a0cdc0b43371a44614f7c5e8d4cb966d0c5aa1a36cf869e75c4fb53e1f225ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233125, "uuid": "6bf35571-2692-4ac7-b209-88e814e6c658", "value": "18D4E02567989F59F1BFA73DA4312400A7F1B446C332E71D7EA910CE0BA2B84C675B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233125, "uuid": "1f22a79b-c0b8-4234-91e6-cb20b1d6d13c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233125, "uuid": "c0737417-cba7-42a7-9cd5-bb0b96ba118d", "value": "12288:3EZWI1RjicX761xDUdL0z48PZAFpuV74AWQ:U8IXjiQ76gdLG4qZAy54AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233125, "uuid": "19b19593-a02d-46ac-9082-03512ce418ef", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233125, "uuid": "6b49a99e-5cc2-462a-b0b3-475908c2aebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233125, "uuid": "5aa5907f-91bc-41c8-a01d-45d5bdce6e43", "value": "RFQ NO. 187519_OSL_HAOFG7S5AW-5BBC4BA4C2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f126222b-9b94-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618234956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618234956, "uuid": "99564523-7f2e-496a-ade2-1e65a135e656", "comment": "Malware payload (AgentTesla)", "value": "7d4986a1c425cbecaea22834c8843c42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618234956, "uuid": "83b15daf-cdfd-4f92-9fd4-71e0013ef8b9", "comment": "Malware payload (AgentTesla)", "value": "6ba542d7f5d41c28855a8ddd1fb99433398ec3c8902ab987942891f5d900f9fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618234956, "uuid": "54e949ab-58dc-42c2-980a-3c8ab3e73b8e", "comment": "Malware payload (AgentTesla)", "value": "5826f326771b7a470357a6cb82c2e7b49dc81e3e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618234956, "uuid": "6ae4cf2f-c7ed-4e5b-9bea-9c0740c0032e", "comment": "Malware payload (AgentTesla)", "value": "41670bf4dd6eccedb4f3f91ecf31f2cbd6b801e02284db17aec7a7b7097e5fb24b75fa1baa0d3c3305e8e1a658be701e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618234956, "uuid": "ee982608-f137-4e75-b3e6-d71afba67778", "value": "D19302CCCD9BFB3C25BD45E1580AFD896D30C549763A0E2E36BC5D1E4AF4A84A8D8162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618234956, "uuid": "31cd453b-887b-454d-b43e-aef80d72113d", "value": "1536:cZtbK99vABACkiUWDAGLCKQ08QenlbJ4YsmLODdzw7YvyjHnd0JEmR:WZKnvAkkoKYnl9/tODJwxjGEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618234956, "uuid": "4240e149-2db6-4b15-8ec7-f9063cbf3c08", "value": 90146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618234956, "uuid": "0930e0bc-8cb3-4aac-9616-ea9099ecf145", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618234956, "uuid": "1adc8764-5c9c-4906-85d2-e59d00a5e6c2", "value": "QUOTATION.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1681a4c0-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207961, "uuid": "1f434549-4f8c-4c09-b843-87fc7f6778ed", "comment": "Malware payload (AgentTesla)", "value": "a097cf3b14e6377fc71141406d0d3b44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207961, "uuid": "5d39b09f-0f51-4e85-817f-17fac31140e2", "comment": "Malware payload (AgentTesla)", "value": "6d12e52fc3c5625407f2eccd6a9036b784d3473c24fc8733eb02c8fc1dc83add", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207961, "uuid": "1ebc12a0-306d-449f-b70c-fb0d79e5c402", "comment": "Malware payload (AgentTesla)", "value": "8158e9a4600cbc259e8bd500993e77299d3481d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207961, "uuid": "2a3c4b60-5e6d-4da3-ad6c-5487f8d59924", "comment": "Malware payload (AgentTesla)", "value": "97a4337e888d89fb6ed01a4811262bd3146e558d0055f7931a4a1a79402a06cde1c921a9b4dcb6ad3b6ad793e30da0f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207961, "uuid": "f9586b93-d899-4ecf-ba02-1105799d7659", "value": "1805BF413284D9C6D0171AF2586FD0211279F9DE9427C70D2B42BB6A60E770A2DEBF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207961, "uuid": "45e4c89e-66b6-4af3-9728-62ac55f0c109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207961, "uuid": "1eb4854a-fdd7-472b-a773-334f0985e0b7", "value": "12288:Y9Te5pjgY4bH1D8byTXNvHbRE4nBoWXxG8CcM9SiyyjK:UEYT18OTdvHlhRhG8CcWd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207961, "uuid": "d99053d2-9f1e-4514-bf57-1161dbcfcb99", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207961, "uuid": "8deef537-c08b-46ee-ae03-d2021ac5e772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207961, "uuid": "e35572fb-befb-442d-b8ad-e27eb42b9c0a", "value": "Quotatio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e181eab5-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618225052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225052, "uuid": "814b88e1-8f7e-4b29-a3e3-7491fa6cbb81", "comment": "Malware payload (AveMariaRAT)", "value": "84316bd8a6b69472115faadfc446253f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225052, "uuid": "9201431e-41c1-48f0-8810-41be17e60248", "comment": "Malware payload (AveMariaRAT)", "value": "6d33f52ccba4dfd0f6ae6559d49f85bfbdb94560dc321cd09defa7d1278773cf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225052, "uuid": "f5611a0b-2224-4cb5-a358-67daff54d9cc", "comment": "Malware payload (AveMariaRAT)", "value": "03c9c3263f71654173e55c7074434a75f487f2b7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225052, "uuid": "04fe5065-6939-478d-beb2-07a0b1f3d492", "comment": "Malware payload (AveMariaRAT)", "value": "95b1e51fbb169e2cc96d6db75a4b1448fd0ba5687d64a2511ff63eb75d5618b4ed5948ddf8d7267c8eb496a6dbe74741", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225052, "uuid": "b87e7894-aaff-40bc-9437-cbfdba617600", "value": "A1D3129EFDA60E12F81146348DE6C4CC9EFFA5322922316FEF75909E10E0DD9E41913A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225052, "uuid": "a34e1f80-2f2b-43b2-bb10-0b53f9e38590", "value": "b863a0170e8607b535791c6f08481ac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225052, "uuid": "358ca52a-db1e-47ac-8682-e8f8238b6a10", "value": "3072:A9QsVlaReZhphqrlT7MG9DqDseBguVdu4+rqv8kzY5Bed/rX:I+ReLQlpJqBBguF+rKLtdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225052, "uuid": "67b3e192-f385-4599-b69b-799c871e8f3d", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225052, "uuid": "6dc86157-68c6-4993-8990-73a22fc85720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225052, "uuid": "2c42aaa7-24f6-4c63-afb3-3236a5d3e361", "value": "SecuriteInfo.com.Trojan.Packed.24465.12290.29943", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4a3a87-9ba7-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618243082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243082, "uuid": "1d33601c-bbf5-430a-b0e7-861813bdeba4", "comment": "Malware payload (Dridex)", "value": "a56f017471302adfbc9c794c49ee27f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243082, "uuid": "ce57e394-f6d4-4a44-a0f6-31420bccd86c", "comment": "Malware payload (Dridex)", "value": "6d72de300d6233f7767441a0927a310d454dbdd3520fb85aa609e62097688f5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243082, "uuid": "9fbd70c2-6a93-4678-bebf-69e99e9b9142", "comment": "Malware payload (Dridex)", "value": "7afa59088628916cb88b2f8c801ff59224439745", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243082, "uuid": "81725fad-db10-4333-8889-cba1b89fa73a", "comment": "Malware payload (Dridex)", "value": "6f617740768bf0bb502ce91389fdf3cd9da130afcfcfefe7a491a7f916b9e0a52696b8886169d90be5b53499db64893a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243082, "uuid": "a61ac2f9-4c60-45ee-a055-c0bc365a7ffc", "value": "59F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243082, "uuid": "17c2f052-f1af-4fda-886e-1841aba27280", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243082, "uuid": "65661eac-1879-477f-b5cf-08d7dc8ed06d", "value": "3072:blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618243082, "uuid": "3b59325e-8d5b-4b47-b949-cc61d40b516b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618243082, "uuid": "7cab10d5-b7d5-495a-b360-42a4665223a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243082, "uuid": "ba647e78-4a21-4889-aefe-90c641d7008b", "value": "cnkR8kfU8IKO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fea4b5f-9b64-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618214204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214204, "uuid": "7c1f5ae4-1417-4fc7-9842-b00774a4e605", "comment": "Malware payload (AgentTesla)", "value": "b7724fd635cc9c0ac12af69468d8f734", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214204, "uuid": "5ce82aae-ba1c-4507-854a-621b825cbc84", "comment": "Malware payload (AgentTesla)", "value": "6df1420d84c9c0a1427b91fdf3e9fe8b6245f9f8ea3b00658c430106e72d33d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214204, "uuid": "c1fda966-f1b0-4017-83bc-07286e41b10b", "comment": "Malware payload (AgentTesla)", "value": "db18fe9a073456a11a8346e510b3d04d6f64adc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214204, "uuid": "86573afa-3529-4557-8f30-396f5ae42e4a", "comment": "Malware payload (AgentTesla)", "value": "56356a832f2399aacfbab7389648627e6f908dff804183e91587ec8407d2f8f259ae8c9f8a18a953000d7e5cb1074b9b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214204, "uuid": "16e33f37-7645-40b4-a638-7ff97ed74c9e", "value": "3F05572362BDC6D1F86D7EB55124830206B5ADDA2533EA5BC84FBCC5E83760BCC949D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214204, "uuid": "90cfdf29-d789-41a5-a311-1b5f94f53826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214204, "uuid": "f45c5707-3ed6-49cc-80eb-9566646d082b", "value": "12288:IpKyZu+9vsh+aNW314fEJsMXuLvfm7AAFyKWiFydoKVh8onDA4w:h+arklruLW7ZsKWgydFVWUHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214204, "uuid": "e03e741a-b2e5-443e-8684-e4c799672f81", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214204, "uuid": "c4bce666-138e-4544-8d3b-974fc76ade07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214204, "uuid": "a35b1d51-3718-4bd6-941a-0152214549c0", "value": "PAYMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd556132-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207838, "uuid": "fe8f6591-9d11-469d-999a-4ce293a108d8", "comment": "Malware payload (Formbook)", "value": "d320967a90e6a8fd824864c53dc02135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207838, "uuid": "c7eb7225-5c6f-4f33-bc5a-ddbae785bbb8", "comment": "Malware payload (Formbook)", "value": "6e110b6474993b690f1bf6f2edc01446010ce9bef5375991693e2bffa81d14fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207838, "uuid": "acc758f5-5068-408f-9138-eb8f6ef2cfa1", "comment": "Malware payload (Formbook)", "value": "345e589b268690d6a3f34686cdd0af5368de376c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207838, "uuid": "0cc748ec-0c92-471c-bd99-e334a3b7513a", "comment": "Malware payload (Formbook)", "value": "dfa028ba3b15412b527aa38429ed5150c9ee91b108bff61a52704ae579e7018715bf6d9fb8fa9cc54db5da01f1937cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207838, "uuid": "9dc8ecca-0351-47a6-9974-f10b5a89faea", "value": "0D05128E7380A776E4F91BB8482049215BF9E85FA722D21D3DF9EDBC3573744824C992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207838, "uuid": "0769e3cc-f095-4d0e-8b22-2ed1a570da5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207838, "uuid": "9aefd13c-d7df-46be-9cd2-e9ecc7dbf5f6", "value": "12288:MWqVPMuk6Aws9YuUHxgf6X91ZLWKCiht0sJw5W5qY5QbTPSsXq60lKN7:M/kOs9YuUg4ZLukSkQbtXqYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207838, "uuid": "df5c06a1-818a-4bf5-9a5b-889c299d3d39", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207838, "uuid": "d45b9ceb-6fbf-4102-aa83-6138258e4ec8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207838, "uuid": "caaa9991-a4f2-4552-83d8-05a271670604", "value": "ORDDER-238486-LBT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e7f91c-9b50-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618205737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205737, "uuid": "9388b1c4-166a-49ab-903b-adbdc26dc6fa", "comment": "Malware payload", "value": "ec2c28cb66ed6911c786dadde2be8127", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205737, "uuid": "a6dc2bf5-df13-4c16-ab03-59187bc8ff59", "comment": "Malware payload", "value": "6e3e53a48c5c910fb8fceaa3e11dbc1591036ab17b6c944e8ef428043c0067b6", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205737, "uuid": "266818f0-a028-4008-933c-e98b101932ab", "comment": "Malware payload", "value": "5be6d276d8caee9781d4a747e90a8f9cd6080565", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205737, "uuid": "0a42669c-7b3e-4191-8489-23affced2974", "comment": "Malware payload", "value": "1f758ea5a5d5505b9eb9ba29b3eaf8af9261fea4a5f99107a44c9bdbd40f26e42add1bf999c550098c0c80b97460b367", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205737, "uuid": "857489c5-cb4b-4dd6-9cff-63502d2317ae", "value": "B1C5331ABBE2AA0AE04F543460ABD8BD411D6C0177AB0C45FB3CB2A87977B3557D0778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205737, "uuid": "567e0ddf-e1ab-4001-a26a-db0d4b638381", "value": "49152:RDwVUKiWtSe6udyAV9wFUZBdf6wHwp/6lvPZBUb/Bt3H5L1:RDMUKiuyArQwHGWDUj33ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205737, "uuid": "e887ca4e-8439-4154-b8fb-581e678995e9", "value": 2636800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205737, "uuid": "2af1a8b1-d05c-402c-b695-36ac80219fbe", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205737, "uuid": "6590e1a2-2ebc-4e33-88d5-6123ded6896b", "value": "NEW ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b5aee4-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230206, "uuid": "d43c9482-c961-4f9b-867c-00e9bd6c25d7", "comment": "Malware payload (Formbook)", "value": "9cc01ab43287d4de9f02286101400931", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230206, "uuid": "2262b6af-0df9-4211-ba9c-f64afa3a2d7b", "comment": "Malware payload (Formbook)", "value": "6e8b4a6dead862631c4f65a7fa21a927abc1a04320f14286910b02b1abbfbdc0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230206, "uuid": "8c4ba01d-316e-4770-918f-703e61042a2e", "comment": "Malware payload (Formbook)", "value": "f8ee6179d0ee162216eb3a2352b19ad5a94c5206", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230206, "uuid": "299fc36f-806b-4bb0-8a5d-989e1a308625", "comment": "Malware payload (Formbook)", "value": "525fb6b79d676160fd6ede66c1ec75ddf12ae84820eb6c0cfb4f042bb3795bc03218713084a5461d1fe605e3ef67c37f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230206, "uuid": "b19e9230-d83e-41c8-ad9b-e8eb6b980067", "value": "03B423455324333E1E15F3FB3E5AE5C869C231ADC138A90068BBDDF986327A1987976C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230206, "uuid": "b911c49a-b1f8-4f37-8398-c619013aee28", "value": "6144:Wqdw5T+2/UVrLKo5r2Z+2YfBF9iUIchxpam0eGgkBgex+M0F9fDulNKOUnnLQIVo:ci2/UVwZ+F5F2Mv61z110TfylcnXV9XW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230206, "uuid": "b50a694d-a902-4923-9caa-14e49c77cc54", "value": 495311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230206, "uuid": "94c5b69e-f9a7-4baf-8505-9bf7d444f533", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230206, "uuid": "0621676b-b1ad-4b91-abdd-de1c0b8bec3b", "value": "Payment Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88eff041-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618253250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253250, "uuid": "9e564aec-52bc-4fc6-81cd-0037acd96ea5", "comment": "Malware payload (AgentTesla)", "value": "98da4d4462431a817342ef646bf33d04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253250, "uuid": "067eb6a0-8e95-4b49-a8eb-dcdff0ffae18", "comment": "Malware payload (AgentTesla)", "value": "70623b6974bf44b26d80e6de5e1eb6a0e20d56d9df7b358572cb4b34b2ded73a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253250, "uuid": "55c2affa-0048-4bd3-a450-4061205aba06", "comment": "Malware payload (AgentTesla)", "value": "79152b3eda371ae745f60cd169134f40092542a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253250, "uuid": "cb71ac87-19bd-4fdd-8aec-7c9137365f8c", "comment": "Malware payload (AgentTesla)", "value": "9aa1bbc01474c52571f3a918a65d07f4184cdf8a474c63a4de09ad297324befa254673ed29d7dc84e47f94b4cc39eebc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253250, "uuid": "9b4462f4-7853-4c3f-9912-0eec133fceed", "value": "78D4E1F139802077E59BAD3421DB2735F2F1A6A36B72988459951DC8C936FC6BD0EE0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253250, "uuid": "69c441ba-0ae7-48d7-b4c3-4c3d1c85b032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253250, "uuid": "253836b0-9bd1-4ecc-b21a-3c8e62a132b0", "value": "12288:6FEhdMSIaY6wjEO7Lf1QvyfT4ExXoOXb0qyV9i:60LY60f1JfPxXyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253250, "uuid": "16d239a7-0e6c-49db-a095-16134c7cd689", "value": 628920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253250, "uuid": "788e968c-0320-45a3-bbe3-b72ea744f9b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253250, "uuid": "a9da5450-beb8-492c-aeda-8184beb2177a", "value": "98da4d4462431a817342ef646bf33d04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0617929-9b77-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618222500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222500, "uuid": "b42aea7b-17ac-40f1-a52c-ffd448b789a8", "comment": "Malware payload (AgentTesla)", "value": "314abb7d0b7d5492e400ba9508efc537", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222500, "uuid": "54404aad-6acc-49c3-b440-8b742bbe98db", "comment": "Malware payload (AgentTesla)", "value": "717f6490e7a0df861300597b441115a3e5b9499f28fa5bdcec99efe4711511ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222500, "uuid": "d7932940-9675-4bd7-ad4b-5be0947d6658", "comment": "Malware payload (AgentTesla)", "value": "b126abd81ff43b992b5ca0899136f9dc60cdade0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222500, "uuid": "da0e41e4-cc9f-41f3-8b33-967e45df1f47", "comment": "Malware payload (AgentTesla)", "value": "40b9f905b7b0ac2da69eaca7103961f0a407267897228e1ec7cf3bfd0b3e55c4af14ab4812d2fd6f6636d09b720ea970", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222500, "uuid": "a6867b1a-9560-4f09-b25e-2c09d9c9124a", "value": "7DE4234F83B02BDFD919F00B94E153423A94657084BF1E6DB6D73EA09CD88E52598EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222500, "uuid": "ed6064d2-17fc-4c86-b05b-1a22bb1d17c8", "value": "12288:hYH1A1npzN+Byjvo93McPMBgias7lOtSvNc3DmKmILiZjSw5Ka/SsPnkmhgTT08:M2pkyDo9jP84QlO8cRmIuZH5Kxsvkmhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222500, "uuid": "dd468ea8-523e-4c77-bdd4-6d3c5998ce81", "value": 680885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222500, "uuid": "7be7016f-3cf1-48c5-ac71-bd23f06d8e66", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222500, "uuid": "a1883083-4d71-44f1-9050-6328e4d04280", "value": "PO 00041221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4489447d-9b75-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618221352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221352, "uuid": "bd88bf41-794b-479e-8280-bf867158ef4d", "comment": "Malware payload (AveMariaRAT)", "value": "811cba52862a62af61525f6d4c6ba768", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221352, "uuid": "499ad9f2-4197-4765-ae00-ddfc3e59b012", "comment": "Malware payload (AveMariaRAT)", "value": "71a23392365192b43b1689b784e7bf7561ad95c6aa0432e6c4635e17e63b1b9d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221352, "uuid": "2a9a0839-b4d1-4a93-9ead-fc2d4e5c4c72", "comment": "Malware payload (AveMariaRAT)", "value": "aa40b02a08223dcf34080757726d257156ecced9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221352, "uuid": "57e3feeb-6da0-43a2-af08-c9f8a48dc808", "comment": "Malware payload (AveMariaRAT)", "value": "937ad41bc5eca776a8d0e8be040732ebed091c57fd4979f9afcbb649818bab45d67c61df2042b8ff4430518401c81c57", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221352, "uuid": "f8863083-23b8-401d-9839-b1f14c23f0ee", "value": "6ED312AE7D590861FE1106349AB684CC8EFF99721D13396FEF71F09910A1ED5E42D03A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221352, "uuid": "5430d9f6-6dbe-4d77-8805-03acc64bc431", "value": "438a8cc2a41e2e09d941fbc6cbc75bf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221352, "uuid": "e93aa9db-48be-4f36-ac85-9923ee7924a9", "value": "3072:gOWCsVlaReZhphqrlT7MG9DqDseBguVdu4+rqv8kzY5Bed/rX:JReLQlpJqBBguF+rKLtdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221352, "uuid": "abf8aa8a-05c5-474c-b47f-f940586e13bf", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221352, "uuid": "72df231f-98b4-4889-b2c6-b6bdfc4797f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221352, "uuid": "f032fcd6-77c5-4231-b9de-dbd17047bdb2", "value": "SecuriteInfo.com.Trojan.Packed.24465.2847.19588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fa9778-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207307, "uuid": "bee2d5bb-0197-4964-9257-5b4afbd7a016", "comment": "Malware payload (AgentTesla)", "value": "30a466b0979e296e16b79dd11b3608f1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207307, "uuid": "f3190776-fc22-49f5-97af-e7a4d51a9e64", "comment": "Malware payload (AgentTesla)", "value": "729754f582c781d64d260b2ccf423a4896eb31687d07321fe2f9617f18e29cb5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207307, "uuid": "3ab56064-edc4-4256-9dda-54743f5dca4f", "comment": "Malware payload (AgentTesla)", "value": "7b9f902c11d1d79403779438f04c164a352cf26b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207307, "uuid": "d635484d-5c14-42df-a2e8-48f1fe000097", "comment": "Malware payload (AgentTesla)", "value": "c48ac7588325b0dde0efd8deddb64aa198987d28f5191ae3f02f31615a73576d1de154f7ce9bbe76508272227d7eb9db", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207307, "uuid": "72e55f01-7f7c-4d86-b7d6-a29c6195d2c1", "value": "D1E42351B7F1186E4F1DB26CF43701B1A29FB9C154FBB750B7A8DE66362804626218CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207307, "uuid": "aae6867e-a914-44d1-b520-7da9f2de0a4d", "value": "12288:Reb2P9ZPj7ieE5ilJ2ix1Z1HwefjqahXxs7Gi1ACPiDSltHDpbQWs/Y9NZ8:oq9ZHtj/QUlW7n1A9AtbQWseNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207307, "uuid": "f4449a52-cf13-40f6-8da2-ed5b25926c36", "value": 716289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207307, "uuid": "8261d7d3-ef6e-42c3-9a94-7dd2174773f5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207307, "uuid": "e47dc739-be99-4ff8-acba-9c8b29546d2c", "value": "Scan354673.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810bb073-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207280, "uuid": "553bf861-8826-400e-85b0-56833b25202d", "comment": "Malware payload", "value": "70161f030be39d834c9837ab54642fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207280, "uuid": "637569c3-b99c-458a-a822-6a2b8c4cf045", "comment": "Malware payload", "value": "742b95fe3807f502f53c2440f07e54314f771938b15511c6c56867bd59dab889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207280, "uuid": "0753109e-d74f-48eb-bf7b-07aa23af2468", "comment": "Malware payload", "value": "4553e1bd90269709f422cb72fa7b4be9c84c5c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207280, "uuid": "797479b6-8b7c-495b-93f7-a8eeb7253920", "comment": "Malware payload", "value": "e40db624acc26e7c580e2a84028ad584d3e2cf7bd920f35ef266da4e42fddf23bc3c0a795c58750084a9533dd417f09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207280, "uuid": "33bc6137-710d-48cc-b933-be36ec5c2f9f", "value": "EFD4230B5A25F217F7C97932FF8AE0E50372B1D3AD3B86444881C66EC1D631E6582BD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207280, "uuid": "1288382b-6bf0-4470-b41e-743b5870be44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207280, "uuid": "7648c154-a74b-40fc-9f23-b2ca219944ce", "value": "12288:Yrq/C/4goNmPaLm5HwUarPfxboEp3wckEcgMuwS2T8Xo2i10OlS:aRQgoNmCLpUa9bCcLxFWgXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207280, "uuid": "ddc714fd-3cdf-44a7-859d-9b0f2c1fdeb4", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207280, "uuid": "1fbf8a83-a605-41d0-8efc-e56a57c31197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207280, "uuid": "474cd48f-9348-4898-b2b1-f039064b1f8d", "value": "po-584350 C622-P9268 MAH5453 - Aqaba up to Umm Qasr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfead0a3-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618225049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225049, "uuid": "08deb8cd-ca50-472c-ae58-6313e1cccb22", "comment": "Malware payload (NanoCore)", "value": "6a647fd057fd6a0b85c644d928125eb4", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225049, "uuid": "380f3de3-05d2-4956-983a-9a711b1a47cf", "comment": "Malware payload (NanoCore)", "value": "74e0f799a11a134c003bdfc626d453e74c92903d0640c8e1c801a78fe715a095", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225049, "uuid": "f1379c50-9a81-4d30-a044-e9a2cde17023", "comment": "Malware payload (NanoCore)", "value": "0876b0bd85b3fea743370b8a7793102dd9328bbb", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225049, "uuid": "3359e036-2c89-43bd-8c97-908e8f54ab4d", "comment": "Malware payload (NanoCore)", "value": "6e443ff1cd61a5776695e54bd6f3f78f0e25cbb307e4b9760a3d531fd429e3847d84ba99a6da6b3df931a3ab1f4a727b", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225049, "uuid": "05608f8b-f490-4030-9353-4df869b6ce32", "value": "BFF48BC48E8AB81ED46E7374705091FCD3A36D2215DEA3E757DBFCDA9B6328045922C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225049, "uuid": "86eb87c5-716c-4a97-a7fe-6a2322bb3df0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225049, "uuid": "ef229fc8-8e91-4104-97fe-01867d1f5408", "value": "12288:I4enekLl7hRNLPXlf/BfykeiLmtlzwrbsybFVxXo7Ko7ICfLcA:QFNLPXLxjLm7KoOVxXBjCfLcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225049, "uuid": "3adca546-18ab-448f-b156-d372ee175880", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225049, "uuid": "98c2cca7-7df9-4c1b-a113-b744c3b39da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225049, "uuid": "08bc127d-960f-47f8-a991-3cd36a527ef3", "value": "SecuriteInfo.com.Trojan.PackedNET.645.23105.6482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec5c861-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230201, "uuid": "071fb708-1154-4a8f-8cb5-cdc54178c6d7", "comment": "Malware payload (Formbook)", "value": "1be33bb40bcce05b5918bfc91ab93ada", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230201, "uuid": "7297c733-7da2-47d6-bb6a-9c2469cc16bb", "comment": "Malware payload (Formbook)", "value": "75ac4abf4dd4f869a600ac69f6976e0171a5247d5f2f5400d3c0e727e5b3dcdf", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230201, "uuid": "37d39a1d-9b52-4071-9563-7beee0f78ab2", "comment": "Malware payload (Formbook)", "value": "2867fe9eb5273d5cac2315a6ec84915369500d75", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230201, "uuid": "e00dc47f-15e5-4529-bf0a-9d31d6805b18", "comment": "Malware payload (Formbook)", "value": "b9b822e19ba76d4fa9d3be360b365f7b9b582738531703c05f9dcbfde7a796a98d6cf95dd2b9e481f77e3803e7d6cd8a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230201, "uuid": "86599c9c-c762-43e1-b435-a3b305e97dc4", "value": "A2542393F13062BE9CB34877823CD066710795A3C8EA35B652249E727D1C988BA4D7FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230201, "uuid": "b331305c-aaa7-4446-ac84-06086bb94b92", "value": "6144:nhi5CM97Pj+1QTXBvhdqpUC9R7awjHp5/tNSV6:nh6CM9mQTXC99/HFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230201, "uuid": "90514036-048f-434e-9da0-1b8a4370e485", "value": 299901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230201, "uuid": "2552b548-7aeb-4c89-9306-5862d1e3b17c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230201, "uuid": "50242bb4-bfb0-4119-9b08-0edca6a855e3", "value": "Design Template.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be36d1ef-9b96-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618235730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235730, "uuid": "19eb434a-985d-4ba1-9839-dc22b3b7aa75", "comment": "Malware payload (Vjw0rm)", "value": "887c7cc66e5668c8dfa5f98382acf472", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235730, "uuid": "b69019f2-0882-46a2-b7a2-b95d7c42f916", "comment": "Malware payload (Vjw0rm)", "value": "76a30f05824526a3acc0d7c15b4cbc7f570bf4d6e5082e97c0fdff272da90fe0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235730, "uuid": "b5d5072b-6eb8-4b81-b379-c15b1e05f0ee", "comment": "Malware payload (Vjw0rm)", "value": "11343a21d8ab9835aa03954014bec385851930a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235730, "uuid": "ea0c2728-fb52-4cc4-9380-2d21de2f9f9b", "comment": "Malware payload (Vjw0rm)", "value": "06199b68d63871d139787b16cac8c3a930fda03d677967d9155fc05fa6e5638da285ce9a47814c63031a5c1c28dfe6c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235730, "uuid": "10dd9368-d22a-4a5c-8172-a3202a996c82", "value": "F981209C285B823C57D67B8A802ED548CDF548B47F28D2B2148CDAC5360ED7987B29BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235730, "uuid": "437da576-7d0b-49e9-bb36-87350b0c58a7", "value": "96:SABNo5Dxk2c24ZRMHXE6/BIp+Ys+fJVDdQqR7bJyKhvOS4UK:zS62c24ZRMlBI8Ys+fJhfRfAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235730, "uuid": "f5e9a8db-19f4-4db4-9356-37a106a3fa9b", "value": 3878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235730, "uuid": "336c2ab2-6ab6-4be7-a43c-1292de94603e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235730, "uuid": "cd326d35-87ef-47c2-b1b1-add664b89620", "value": "Invoice#2304.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e2d0b8-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618230032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230032, "uuid": "91b1099d-cc6b-4f1b-aa95-dba498fbaa11", "comment": "Malware payload (AgentTesla)", "value": "c57d42e9881e7695db94603392e4ac55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230032, "uuid": "f094fbcf-a8f9-4688-9a07-4bf80ed42a20", "comment": "Malware payload (AgentTesla)", "value": "76becc161d40feb065198bee796049db8eae386be9faa1c3998c8ffd545695aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230032, "uuid": "6ef38843-08a0-47c1-8811-a60b8b791384", "comment": "Malware payload (AgentTesla)", "value": "c36e6756d1893deab470b16a1354bd35a5c19ac8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230032, "uuid": "20bcdfcf-cd2f-4f68-ba62-956d31461887", "comment": "Malware payload (AgentTesla)", "value": "372c5c851d847536fff8086eb34a6167883561cdabe6c28e2ed0db57b9e679be6a7739f660c5a474d0bc47139a3066e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230032, "uuid": "e3589d21-a1c5-4f9c-bc63-15d99a034cbe", "value": "1AB533A63CD5DF4BD99705B6800EE1650961EEE4BD18A807332E3B327032E6922D7F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230032, "uuid": "2e693201-654e-4b53-bc37-42f82e515f73", "value": "49152:AZjCcXPeY0Bnimzm8P/NUunNhTstbtp9cWfjA6K3t8N3s:A3PeaerPmunNhTsPbCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230032, "uuid": "d482d1f9-999e-47b4-bf7a-6e82b1df4800", "value": 2425344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230032, "uuid": "01520101-4c95-43ae-bbc1-b11fef714595", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230032, "uuid": "9dfcd95d-8716-4697-887a-0f9090fc0d3d", "value": "Customer ID 2199201992001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3547539-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1618207445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207445, "uuid": "b5990346-221f-4d4b-bec1-0c3e93ac31e8", "comment": "Malware payload (BitRAT)", "value": "f01074e44ea85a89f62de30c25eb32be", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207445, "uuid": "45763918-4f0a-43ec-b0e1-8c4efe56ed56", "comment": "Malware payload (BitRAT)", "value": "76c866501ffb3ed58214ba7949ddc13202e6c9e423c43e6ff690e548750386e7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207445, "uuid": "b0aaca10-6f23-45e9-9ab8-960797b8794a", "comment": "Malware payload (BitRAT)", "value": "12fa5d7f899ee16ef3fe2db14c905cc09d605265", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207445, "uuid": "d05cb915-19c2-4717-9e95-3860511dc569", "comment": "Malware payload (BitRAT)", "value": "bb71da7a58d8f1521c13e6471f54d9506015c9dcea1b2a82644a99570f6a04ea4a80f1c0ad5ba4346fdf888865d6b176", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207445, "uuid": "e4cad816-3cd2-4144-bdf5-79812b70433c", "value": "EFA533543D6635B850B426792E46D24F8EBF99FF2A67806CDD2C040379FC29264E8CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207445, "uuid": "abbe9e32-83b5-411d-bb1f-ddbe06f6ce6d", "value": "49152:+PReeJy+ELikPqeYaK9JzaR/75us/3sX0Y97brCHCCaSmv3:+55qiBe+DMj5p/a9z+jmv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207445, "uuid": "91d1de76-13f6-4b95-b5ec-48fa3466b9a1", "value": 2249542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207445, "uuid": "f36c6505-e2ca-44d4-b7fd-13ddf8f01cbf", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207445, "uuid": "78512df8-882a-413d-8e68-02b2303127f7", "value": "RequestORDERQuote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1679db87-9b96-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235448, "uuid": "c5b7b748-4784-4d1a-9e99-2a4df06a620b", "comment": "Malware payload (AgentTesla)", "value": "b608923179c6189c1f648a8f99ad0f8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235448, "uuid": "b89421e9-fe16-4337-8f47-5f0a1d79f814", "comment": "Malware payload (AgentTesla)", "value": "7767a5a77ea267c3b5886403d6a148437c0ea9e73ba84ff1a047ec17a716f577", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235448, "uuid": "c91406a0-577b-4079-9b96-e5a324d64548", "comment": "Malware payload (AgentTesla)", "value": "1eec768119658a93990944a9dc95ec09876d94cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235448, "uuid": "16862db4-0031-468d-bd9f-319d028a5083", "comment": "Malware payload (AgentTesla)", "value": "38d38c2a1a66b692a7c61d25bf0a7ee7777036f23e819a8f448b2633838182222ce94b747e61f85326a6ea0bd3e74c1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235448, "uuid": "2c89cd3d-1a12-435f-b75b-c3007f3e6c40", "value": "04E4F111779ACB42C83687FA5422950347B9F1DE7827DF6C0D8052D6306AB0D8EEAED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235448, "uuid": "e8f75caa-9a1d-4ff9-bb8b-43f625a7bed7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235448, "uuid": "460e078b-c51f-4f77-a014-53b3acb751a9", "value": "12288:+KJPLhJ8R3Cn9BeAHIFOMAU9nIalOTAba5M44QwuvWhuKly0:XJPLM3e7P6pIaAA2M44Qw9u+y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235448, "uuid": "0c66bf13-ed58-40bb-8134-2ab40e074b5e", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235448, "uuid": "08dd61b2-13b0-47d2-8bd8-ff9e169e062c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235448, "uuid": "ff8becbd-9b06-4da1-b251-502fe62ca7bf", "value": "210105 SA20003 Order Details Update.pdf210105 SA20003 Order Details Not Shipped.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718af284-9be8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618270820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270820, "uuid": "90d0165a-0c5c-4feb-a125-648ca306b5a9", "comment": "Malware payload", "value": "a16012041fbe6c3545acc400fa934f3d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270820, "uuid": "5d98dd6e-5a08-44fe-a503-0fa4b64092a6", "comment": "Malware payload", "value": "77c88222a44c9c1c04c1198da8803e2238062f8a4624768e96ff03e9608921e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270820, "uuid": "be7fcc71-3385-4fcf-be00-e97b298af4cc", "comment": "Malware payload", "value": "d287319ff8781e399489b083ad69152db87b78fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270820, "uuid": "7c51e1cf-6942-40fb-a0f4-02c22f84f8d9", "comment": "Malware payload", "value": "4f3454f4b41be855f1064e187dd5e08bd74fdc64a926b3671e8c287905cbc0b6fc3d7ab2b9a825ec96524ff9d0d146e5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618270820, "uuid": "58d544ac-0f2e-4079-804b-a499c7e0fecb", "value": "4E538016B757C9A3D1596A358EE2D6CB3331BC22BD81930F318A332F2E379509E42B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618270820, "uuid": "16f9a508-fd5f-4c61-a7c0-e1de87ab9fd6", "value": "384:t9wmDkQdELAcwIpXrLvjAls0I3xuw1rR:TAtnpXrLv0ls7Buw1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618270820, "uuid": "850e4c18-e6d3-4ee5-a9a2-ecd42b6a3c28", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618270820, "uuid": "db3d6c5d-94f4-41ca-9358-b23e0062552e", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618270820, "uuid": "dc96478f-e012-4f55-a025-0177e6cc46a8", "value": "SecuriteInfo.com.Trojan.GenericKD.46081702.29616.14492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e3003b-9ba4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618241731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241731, "uuid": "a6af3386-8c0a-4ea0-8618-542795a7e6da", "comment": "Malware payload", "value": "0207e4254b46d82f5d49c55d95ffdb4e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241731, "uuid": "a803f747-d420-4086-a2bc-06399fed2f5a", "comment": "Malware payload", "value": "78c19d6d762153062701aa73ce9e82f93ebb8382eea22291255f79c76ea831f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241731, "uuid": "b8e5a065-efa7-4fe4-ae32-23824558bdf0", "comment": "Malware payload", "value": "52f15e00cecfb20a0f50d427319b7e5f6684b87f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241731, "uuid": "6bc1b97c-39ae-482c-acdf-6edcf8c06726", "comment": "Malware payload", "value": "2557f8ef386c65538c01cb69ce62ad99f3177864e04589bb261785d62deed2ff95facd1df19e517e25000db18e87bc6b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241731, "uuid": "eb165073-a3e2-4e94-a0b3-3b2a5b8fe7f1", "value": "39C4339C87D6DE00FBE2D579AB21530D495260C6372C934A9006F5CBEB21AC11AFB7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241731, "uuid": "36303929-5493-4c7b-a252-1391f386032f", "value": "12288:q+vA9C71B8zNwc4/X4P7FpQTFRDYQmA+7CLWxQVQK4ePFBVRI/6ok474G1TSR:jBB8zNw7XYppu/7tLEyQK4ePFa/D8m+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618241731, "uuid": "c8776179-869c-4471-a372-dd3c44b71303", "value": 586744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618241731, "uuid": "7bc5fb8b-033c-4835-888f-3ef70dd929d4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241731, "uuid": "a6e443a3-0cd4-490b-a64c-57fdb6f24aeb", "value": "URGENT RFQ ZAD 8488721 MA CLOSING DATE 12 APRIL 2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097cd774-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207939, "uuid": "be32c963-9f88-45b6-8faf-1513dde20dce", "comment": "Malware payload", "value": "b75196ccea3a4ed66a87e7a98595b27f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207939, "uuid": "84384823-76c8-4a76-9f65-9d19fce2aaf2", "comment": "Malware payload", "value": "7a15a21c229fd3f9a2a18f2bb13bf2845a76a3822914c751174b1aa98303b8e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207939, "uuid": "029dc2dd-15c5-490d-810d-23033c9f2088", "comment": "Malware payload", "value": "db65efb2c2f426165479a6b9f70700d61f56b6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207939, "uuid": "d3f7d0e3-5022-45e6-b079-d66758c26486", "comment": "Malware payload", "value": "ec0e497afdcf212fb3396307407ac426d581e666f1f04c4a300e7611394bd16ee44c2f28beca6b098a6d9fc415524179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207939, "uuid": "92a34d69-d06b-41aa-94ef-94a34e230da1", "value": "43459FD1F1508CDAED6B09F1AD2BA53024D7BE9C94A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207939, "uuid": "d45f73e6-9487-4b9c-85b4-e9d2a1be83a8", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207939, "uuid": "c0837cf0-5428-403a-8a53-90013b2e09cf", "value": "24576:Du4es4Ep+uj0/XkFi56awoZlrAHuKTp3QQxWrRs+:DuPsUXkFikawNfuRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207939, "uuid": "e7287e24-72c6-460a-98f4-841551a1a42a", "value": 1191917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207939, "uuid": "4bf87b79-34e4-4c10-91f7-f37043087c3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207939, "uuid": "65c43745-373b-44ea-a8e6-0666aec17771", "value": "00000998880.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd06fe4-9b62-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618213392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213392, "uuid": "84f8890f-25e3-4f1f-ac36-792ea7d9a779", "comment": "Malware payload", "value": "fa157956ddbab95420acb8da46eac6a4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213392, "uuid": "1b1c6296-050e-4a9a-a1f5-7350559df249", "comment": "Malware payload", "value": "7b4dd1f8ad728126f05c9abf07ad34daf3ff31307f90a8b57cd2cae3c220d4de", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213392, "uuid": "b280f1a0-a08d-4665-b26f-2e63e1bea1a2", "comment": "Malware payload", "value": "8b56a35774bdad8a78f998910c5e7969ed5cbae9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213392, "uuid": "2060318a-af0e-4171-807a-149e9d0d1344", "comment": "Malware payload", "value": "6699c081ba8f446377eec83120897e47cf78c2e062d11d619e612e035b3e5d6ec38e648c3b0e4c7037c3376d8144e9ed", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213392, "uuid": "e99ae174-cf92-43fb-9754-914530ad8301", "value": "28A483ACC09747EC8FCDB7B46A1A1E891208776DE385F5533638A7B52B93C7A9007874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213392, "uuid": "2649c42c-8f1d-4ba4-82ef-bdf1d649c424", "value": "6144:R0uM8rPGMA/ocUdgtZL4E9c7IG/GGUVjgDcW5DzvWpaCh5DQ3:RbNPGFocUOZcE9c7V8g1BzvWcCDc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618213392, "uuid": "409eee70-83b1-4f97-94f6-3ea8d91a10fb", "value": 460122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618213392, "uuid": "a65d4ed3-2038-4ca0-b466-c05e92af896f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213392, "uuid": "861fc962-99d8-4899-bf17-c3b9197821ca", "value": "Payment Slip.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940dc73f-9bbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618252839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252839, "uuid": "7b8dfadd-731c-4abc-bca4-78d986f1b440", "comment": "Malware payload (Dridex)", "value": "27d79d4b9144348a9c1d6053e86ab5f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252839, "uuid": "a2fadff7-a36b-4c09-9f5a-8ccbbfe152f3", "comment": "Malware payload (Dridex)", "value": "7b8e5d18e8c1334b2a88127c6d7dbfa576ff17528f9c5a5f6d8b433de6fcd249", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252839, "uuid": "7947a19f-1e34-419b-8845-605928c6f3d1", "comment": "Malware payload (Dridex)", "value": "11e48f59ed4eca16ce84b74a7eb566023be8305e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252839, "uuid": "383ea7ac-e808-4ec4-a625-eda642b6be73", "comment": "Malware payload (Dridex)", "value": "5e1c2dcb29d57ceeb1e8b552d18d622a363440bde498161490afb8860c18431c1bba1769bc3371836b2f02fdeb519091", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252839, "uuid": "f2184f33-b56b-40d6-9eaf-9ee7a63ee767", "value": "DBF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252839, "uuid": "ec1987de-207c-46b1-be29-04754a2ef307", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252839, "uuid": "ab28be6e-8566-4cf9-ab9f-60ea13b1e44b", "value": "3072:flpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:flo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618252839, "uuid": "5246b847-592e-4503-b4e1-3447c9596cb3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618252839, "uuid": "fad27cef-35b9-434b-8233-3d79d9979fa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252839, "uuid": "6eb7eb0e-8c6c-4e4b-be2b-865924c1de49", "value": "27d79d4b9144348a9c1d6053e86ab5f5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc353ca-9b71-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618219943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219943, "uuid": "938b82d4-3dc3-494b-8c6f-1d1b384f5390", "comment": "Malware payload (AgentTesla)", "value": "e983ab7eb29a75040eec04e8c9fecee6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219943, "uuid": "f3095a74-774e-4277-aead-179891befb7e", "comment": "Malware payload (AgentTesla)", "value": "7de59cf08a83691dba74cb146cb953a496ed8b3bb76359a1a780939592a2b221", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219943, "uuid": "8fbfccb7-7d5d-49b9-bf26-009228743364", "comment": "Malware payload (AgentTesla)", "value": "83d3c02ed806484ecf2490595ec0384d128f3a3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219943, "uuid": "e70219a0-fa36-4d43-bc1c-035ccb8e219a", "comment": "Malware payload (AgentTesla)", "value": "cadbad8d3fcf132ca49164a2e5d2f62145653ece0383c5bd2ac9c6ead726198926fcf1025750ed10e4c78f0bb172dd94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219943, "uuid": "b858e0c5-f497-4614-9bbc-8b7c6a82d57c", "value": "0AC4234EF61F1AFC6920588B6B7991DA9D0D2E77705224474D49C038ECDB32BB8E64F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219943, "uuid": "d2435a6c-bc79-4926-8008-8b44d394c84f", "value": "12288:BPIk9W4GdJ+VhOdVsVgYNv+tgpqi/GDS9yuqYa+:BjW4GdUVhOdWgYNv+mYp9St", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219943, "uuid": "f2023865-7fda-4c31-9985-6b0ce3b5492e", "value": 592882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219943, "uuid": "a4ba34e8-4b9d-4fe7-a01c-e5f00a6ae7a4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219943, "uuid": "8d286d7d-38ad-4c8b-abd5-0a082733708a", "value": "products & catalog.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a4f89e-9b5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618210826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210826, "uuid": "664efda3-038f-4e2f-8e3d-3a05c72e5bb8", "comment": "Malware payload (GuLoader)", "value": "758028b3f6c428890bf423f4bf61493f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210826, "uuid": "cc4e5cf3-f3f7-44f7-84d3-fd8333bcdd2d", "comment": "Malware payload (GuLoader)", "value": "7e2f0e6ba024408d3b889101de8ab48b3592b465e7a33c95c4fbcb5a4c912fb7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210826, "uuid": "6c09a911-6de2-4820-af71-f8d02dd5d0d1", "comment": "Malware payload (GuLoader)", "value": "f23458e2f4b1ec7b1b626892878fbc8a81bcc8d6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210826, "uuid": "efb69deb-25a8-4971-bf9c-82e01f5a8814", "comment": "Malware payload (GuLoader)", "value": "cd67fe642cfb913bbc78f5baaffdefe55eceb3b692394aaa54300f98cfc9dc518ec408635a1a002c7035fdbabc4c6e6d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210826, "uuid": "9ecec2e6-6a3c-41d0-a643-75de19b2efe3", "value": "61931913B550B6B1DA2CCBBD66798AB811577D30242CDA03E2C5231C3A79EC99F693C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210826, "uuid": "705da3ed-a8e7-41e1-bbb1-b4df02079b56", "value": "281390d21b787569ccc2303fd6dad5ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210826, "uuid": "834e748d-47d7-415c-8629-5f5c042b47a6", "value": "768:+M3sZY/kPxOwOJu9LydptAQe9Pjm1j+BDMlf4tgTQx5dauPDJO1SiSjwvJ:BsZY/kZOwhtydtehuj+BOfs5Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618210826, "uuid": "15490945-1871-4d1c-8eea-af3f4cf1de27", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618210826, "uuid": "563cd032-a85d-41f9-adfd-7ffc9c0cbf1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210826, "uuid": "35a922c2-aa6a-4b31-b0e5-a314d7210141", "value": "SWIFT Payment Advise 39 430-25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929cbc8e-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207310, "uuid": "b8de8444-b740-4e64-b537-73d5fb8cfad2", "comment": "Malware payload (AgentTesla)", "value": "7a9fa9dd646cb85d073f62dc35f430de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207310, "uuid": "0c638773-fe86-4ae1-8726-f27c8c99a49a", "comment": "Malware payload (AgentTesla)", "value": "7e67319f3f614373d956474c27a4a019c0057a2132a24c8b5197f15c2b0c5317", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207310, "uuid": "dc6243d0-40f6-48b5-8f81-a653f2b7f931", "comment": "Malware payload (AgentTesla)", "value": "f7250934ffcc52bd98002bddee20886d50dcefed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207310, "uuid": "1cbe4295-d5c7-45b4-ae2d-a0a77252205b", "comment": "Malware payload (AgentTesla)", "value": "c68e2ef4ecd4fd844156643972f9b16ce8c18f686335a2bce25d9c1453a07cff82096c11485daccc6d04d1730d14e71a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207310, "uuid": "13ed5fd0-5080-492d-a667-4a09bda897f8", "value": "2FF42205A3D4DF5AE1BE9B74A4325A0007F87187AB53E75E3DC970EDABA3B50CB01606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207310, "uuid": "36cb6f34-4e4c-4f49-bb0d-533a23f2f610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207310, "uuid": "211e8c7a-9ea1-4672-952e-644f9973739d", "value": "12288:3IcKcfhyuihVI8LdM8tWHSBJiWfUpZUdfafyhH0IQmZU5d7iFaNQcYr6KdFp8uXy:3IjcfhyphhdgHSqooyhHj8WFUQuQX+pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207310, "uuid": "6dbfadd3-d353-4c31-a9a2-d1ba38531cfe", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207310, "uuid": "52d92d96-4963-4973-82dc-59f385d01b18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207310, "uuid": "f600bf1e-4a21-41fd-b892-aea72e3c581f", "value": "Scan354673.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd828c-9b64-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618214202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214202, "uuid": "40c3a288-7b8b-437a-8486-0975e341598b", "comment": "Malware payload (AgentTesla)", "value": "0d94159e76c44c8d53105c7c3d7dd0e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214202, "uuid": "a8110a70-59d0-4be1-b2c1-bafdc03fa4b8", "comment": "Malware payload (AgentTesla)", "value": "7f398111d7034c7e61fb51ebeac125db6945903f27d90ffa68a8916e183f81a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214202, "uuid": "2343084d-13c0-4247-a789-81b70b5a0d6a", "comment": "Malware payload (AgentTesla)", "value": "e4e8172d915c285a5a28e6a811d21ac66361d87d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214202, "uuid": "687f15af-29cf-4f63-ae53-653459a50ef6", "comment": "Malware payload (AgentTesla)", "value": "681f28f4f5a230b05db44a1ef1c70ae3e9064e5b06827c03e6dff42aa40148352f5d851c129eb19502ba9e21b9b185ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214202, "uuid": "ce6561b1-e7b4-49d3-a1a0-5d88732b2c4d", "value": "9FD42306B896447452F7FDB9225857F98631123FB3227EF4DCB9A1D4DC4338868B60BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214202, "uuid": "5c1ab40a-c659-4b1d-a660-f54a6a31ca6f", "value": "12288:YfKINw+9vsn+alW3/Sfi1+MXoHvPm7AAFuK6irWJQKZZSor6d:Yu+a9sPpoHW7ZcK6YWJ9Zk3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214202, "uuid": "f7d6c36e-27f1-40ea-919a-44e3b3d97443", "value": 607568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214202, "uuid": "b91458a9-23c6-4e9f-820c-6fbd945f1689", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214202, "uuid": "97eaf344-9ab8-4a34-843d-d59d234cf73c", "value": "PAYMENT CONFIRMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4f1f13-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207863, "uuid": "4be87aab-ea1c-406d-a351-98c5293940c3", "comment": "Malware payload (SnakeKeylogger)", "value": "3e510d86f19fbd82ddbe5e6cb125ff2c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207863, "uuid": "74ca8228-d272-4e49-8429-ff4415af8389", "comment": "Malware payload (SnakeKeylogger)", "value": "7fd973c399216902a5e2ebf1cc467a2bf0a1e5a8931f03c3f9cd3c188c5aaf94", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207863, "uuid": "e1fc266a-97ee-4885-9b19-cf3eaa84ca6b", "comment": "Malware payload (SnakeKeylogger)", "value": "b3acc51f6c5fae22d542f310b5c58bf9d1b6e351", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207863, "uuid": "0ea37c93-133d-42b9-9b02-dce6b177b43c", "comment": "Malware payload (SnakeKeylogger)", "value": "aea736481ad3980ba97f59efb4fce88558ecf7e8a9e0991f88eef79cc3308d23e55e333d2e64f6b1b742ddb0aa2e09ac", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207863, "uuid": "6f39767b-842a-4715-a501-6407d49ffb1a", "value": "DC55BD5CA6BCBEC5D82407B6F032850213A1F2CA642FDF58D998628D152B74FBCE8D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207863, "uuid": "659de727-647d-48af-9880-b6bf64e4d609", "value": "12288:+lhvA8PNSHaEibT9CyqjrC1pJgsM0xEsmm1h3Q3DsEW3sLJG72W41gZItPvaaaoL:+lhRJJCy4ObgsMy6m1h3TEW3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207863, "uuid": "850d35e4-1277-4d33-b5ab-4445857906a5", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207863, "uuid": "5ba69d1c-aff7-4026-9ef6-1ac0b2a8c0b0", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207863, "uuid": "8171b0c6-14ff-4b61-ba90-3cf84909d706", "value": "RFQ No A4762GHTECHNICAL DETAILS.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff925d5-9bcd-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618259328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618259328, "uuid": "2455d306-99ec-4f73-bb5e-f75da49c6d6d", "comment": "Malware payload (Quakbot)", "value": "6bddbc2adb3ba1c00f82a27bf6a1a984", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618259328, "uuid": "1bdc33c3-b315-4f9a-9b4e-1a0d0045e239", "comment": "Malware payload (Quakbot)", "value": "80cfabe6a394c7737a22d5ea72c604fb65fb6b66e979e848d07507343fbdb705", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618259328, "uuid": "4b32c1d0-8b31-439c-8714-0a6db52a8210", "comment": "Malware payload (Quakbot)", "value": "06a5ac5269665d1a9faa1f1ef726a1a3a5d1529f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618259328, "uuid": "1dde25a0-068c-4d86-a49b-9cb0aa854b2a", "comment": "Malware payload (Quakbot)", "value": "854bd35e59800aa5f61aab3f2bf16ed99d0b8fb62f4ab98085a556507375de73d8dcfcbf67d9fc852cb6d2fa3448212f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618259328, "uuid": "e1828533-d82a-4a1d-bfda-822222086448", "value": "E0657C31B1D2C437D4732A7C9D7AA29D942A7D511E28985B7AE40F4CCF3A6803E2D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618259328, "uuid": "5fd62996-abe3-4546-baab-5fbdc5fcde5f", "value": "413398ffac649594b2b53c025e6614ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618259328, "uuid": "628a45b0-5962-44a8-9ffd-ec32f9f44370", "value": "24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGGw5:sbeeGRuPPuzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618259328, "uuid": "01dbb38c-2d98-4ab8-b18e-a1a429246e30", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618259328, "uuid": "c1692f87-41dd-43da-a929-8264e032b2f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618259328, "uuid": "ec3749f0-e33f-42f5-9417-972e5abeed53", "value": "442855327891204.dat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7725a36a-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618208123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208123, "uuid": "cdb70137-0168-4dd6-99a6-e4cdd2e507fb", "comment": "Malware payload (AgentTesla)", "value": "f179d14808fd5db287e3e9853b128e9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208123, "uuid": "d5395c59-3611-469b-957c-bbba35a3537d", "comment": "Malware payload (AgentTesla)", "value": "820e8f3bd8516106fbfe14e5788964d2ff7d0d33331e87a885f1a3cd3eed944b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208123, "uuid": "fad0f656-9031-4793-894c-be5bfb238df4", "comment": "Malware payload (AgentTesla)", "value": "58dd8843ccd28e083702b5e752eb59a79ca67b62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208123, "uuid": "7ca81291-83ae-4ed0-83bc-dd01248da355", "comment": "Malware payload (AgentTesla)", "value": "ec6c53d5eb6f6d7ae35031098cffa654f1804e7bf93b656febada5bb32a5384511dce3d16a16768bbeeaee86f39e4f10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208123, "uuid": "ba87b285-031e-40e6-b3e7-8eb691e5d958", "value": "6B94239E10736BE637F24F0B38204AE78715FB0A2CFAC0998469EF0B5AD444764793D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208123, "uuid": "43a3e7bf-2256-46e8-a4e2-2310cc2fde85", "value": "6144:LLdrq9C9x3A36swKGFZxRoz8UwI5H3/ai/js90isNdi6OzTdNPZ0XzlitCT2eWxM:LLdrqkk3vq/OgS9/auEsNdi6yPEikTOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208123, "uuid": "9d12e4d6-1336-4ff6-86df-658e1d98bdf2", "value": 423514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208123, "uuid": "d74e842d-23a0-4c1a-85e4-191491256046", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208123, "uuid": "15172a05-1e01-4677-897e-38e7704e6f04", "value": "QUOTATIONQQO2103060_Hangzhou_Zhongniu_Import_Export_Co.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1b516e-9b75-11eb-abe1-42010a9c0039", "comment": "Malware payload (DanaBot)", "timestamp": 1618221340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221340, "uuid": "a48a3c03-153b-43b0-b66c-7cd0528c97d7", "comment": "Malware payload (DanaBot)", "value": "aff6f8c7521796d3bc8fc1059dbe2409", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221340, "uuid": "7c652ad5-d97f-4687-bc08-f18b0bce99f8", "comment": "Malware payload (DanaBot)", "value": "826d2e8f10f6991f25dae46522fb53d041a4d740c4ae0a8b570c41c099e9e31f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221340, "uuid": "5933bbea-f77e-4235-9cf1-a2ac23b1d577", "comment": "Malware payload (DanaBot)", "value": "eaa8368b259beb696d45ba1a69b75bc0d99c8bc9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221340, "uuid": "114d532d-2c6d-4bd2-9996-ffcf2375b7a4", "comment": "Malware payload (DanaBot)", "value": "3a37824da34ab0e58407118e21550120f769e28a5bbbbcfc40e9152fb4c77a0643571e86e568968020809b3bcc8469ad", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221340, "uuid": "b63b91a2-4790-44a9-ac52-932d92dc21b8", "value": "2F4522CC3BE4C067DEA4D9BE48F59A164AB16830DE49C4466F006FAA60B1EDDED14F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221340, "uuid": "1e764f92-cdb3-4308-9d7f-448a74b79c1a", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221340, "uuid": "618f63e2-225e-49b8-b814-3b0142b0bf2c", "value": "12288:40gbfdhi0JFnqgMTCVAJGstzWentOPwCKIdNyt58e44H4EQXcgZAf7qrBWVt80z/:DC1hVnq3xJN/tLCH28e440p50f83y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221340, "uuid": "b2bff19f-1a1e-45e8-922b-82c62a7a3a90", "value": 1257147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221340, "uuid": "9eb57767-3bd2-409f-9089-c210fbaee375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221340, "uuid": "596ea8a9-eef4-4d2c-a355-f211d91bbc68", "value": "SecuriteInfo.com.ArtemisAFF6F8C75217.6228.28683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddca7ea9-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618253392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253392, "uuid": "7433e1d7-bf02-4ced-b77d-d0717b629e82", "comment": "Malware payload (RaccoonStealer)", "value": "bf9b680dc5b3b65fd7f47a04dbc21843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253392, "uuid": "5076d53b-d6c3-48ae-8172-9e2492e7c714", "comment": "Malware payload (RaccoonStealer)", "value": "82bd63a7a749e86241fb9113bf40fd27d9a3db36c9971ee14ff54825fa631ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253392, "uuid": "1b97da27-8e7b-4d56-bdc1-e5e4240a0077", "comment": "Malware payload (RaccoonStealer)", "value": "be344b681644eaff29adfb0a16fc989d66b509ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253392, "uuid": "130dfc39-ffd8-445b-9c4e-75445d879abd", "comment": "Malware payload (RaccoonStealer)", "value": "1ee3f009f0450adf8b9dbfcf29c73939e8e402870a06ae5f4d912e299c2818280702c8baf62788f6361cdc4b34dbf4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253392, "uuid": "7ec2b224-4516-49c7-8f26-74aed73d3395", "value": "4AC4F11073D0C033C45225758429DBB58EBF7471667A6D8FBBC80BBD2F656E1B22A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253392, "uuid": "0e0aff2e-4156-4c94-aee0-aa339936c85c", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253392, "uuid": "272a763c-d46d-47af-99b7-090dc8347a7b", "value": "12288:+QEdD6okeYkljB2QlCF+BsmGR9Nki/m7uyyvaikmLdvCHD:+XYwjXCYBsxk7yaikkvCHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253392, "uuid": "c2a8c070-6ead-4b7c-ad1f-9e39ffd7f69d", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253392, "uuid": "5c2cf82a-3bf8-48bf-aaa3-b37b3129dadb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253392, "uuid": "8996c844-4a5a-4053-a8aa-c954d4eac202", "value": "bf9b680dc5b3b65fd7f47a04dbc21843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee5236b-9bb2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618247784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247784, "uuid": "111ec2db-9d44-4111-a336-f3975d8f60b6", "comment": "Malware payload", "value": "79ffbad6c06a00985863c0704314f2e4", "object_relation": "md5", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247784, "uuid": "6e45b838-8e67-4934-a63c-7cf0ea967ca4", "comment": "Malware payload", "value": "832fdfce435553143a0e5bd1a9711c7419c6d47aa7d76b8d85ac9b889b79a030", "object_relation": "sha256", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247784, "uuid": "010f1464-a334-4ffd-b0ef-0575d6ae7799", "comment": "Malware payload", "value": "76f0ec4f707c3dfe34e7484bb29cc563e5ec86e6", "object_relation": "sha1", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247784, "uuid": "24c758ff-e919-4d26-b9be-da23c8da994a", "comment": "Malware payload", "value": "d97a13f5152c41cffcb3884f30315afb02f3a120c4011a5d2e8c1ae1a5fb4954048b6ebb4f8dca64a633e39cd8e46a60", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellXMRIGDropper", "colour": "#AD764F", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247784, "uuid": "1614a5bd-346c-4805-a148-5ae942be07a5", "value": "9031E262D9E2056A4361D9E0B7D531F9E126C105FC21C701EA61B93420CE867A33FBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247784, "uuid": "9a3de2ce-803e-40f8-a2aa-adf45eaf4e52", "value": "48:0+8OfgjIKgMVIKlSCISCDSCnSCdBunu+SCk8SCCSCgTI+yBVm+4iQXbH:f82gjI3MVIPGZ1akuTryvNJXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618247784, "uuid": "f89dcdc7-3527-42ea-8b1e-fc0773567fa4", "value": 1826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618247784, "uuid": "56de76c3-fcce-4d11-9d67-ddacf45782c0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247784, "uuid": "8a55c48c-e312-4519-856c-cbbfcb451015", "value": "AxQdjYx8.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f7f345-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207616, "uuid": "bb3494fc-5967-478c-b923-c72a8ff2cf63", "comment": "Malware payload (AgentTesla)", "value": "c96b1f4dc1a2a841743b670d775c9466", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207616, "uuid": "71c927d5-6f7d-46da-a87b-3287d6c0ac0e", "comment": "Malware payload (AgentTesla)", "value": "83c0e817f62582a3e6aa5f20d6cb6738588f8bd7a3d076f6d174ac1b10bbe8c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207616, "uuid": "bd6764e9-2739-4f50-88ed-3c221217487f", "comment": "Malware payload (AgentTesla)", "value": "81ca2259f3933734542cbcb4d5393d4878f41a66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207616, "uuid": "28346286-869d-4be9-8ceb-0a823e0ed65b", "comment": "Malware payload (AgentTesla)", "value": "b7a2e580ac15cf6144265fc9061038508fcf44b8b419c2856bc26122f9687eb8d0248ba74f20e9de4569e3a7547358e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207616, "uuid": "42696753-5e9e-4b30-a29b-0b0ff51933bd", "value": "D6E4CF3F37805A59C9280E77851B44C023E4CCABE634F21EBDCA37D54FB165A5E2E626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207616, "uuid": "72370444-6ef9-4ed9-8fd6-5d4a31f1904b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207616, "uuid": "b098fccc-fb04-43ae-868e-b2c547be7841", "value": "12288:o9zqqB3PQhPp5owSPdoR1vieIDmZKmaxGMVLurd:o9zqIgfoxUvijmMmarVLurd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207616, "uuid": "4022bca6-95b4-40aa-9fc9-8cabd858f925", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207616, "uuid": "e7c07a41-b24a-4994-85c5-7e264903dcfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207616, "uuid": "c2ecd033-413f-45b4-9b3f-f799c47c6a0f", "value": "NEWQUOTATIONs#280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1748c30-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207469, "uuid": "0700f75e-de55-4aab-81e2-264abb63894c", "comment": "Malware payload (Formbook)", "value": "f5deb07721a46cf6a26c5f93ffc0cf2d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207469, "uuid": "a846f1b7-0cb5-4c11-84fd-36020301408e", "comment": "Malware payload (Formbook)", "value": "8496c1ff98054c41e0b04e0d9f6f6b5da8a8bf495a5e92a94060d89b1a3f41c7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207469, "uuid": "2c4ef70b-9c34-4833-910d-4ef43b518794", "comment": "Malware payload (Formbook)", "value": "5f0beef738d9cbd7a8f29d028baf1163c330aa50", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207469, "uuid": "a633561e-022d-41dd-9798-ee605ae2ea70", "comment": "Malware payload (Formbook)", "value": "5ea7c61fd790779c45f0f0bc287903355d31b0013d6ecdd9616e4f7dcf25abadbceef5155f2421c7bc26fbecbdb89efd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207469, "uuid": "dc20c76d-e243-4ecd-ac96-3b900e054db9", "value": "09D4234BC59DE952B88D2A26BCD811BB4E1D1CBD3816425EF5CB92348CC79C1E9CBB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207469, "uuid": "ed0e4fa6-a011-466e-bdd1-d12c1a7806ae", "value": "12288:aaVPwi5gbfXRHzTyL8w9IhPwGOLtY6wd+CpYuADbjHW2dHHkh+a:aa2i2bJzk8TNCk+hBbj2Phb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207469, "uuid": "06854532-edc7-4199-b594-0f34571ff8f7", "value": 645682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207469, "uuid": "55170042-42cf-4de1-9873-963e2b094fcb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207469, "uuid": "10534de0-7e21-472a-91da-4732c5bdb170", "value": "CIVIP-8287377.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9da8aa2-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618225039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225039, "uuid": "ad5b3b6d-c052-458a-8e2e-2a96c12f196f", "comment": "Malware payload (AveMariaRAT)", "value": "5c09522de5f3253871d318ba84094b2e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225039, "uuid": "783fda44-3de0-48a6-94f9-bb55c2dd6ac3", "comment": "Malware payload (AveMariaRAT)", "value": "872ac5743d339a60af70e0b933a15c4c68f5e40b168c3b5ef444cf280673ee42", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225039, "uuid": "3f50afed-109f-4c60-8914-d3ea37da8d5a", "comment": "Malware payload (AveMariaRAT)", "value": "c783db9c74006be5933fa057f2ff532b60392b94", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225039, "uuid": "37213a57-e501-4297-83bc-050b5c9c1b3a", "comment": "Malware payload (AveMariaRAT)", "value": "c4fade1d6a7cfd22ff0b1b2c5e4c3d7f5ed7bb1b997f6f7f71f7d5f367da54b21ac14ed1bfd39270e83e2876b205b434", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225039, "uuid": "846d7b28-41a2-444a-87ca-00d6552046cc", "value": "41D3129E7D660551FE41423496B7848C8EFF99722D22346FEF71F06920A1ED9E42D03B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225039, "uuid": "7cacf3dc-588d-40b9-8fb1-853a5770a21f", "value": "df9b7c9b4981d90c5682d6370ce47ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225039, "uuid": "49e47336-02f2-4472-9d54-15e8767bb47c", "value": "3072:4/w/0fsVlaReZhphqrlT7MG9DqDseBguVdu4+rqv8kzY5Bed/rX:Z0fReLQlpJqBBguF+rKLtdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225039, "uuid": "82e5a594-5194-4207-9551-862396660877", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225039, "uuid": "2cd0be0d-9627-4a2f-9ec9-347214c05541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225039, "uuid": "9885e8a0-a494-4a24-8933-ed11811b3f83", "value": "SecuriteInfo.com.Trojan.Packed.24465.17731.23605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745ad5af-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618208118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208118, "uuid": "b7e23308-369b-467e-8ef3-cd00ec5b120b", "comment": "Malware payload", "value": "c735e3c5325192c3adcf11cef86f615b", "object_relation": "md5", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208118, "uuid": "dd588d24-685f-4f36-81aa-7b60f3a508f0", "comment": "Malware payload", "value": "879bb47495c407c7337501a43ceb22deb6836cb88272edd8abd62a3e9c3eba18", "object_relation": "sha256", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208118, "uuid": "a094583c-3a1f-4aad-a077-000fef53ebde", "comment": "Malware payload", "value": "c0b8d681b591be7652014df36494631e48b3997a", "object_relation": "sha1", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208118, "uuid": "fbbbf884-48a6-446e-9018-7db2092c21fe", "comment": "Malware payload", "value": "a43d7d7e552c4ff18d1cd5f65aa902a916734fa53a27837c993f27bfc43628362de177416a35a81a612521245fc359d2", "object_relation": "sha3-384", "Tag": [ { "name": "Rackspace", "colour": "#613A8F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208118, "uuid": "d9f71110-d806-4356-8d44-1db3df71aad2", "value": "2D02AE123A355A2C79F28433711B7E0003F96C029F4CF149ADBAA0A0E4F578F2B9948B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208118, "uuid": "6d8621a9-3438-49ae-897d-4b83b3d261ee", "value": "192:hoNhY5OzNx4sAQxCzpBH18Z/hx1DVp1wU:ehY5cL5wzpDOVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208118, "uuid": "d217ce01-258e-4e04-b746-4e5ed0628ec1", "value": 8225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208118, "uuid": "2df9a768-9553-46ac-a1a5-ece0e59cdbad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208118, "uuid": "5024da2c-498e-4a2e-8b07-71bcfc07f393", "value": "89736782464672.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed64bd16-9b78-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618222924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222924, "uuid": "683e7dba-f3dc-477d-b64a-ccb8274172fe", "comment": "Malware payload (RemcosRAT)", "value": "7b43f08e57ff0b2a8650be3bfb18437b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222924, "uuid": "344c6231-f293-4133-96a1-89e833675784", "comment": "Malware payload (RemcosRAT)", "value": "88387fbf4550ae2b3f4f98dca8656531e543320e125438ebd2b8d2cd29b88cc1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222924, "uuid": "f6355ced-6cf9-460d-8f0c-9950e9118418", "comment": "Malware payload (RemcosRAT)", "value": "0a1dde5950d83ac3b15aa93d440ff5bece49a297", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222924, "uuid": "9dd83868-b093-4b35-b72b-45872a96f4b8", "comment": "Malware payload (RemcosRAT)", "value": "b16f72292cb6231a505f8518fa3455b5103281b0b19d0e249044ce434489de407b63662679fb85d18069fd697a3bb0cf", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222924, "uuid": "178b1ca3-d7bf-4800-ada4-c4bc1d35e771", "value": "B1F49E22F5D15437C16E1A79AD2B96E89C3AFF00FE64DC4927F91C084F383917A652A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222924, "uuid": "2e458b96-8f1e-4ef4-b6dc-f578bb40647e", "value": "23399c21b0aa604a8aa13da9702198d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222924, "uuid": "5e1d1faa-5198-4675-8dcd-85e81ca48a6f", "value": "12288:wjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c07KRmp1:wjMmMH8XEgfqFDd07K8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222924, "uuid": "96236355-6d23-4690-bab8-c9a0c4c59a09", "value": 787600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222924, "uuid": "4dc4e6a8-2792-45f9-b45d-93ef5e495f20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222924, "uuid": "885fb8a8-4efc-4968-b0fc-621ecd4f46d9", "value": "Urgence RFQ_AP65425652_032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1140e20b-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618241882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241882, "uuid": "5e153c36-8dd8-474f-a091-4173996581a7", "comment": "Malware payload (AgentTesla)", "value": "bbef34d519656122d601c88fad9dee1a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241882, "uuid": "e879fda3-562e-486e-9b1e-bdbb5914a1ad", "comment": "Malware payload (AgentTesla)", "value": "896b996560e0328d3c258ffa2d87e83868f00c69f9777e8f7bfd41ed83f14f95", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241882, "uuid": "36483942-1f55-4b58-b79f-6844eebc7e04", "comment": "Malware payload (AgentTesla)", "value": "f47c32c7894c2d1553268c9da127b2837076cbda", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618241882, "uuid": "888259ba-22ae-4a10-9b49-7c3013b464dd", "comment": "Malware payload (AgentTesla)", "value": "77086df0ccea46cb04ca62862a92d294cfe3c4845a73b6f721e2800a05be17fae7d65ccf003e69aea369c92af1843b14", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241882, "uuid": "c1f73d78-18ce-45ed-acab-19a5b6ebd387", "value": "A2F423C4591F1EBA71197C4E76C7CCFB242286090B6BB4FA4909C15E6BD15FAACF2312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241882, "uuid": "cff54f17-4201-48f7-8146-5caf8d71c4e4", "value": "12288:Emy0UKc1o1SAx9MaZ6Z1nMdF0ttHH8EeLbdN5E7h3n3V658B9QYN8WGPHi5l/Jpg:krKAo1SAx9lWyktEdQh3l0k12vKtrZB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618241882, "uuid": "768e0817-e7a8-4a07-a7c3-fd7b2843de5a", "value": 784816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618241882, "uuid": "10cfe765-6929-43bc-b663-437ca471ea14", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618241882, "uuid": "1edf3945-afc1-4dd3-8c50-9657d5db5948", "value": "Contact form.pdf.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb08a1e7-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618208693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208693, "uuid": "378abf16-4da3-4fc7-9634-da31233fec2b", "comment": "Malware payload (AgentTesla)", "value": "be64c3b380a261a6fdddcd9dddbcf5f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208693, "uuid": "48bd3411-7b11-4a94-8bd0-e00da00db85c", "comment": "Malware payload (AgentTesla)", "value": "8991d98a4126be86f90a2c52597361fd376bbbf8a47c2036f77153a7f3436018", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208693, "uuid": "ff7592c2-2d10-44af-bd14-aaeee264085b", "comment": "Malware payload (AgentTesla)", "value": "8cf70127f58305b0fc7b103e16b5415b55207ac6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208693, "uuid": "d79e893a-71c2-4b41-8c2e-6d7b1f97d41c", "comment": "Malware payload (AgentTesla)", "value": "c2cef63940f6c9fc47edd1483d9dd19a6a2d2e471649a1bdf4f4356eecba2ea1b1dbd0748321e00de65217be0ac929f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208693, "uuid": "5323048a-87f6-48dd-af97-5886ce5acd21", "value": "DF0579432ED4DA8CF0D95A3E16FD10227FA7D8860A0E8FC7A9C7B3AD45D1906F521A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208693, "uuid": "226e5316-cebf-476c-9ad3-74a8b240b571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208693, "uuid": "7d2d6657-acec-4dcf-a89a-b4492d35e209", "value": "12288:e6pOYqRKievnktb0c1AoOM9xdPJxaeZoY8DBkC4cvbS5L0kPK8:e6OXRKxUl1dxAeZKJ4cvfkS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208693, "uuid": "7780b429-f5b2-4b39-9500-636db287935c", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208693, "uuid": "74cab3cf-1d7a-42b7-be83-5702e6f3fe1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208693, "uuid": "a80ca40d-2880-48ff-b294-53b3011dc29d", "value": "IK8QsX6z2B1lPY0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93767cb-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207885, "uuid": "f810e7d6-922a-4e4b-ba1d-eb3d1f66e13a", "comment": "Malware payload (SnakeKeylogger)", "value": "40f1b0be10c0ccc4368667a0df1346bc", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207885, "uuid": "166ed870-c19f-44b7-870a-68614ebf9606", "comment": "Malware payload (SnakeKeylogger)", "value": "89c7e0f147e4020561272e2520cbedb5c83d9d39bfe555f091a60c335c81c32c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207885, "uuid": "fb319903-d12c-4737-a1c8-5c8c8ebb0349", "comment": "Malware payload (SnakeKeylogger)", "value": "70130bb1f7842760d4678fe64ab4f75de4ac6438", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207885, "uuid": "6126e055-d394-430e-9132-42632822077c", "comment": "Malware payload (SnakeKeylogger)", "value": "b3f5458d08111161a0524f3bda8340cde419ddd850152d0bad0b90a6ed4b37a624f363bb22db7b4054582fa760d5941e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207885, "uuid": "bdf7c327-7b43-45bf-bc79-9df6c1a0a940", "value": "26C423D33D214A64073B57AF25A3D0A8526C8A7E18AD247FB3B9DDD2567750CCCAC0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207885, "uuid": "6f88f5ed-7a65-4450-859c-4289176f61fb", "value": "12288:tE232L05M6Xm2kyPuJ4TkqhPEH1m4ucFwqVgrqfGoEGNhCabZql:1+6XVYjwqVgcGoEGaasl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207885, "uuid": "69e9faeb-62c9-42a9-89a2-d8e4929d6e7b", "value": 571525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207885, "uuid": "cbf33eac-a998-445e-971b-f0e784d0757b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207885, "uuid": "7bcbd106-2eb6-4afc-ba41-e6c33370f7f8", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cdf86c-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1618236038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236038, "uuid": "f9a5c530-61a5-4190-b391-a37a385c3ab3", "comment": "Malware payload (STRRAT)", "value": "dc550751fff2488186c51f5307d5f633", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236038, "uuid": "513d1cc5-37cf-498d-8fec-f71bc8164653", "comment": "Malware payload (STRRAT)", "value": "8a3cfa2c1eca307047e5ac1d9b9046064bdad17641ee08d6eee919dc36a80ca3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236038, "uuid": "b0355836-4b80-4504-b335-60916a8290fe", "comment": "Malware payload (STRRAT)", "value": "1219651cb85920a609fe07a913800c3bca2173a8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236038, "uuid": "f2d78236-5eeb-4100-a378-cda774a3b524", "comment": "Malware payload (STRRAT)", "value": "0dd8c2248207189d04f5de24b3d9dfce5ede21d431dd55a597b21ec6edebd6a82040b5720d5a24610acd7d7d1d68c651", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236038, "uuid": "18042e11-8080-40ff-a1d3-61f25a20b27f", "value": "DA14234725B980ABD2594736B5B213E2A7472C9D5E2173DC0F16231EFA82D1DC7F0AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236038, "uuid": "888f8c54-9f12-48d8-a73b-00aca769ecca", "value": "3072:zt/KxYCjMxrVg69tl+bFoQWjz9irQdghGv2KdyBa3Lg9wi5JfVxO3uFC:BSZMxrVJyFoHz98QGw2K0BKLw5lVxO3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236038, "uuid": "fa86d5af-3d26-47b8-83a6-3d332d2098e1", "value": 194726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236038, "uuid": "dcdd925f-7b5c-47cf-a958-71cfbae2e45d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236038, "uuid": "4a3b3928-422c-4249-a801-44f67bd6fcca", "value": "list3503-purchase-order-12-04-21.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318374de-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618253103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253103, "uuid": "857edd8d-305a-4ff3-99b3-83443005ba58", "comment": "Malware payload (AgentTesla)", "value": "f5f1e2a3e5dce186eed0352350911887", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253103, "uuid": "aa762f4b-f6b1-4141-8e35-bf16f4ae58ed", "comment": "Malware payload (AgentTesla)", "value": "8a3f4202e9f89c018f5c05b15c67898e51dc4d41ad368abb871e044458f7822d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253103, "uuid": "fdb706b4-bf15-4152-b172-c9bcf51fabc8", "comment": "Malware payload (AgentTesla)", "value": "62f0fbf33e6e78ab4a7d7196763cc3dce62c6a4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253103, "uuid": "a31d494e-c902-4988-8981-0ebd3dc7e87d", "comment": "Malware payload (AgentTesla)", "value": "174c3ededb0b5ed3f4b38a268cb5e512cf16e0a2f92505ec9047acaffb992ce8fd701cf58f30b5e16cc34ebc52a31e6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253103, "uuid": "aedba93a-97fa-4e1c-8021-9fdd441cbea1", "value": "EDF423412B94CB55E17DAF745932040423F8F1DAEB1AEB5FBEC870DD4253FAA8685223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253103, "uuid": "e84c5416-6fea-4987-99c7-f643e3c433f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253103, "uuid": "cd9f8ed3-0b5f-44f0-89a2-76a037470773", "value": "12288:XYMEBDhUzj786IMeIZfFtSyn7CY65s7/k6oHi8UiX67zeAIIHCiUzAnPAG6XecA8:XYMiGJIMBttSyW7sw6tf/cWCiuOPA9eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253103, "uuid": "26b451cd-ba4d-46a4-a325-3ba87e8aaad0", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253103, "uuid": "ea45233a-3194-4b93-87ca-d8f1ad5a312d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253103, "uuid": "7838ec4a-07ce-41cc-b01c-7766c41b7e27", "value": "f5f1e2a3e5dce186eed0352350911887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4400b83b-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207178, "uuid": "0b45eda7-d6bb-4d4a-b600-0029af5d1e1c", "comment": "Malware payload (AgentTesla)", "value": "97ff15ccf739850fe35c95fb4eb5099a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207178, "uuid": "60851326-a600-4647-8e0f-00a5f498ae45", "comment": "Malware payload (AgentTesla)", "value": "8a780dc272b6133d582b481e8977a2db3c55736381e8015d1fd9b6e08b6c1ffd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207178, "uuid": "0e9dabf6-d8dc-432e-8c22-52f45afbde6e", "comment": "Malware payload (AgentTesla)", "value": "fe30dfc3bb417bb83130b784ae067acb3636ff0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207178, "uuid": "516f6ea4-f40a-47ec-a44f-a7241d64d87b", "comment": "Malware payload (AgentTesla)", "value": "95a64a7accabe3f4fd9ca63a7fc72e8ca5e772fa51e378a16be09263565f3433644fddd33c6fc15e5bcfe45c591e8d7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207178, "uuid": "c9271080-fbd2-444a-8656-e372fabdd136", "value": "97E4CE2F775E2B1EC2080A32383B0AB452E4DF5326B5F62A7CC6ECDC4921A0D571B5D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207178, "uuid": "477e4ed7-3fc5-4981-b4b1-94043f1a4948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207178, "uuid": "e7b80a36-297e-47bb-a326-f705910da53f", "value": "12288:0if8x3aHVzqqB3PQhPp5owPZW010CjZH+TqUXHImiN+SNRF9:0GHVzqIgfoH01LVH+OUXHjiN+mF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207178, "uuid": "e5ab5130-e907-4c33-b368-6138c53e52ce", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207178, "uuid": "4e5f3d4a-f780-4059-8933-d3683c07583b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207178, "uuid": "a5e9fceb-8590-4680-adbd-a98ed4c76625", "value": "APRILQUOTATION#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dfbf9b-9b6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618218757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218757, "uuid": "13061a40-7de3-43e3-8b4f-d817c4bb0f2f", "comment": "Malware payload (AgentTesla)", "value": "7c11ef37a7bdad154a455d59b65c190a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218757, "uuid": "d6e9243a-116b-4f64-b94c-bdd32d085ed1", "comment": "Malware payload (AgentTesla)", "value": "8b8f8698c1165d37f1dcf607bfc31a0d8f884389b26ebbd106bca128f85e40e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218757, "uuid": "70ff3a23-ee34-458a-b675-a83dcdc8a83d", "comment": "Malware payload (AgentTesla)", "value": "3974dd90b0180e8087bc2adbd3947f651a656ab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218757, "uuid": "436411d9-232a-45a9-847f-1c04e6d5030c", "comment": "Malware payload (AgentTesla)", "value": "51c81e1aeb9158326d8ff356ab7f2c39592b24b33f93e87f1d05e0ea8fba75f1b3582bc5679e439c78e019cf4524a6a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218757, "uuid": "91d354e5-add5-4363-b0f0-8850462e2eca", "value": "56F42388A7D8BB78D47E577D9831040027F2F54EE733E6567D8818BE1A83AA8C784752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218757, "uuid": "1ba9244b-c566-452c-a176-58928ecb4c19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218757, "uuid": "405030b1-eae1-4df6-aa6f-6aebd0f973a7", "value": "12288:Mgdxbzvzi13jlCfH4lEWSoWVZpeQTG3PjMJtS0crwEpYi/Py1A/K:MyPvzk35CfYl8oWVT0PjsStDphPy1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618218757, "uuid": "91b6c819-a154-4cd6-bc39-39cf592b02a6", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618218757, "uuid": "e65a519b-ef8a-4c87-9dfd-aa051f3c834f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218757, "uuid": "0e5a2429-19e7-45cf-b6d6-9fa9e158b367", "value": "Remittance Details,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26319127-9baf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618246212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246212, "uuid": "d23e800d-e65a-40a7-ae13-48bc0d8ee0bb", "comment": "Malware payload (AgentTesla)", "value": "92d06ea77cfe92552a1593c0dcb21c81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246212, "uuid": "c7e17f66-074c-40a6-82d1-5df52b502e3c", "comment": "Malware payload (AgentTesla)", "value": "8c811285978a7ff24328a6d8e49291d1d91b62bcd53224cb5ad55b6e243efda4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246212, "uuid": "73bd3b7f-9410-4330-9a71-ed7ed3f91468", "comment": "Malware payload (AgentTesla)", "value": "e0a964ec98cc0d901fd8bd78c8d06fc7768bba90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246212, "uuid": "5fa75871-2550-4ac3-b8b6-360ce61c7388", "comment": "Malware payload (AgentTesla)", "value": "fe807caa1983fade94d6b14e79945bb234cb34ea22a303ec7d4ba1c7c0b4197883892f26ea05b13cdf06b9d2f88bcb7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246212, "uuid": "53b5d13c-e787-40a4-837f-d63298d4caf0", "value": "6DF4332F64CDA2F28568949EF2E65F33C53951F4AD430BBD6C90140E0A4416A8FFD3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246212, "uuid": "31161fb8-1bbe-44e6-ae4e-d6309899cd47", "value": "12288:GFSeM8XjaMgPJCjBdFxBE1SOIV3cHbmhASA22g22kKpAa0qJbHS5mV4+7OvgvBXH:GzMWdACF6IVM7mh0vHKp9LJa72f++x3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618246212, "uuid": "ce60297a-b4e5-4cb0-9bed-447858b14aaa", "value": 746845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618246212, "uuid": "78c528e9-c184-4cce-b90e-57ad3c37cea6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246212, "uuid": "0b9fa34a-3314-4901-9783-0be404c92add", "value": "COMPANY PROFILE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183d7b50-9ba0-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618239746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239746, "uuid": "48e5c372-ece8-4578-9b06-7a46ebeda1c8", "comment": "Malware payload (GuLoader)", "value": "cf70625f819dd81b39cbd16f47dc8419", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239746, "uuid": "fb806a0a-67ee-4dcf-a5e5-b1b0f1e6bf68", "comment": "Malware payload (GuLoader)", "value": "8d1c4979ab05b4208c84ae71e7ea336d0b385d2855ce6ea43d513ed6b740695a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239746, "uuid": "acb09950-6d67-4941-a95b-dcfb74677639", "comment": "Malware payload (GuLoader)", "value": "5b4e9ff91e8bbc2f01075e464b9128505c2980a2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239746, "uuid": "ef0fce1a-b7fc-4f15-97da-319314527264", "comment": "Malware payload (GuLoader)", "value": "bc42968b72e66b38f957f484d82b8a75f9ef117b63f049566f0fc5a1bf4e305d29e8303f457e4f92bc660f7b6caed171", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239746, "uuid": "374a5936-8343-4b9c-b437-a816c4842fea", "value": "A6E35D613B40E17CCAB24670B2B4269881737CB427B98B0BF1CF9D6A97779D7E840356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239746, "uuid": "ee183fb8-1942-4182-bd36-98cbf828b245", "value": "768:EzlTzXt3zSxhjTphA8Es0svVd1ZZv/Nyr61dVWHCuMvdvckklVGDIvoK:4t3zSxbHv3nZnn1dVWiukdvr3Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618239746, "uuid": "37999c60-6421-4a27-8545-3f839037f9b2", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618239746, "uuid": "75f2f399-c69f-4fc5-a8d2-9aaa6352c5f8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239746, "uuid": "7310e7c8-f446-4ec1-b2e3-99b34b58f789", "value": "Anmodning om tilbud 12-04-2021\u00b7pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83eba30a-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207285, "uuid": "1a4103d8-cd3b-43e3-92dc-4379428233b5", "comment": "Malware payload (Formbook)", "value": "0cdbfdf044cfa1d810ed06b745ac9cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207285, "uuid": "07209ed7-3fae-4b88-b468-b0b6f66f0566", "comment": "Malware payload (Formbook)", "value": "8d85a4dbf755253e9f46aafa65f5374431e5843e6d1fa6ab61ef238919d9f6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207285, "uuid": "a6f119dd-563c-4623-9faa-39e0ab5c3271", "comment": "Malware payload (Formbook)", "value": "124e5c370a103888227112141ea559b85ae17656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207285, "uuid": "84ee02b7-ce1f-4012-91dc-2eb42364575c", "comment": "Malware payload (Formbook)", "value": "0622b2f91f5bab349ab244a59799644256079a9e86e20b06b27fb557f50892c83d3b37104717ced4c77c99e08c670643", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207285, "uuid": "7b739d26-0cc0-4f07-a137-a0a5192dba0d", "value": "25141247A9C26CB7EB0400320627AB6AC6B79F14111937C70F64BB7B7E52642D93E1DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207285, "uuid": "64821166-9491-4269-bbd3-c0c63e29eac7", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207285, "uuid": "8e984c01-2a90-4861-ae83-715996c123f3", "value": "6144:HdiVOo3WMw/4lKQpzyG+iwoL+sMduTezXIi:MVl3Jw/NYzFwQN6mezXIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207285, "uuid": "aa3be481-4fef-40cd-9c2a-8ebbfcc1f0b3", "value": 206697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207285, "uuid": "b1fcf5c2-a900-41cc-b633-e9329e4db946", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207285, "uuid": "d2c96b5a-3ae9-4bd9-b56b-aa010d1422d1", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09637db-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618225050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225050, "uuid": "e688b826-f8c7-4e6d-896e-af1f616430dd", "comment": "Malware payload", "value": "4e9ab501e4d6add74f0f113b1f22f601", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225050, "uuid": "1e9d2ee0-f5d5-40d9-a4dd-432017365ee4", "comment": "Malware payload", "value": "8dadaf334a60ae74a21ded30f69e404e0f9194ce90289ec68b8df5c72f100576", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225050, "uuid": "f3770eeb-6a46-4c64-84c2-734500c80073", "comment": "Malware payload", "value": "fbfe5d74a693be4b0070bbddad70db00a4f4c4f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225050, "uuid": "d87311ab-c5b4-491b-93ac-f0713bfb989c", "comment": "Malware payload", "value": "52a977daae452cc9c549e16885eec116359820040ac4ac5fff9c68a9801db983b22b34a7657f9baf864463149d627cba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225050, "uuid": "1dbb6818-5f8e-4ce9-9221-d1e269859fff", "value": "5AD3DFB393D708B9D0159A7DD2D63E2936E2EBA6241715BB3B585A1437CE302320DCF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225050, "uuid": "98da677c-ffed-4330-ba7e-5ea92e1e83c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225050, "uuid": "44d7a0a9-644c-4b91-9d05-a9ffb9bf4417", "value": "768:3hybrk03cO9KDUUjvgyExXkZ6RuRMIIku11QvqrWk11QYXmrJIIrXj16IMrt1WQO:CrEJZ0fvbE06lsHszoZwle1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225050, "uuid": "7740c3e9-71b3-480c-982a-b18826ae8942", "value": 137920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225050, "uuid": "24899eab-f116-4b6c-a6ee-5c8f517dccc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225050, "uuid": "1ed4b5d2-9140-4417-9212-63dcd93b2e72", "value": "SecuriteInfo.com.Trojan.GenericKD.45979987.7892.11157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b78b890-9b5f-11eb-abe1-42010a9c0039", "comment": "Malware payload (FormBook)", "timestamp": 1618212049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212049, "uuid": "19d3c17b-d65b-4dcc-b1d3-3a94d4393293", "comment": "Malware payload (FormBook)", "value": "9d71011e0ef3208145dd434e229ab0e2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212049, "uuid": "26b8eae2-8b33-4662-8d7e-41d705e0d9f0", "comment": "Malware payload (FormBook)", "value": "8dccc7a8d24c010a59d807148c7a6779a7f2eac86868e1cf083235d0bcce3414", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212049, "uuid": "ffe13a01-ea2c-4ca9-8031-c2022e139fba", "comment": "Malware payload (FormBook)", "value": "ecb4b62327a724ab00bd42bf98a51db3a3977079", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212049, "uuid": "471c1ff7-6e26-4951-b8df-d6580bcc0bda", "comment": "Malware payload (FormBook)", "value": "a86104eb78cf544192e16e1d6829afd6838d9be08638906eb3513abc09d06d655d03c5f4d0ddd049b24ca7c5f9269b1d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212049, "uuid": "ea783a88-c01b-4207-b669-4de0517b58c5", "value": "93E5235363E04AF3C4E4BF3325E3697B4E535D403660924EA704BF9F63B54821A61BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212049, "uuid": "57c7d082-48e5-4f14-a3c9-10447da19a6b", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212049, "uuid": "ef0f89a6-953f-41dd-ae2b-7df0220093a9", "value": "49152:tjYDLy+crA3wPtYzdrkW64QWfMNAFKmnk9vpRGH8owSI/dycghUmLNU8B83/Thok:tjPcII6W64QuTIvpELwXdycghjLNUt/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618212049, "uuid": "b43f471d-73ce-4e3e-9e90-e4f0eee62abd", "value": 3059224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618212049, "uuid": "d90c3178-a4ec-4200-be06-e7569fbd458e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212049, "uuid": "92abd4c9-7170-43ef-b501-9a98b1ef199c", "value": "PURCHASE ORDER.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51db8d2c-9b78-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618222663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222663, "uuid": "a45458f2-43f7-42ba-bc2e-de2f1ad7ebf1", "comment": "Malware payload (AgentTesla)", "value": "047d044a824e37e8f72fd7a13d213fa1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222663, "uuid": "10919198-2cd3-48d2-84bd-16b7135ac239", "comment": "Malware payload (AgentTesla)", "value": "8dd387278cc038e5e8a05614910a1a23aeda6f236f56a0f355559b529558efb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222663, "uuid": "a3bf34cd-8d2f-48c0-a46f-42b631714ae3", "comment": "Malware payload (AgentTesla)", "value": "a86d4c4f7f58349c97d7b9efc14b9bd5d1544860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222663, "uuid": "058b9535-16b1-428b-8d24-7e5782f28106", "comment": "Malware payload (AgentTesla)", "value": "17954fdc81defbbff11d49c1bcc50dae3992e3db863b48662429ce2b0c3efab5bea4cfb52002245e73de40765ca9a914", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222663, "uuid": "ab8e4a62-4e86-4fc7-9b25-553297d21f6f", "value": "0DA423030BD2AD7483C93C329A86DC051891CC66D714955BCF6BAFF6E629FF24A4DB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222663, "uuid": "09e70bca-0a3e-42ec-96cc-8241103dacc9", "value": "12288:Lh+1ph+hB42zI9MxF2v/RkJWfz3BaMlyaRmL5tVmpPmIYAkrujwhFGPCW6WrKTty:g1ph+hBz2MxAv/R6f2RGjIzjwhFG6Wxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222663, "uuid": "85a0389e-3bbf-4416-ba73-af1e28d485dd", "value": 483085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222663, "uuid": "f109d588-edca-47a8-88d5-043c7e400ad3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222663, "uuid": "c5d5969b-13e4-4ec0-b91e-c6a2318a6475", "value": "CI-OMG2006023.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123f09ba-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1618207954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207954, "uuid": "5b417867-1de2-4b85-bde1-81986e51f03e", "comment": "Malware payload (ArkeiStealer)", "value": "3f8d03f7c79b4583d32a060d08c3a978", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207954, "uuid": "d0b73504-e49c-403c-9998-60830c81fbcd", "comment": "Malware payload (ArkeiStealer)", "value": "8debc24c69c62f957769392673c548fdba7ada00512b2d0723390e558d535263", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207954, "uuid": "d927012c-a23a-4a7f-8c84-4d00dbb90004", "comment": "Malware payload (ArkeiStealer)", "value": "48a6e20e5c5adeef71276fcb1287a3f11d340328", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207954, "uuid": "eac452f2-ee76-48fa-9dc6-13a9ea46ee5d", "comment": "Malware payload (ArkeiStealer)", "value": "eb008189f405d3cdf16d6abbd0e4cffb9244c00f0533521e6886580859892c5528262c0696d046fdd80949b988e75d9c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207954, "uuid": "1ef574c2-c82f-4f4c-8bc2-f8c41e35011a", "value": "12F42313EA37EDC32F502906587FFB3432239E63D93D65E98B5F5264E68492026DA1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207954, "uuid": "b41cdcf3-5abd-44b6-bdde-7dc4620781ce", "value": "12288:rnXmwmZIppxUMGcDZbmu0XZlFrPJN8wSUNDYsRcwgHwl1czxRc2gHC1pHw9yN:rnVmZ6pxnDZb0ZpS4lcwgQkzxu2ACv84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207954, "uuid": "fc9b41a1-ed0c-4fd8-80f6-a54ff86b3510", "value": 776372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207954, "uuid": "002da7e0-09de-4401-abf3-d43fbf4bad96", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207954, "uuid": "938708b0-da35-4b39-9420-bf5a0b8c0b8f", "value": "MT103_Swift_Transfer452-567-2XXX.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65248ba5-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618209381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209381, "uuid": "2fd344db-2253-411a-87c2-0d88a67f83cc", "comment": "Malware payload (RaccoonStealer)", "value": "6f23faff2a32f16a2a3cfb3dfe4d2e38", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209381, "uuid": "cb73f1ed-e67b-4b56-bfac-79c901cf1b13", "comment": "Malware payload (RaccoonStealer)", "value": "8e9d0e52d976ff21f930c8c032b94b394738fb652db616eebaa18fb0ab5fcde7", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209381, "uuid": "bfe9530c-9292-44ac-b2ea-804808992d4a", "comment": "Malware payload (RaccoonStealer)", "value": "d52ded952a66428f282811dafb651d124b7b05ea", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209381, "uuid": "147c5b41-4e4f-4e20-b8ff-3e9edd14ba95", "comment": "Malware payload (RaccoonStealer)", "value": "aff0f6614c4664c3aee1cc4027ed4229cba7e8cb6a591deec463e2c2ee4597cf60376d9cfc797bf106ec98e6e3f9ee2c", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209381, "uuid": "3a5381d3-efad-4e7d-a818-598dc2662a09", "value": "5845012DA6D110E6C4465277A64FCFC3BA2F74B05F10BFE66E2485060CE1171EEBA663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209381, "uuid": "0fc29cd5-5b0a-4088-a576-cd69cf9efff6", "value": "3545e37e8e8529df75bb26e8327427eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209381, "uuid": "94cffc23-0830-413a-979c-400d5347f5f1", "value": "12288:mjb2Fr5l1q3Wtfk0hbk3KWPy2fyvJYmwkyvLfTvkJh8HClMUQ2WKDwz8RYUFkr:m3w1I3BzyqmgvL4+UMr2WqwzqSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209381, "uuid": "b00f0e13-9fba-4cf9-a967-7299f790acf3", "value": 1175260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209381, "uuid": "02058243-d686-429c-8f80-900920a85943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209381, "uuid": "934f937a-b76c-4817-8648-88a32041be67", "value": "output(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c33603-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618229939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229939, "uuid": "d110d00b-5abe-46e3-a85f-e88b55add995", "comment": "Malware payload (Formbook)", "value": "e70135cdb555ce99adee7df642813dcb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229939, "uuid": "1d98de9c-4e45-4097-bf26-8b97a1a5341a", "comment": "Malware payload (Formbook)", "value": "8fd53e5f78693bc7639c94ef4a7969c5395c4e90ae255c0080f687811c8339e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229939, "uuid": "271c84d8-bf97-4701-b7c2-6aae8227f696", "comment": "Malware payload (Formbook)", "value": "cbdcbfe1426651f5c2fba88872688309e308dd74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229939, "uuid": "4daa7349-e34a-4701-802a-1cdde4bacb56", "comment": "Malware payload (Formbook)", "value": "1d705f6f341911fc6cafaadef09795ce45fba52ab6cef6340d7411a8789c0932fa9d7a9a005125fa935bca77b5146845", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229939, "uuid": "1c2f447c-5625-4eb5-8758-f332dc709185", "value": "6F026CB4DC94E56ADF0B85D1040F7F88192EB639B2D708D03F4CB9612F5A74A07728B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229939, "uuid": "3b350e86-df23-43d1-aff8-b0553eb49a83", "value": "192:v+5wk2b/9LmQCx4ZesrJHUf9i5Lt8cAKIG4BrNAorM:Giz9aQCC3tD+5AoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618229939, "uuid": "9d8fd485-7a7d-4e39-8db2-50f0e26d974c", "value": 8874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618229939, "uuid": "68617db2-fdc7-46e4-a6b8-4d93283d6791", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229939, "uuid": "0dcc8981-4551-4422-826e-ba3037ea708d", "value": "e70135cdb555ce99adee7df642813dcb.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29585b0e-9ba0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618239775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239775, "uuid": "259f1091-dfa0-4b77-bd20-c94b122f0adb", "comment": "Malware payload (AgentTesla)", "value": "de108f94b2457d1acc5cf78b1a9cfbb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239775, "uuid": "8ec53307-42ee-45e5-8b1f-0d1400dc7f4f", "comment": "Malware payload (AgentTesla)", "value": "8ffcf8ffaf14be0fec37f88fa1967ec34dbff332167545d4fcbefe63376da0b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239775, "uuid": "03753fa0-2b9c-485f-a011-f0d4fb87e613", "comment": "Malware payload (AgentTesla)", "value": "6d9b469f6c4f6fe74ddaf6338a95e1b65b2442e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239775, "uuid": "1ce16de3-ffe0-44c1-a419-05ae853b70b0", "comment": "Malware payload (AgentTesla)", "value": "94be1753438c15ba4a46de9687b8cfb517620dd84f4bc3d1a309bdb5498cde49439e2f7f5d69bc28867dd8d4fa78f9ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239775, "uuid": "1169fd0a-fa5e-4a6c-bb84-4e1b63341436", "value": "AAF4012B23899E2BC6AD4AFCC4E1D20297F1CB2A7993F3563FD410F509617D67788281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239775, "uuid": "178e4c83-9652-4a51-8b5e-69642d12b251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239775, "uuid": "3bf2c6fa-c33c-4dfb-a585-64326cf38224", "value": "12288:kI6zgD8iptB+BMyywGzY4/uWDAi6i90QqYSoft7MOep+KTA9ABQ3uK9zzxWYTlb:DQi8irBmNywqF/ueAk8g7zep+KM9ABQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618239775, "uuid": "9034d398-ba82-492a-9fcb-33bae64f2bd5", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618239775, "uuid": "aafc3053-b0e4-4d8a-a613-3442af1ebfce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239775, "uuid": "e199df08-c551-4154-86da-36c181a47a32", "value": "GS_ PO NO.1862021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b929d8-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618206624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206624, "uuid": "8bac1373-7d6d-41e8-9162-d0b8a6d1db1d", "comment": "Malware payload (AgentTesla)", "value": "af091dc7bf7766a8d603740a4db0a3b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206624, "uuid": "46c0b936-8726-4a53-b2af-a1cf7f40471e", "comment": "Malware payload (AgentTesla)", "value": "9048967340220a278a366b64952606df69467722364367933a3b672e938a216a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206624, "uuid": "96343d51-9724-416c-9f9d-71b6bf9db0ac", "comment": "Malware payload (AgentTesla)", "value": "5be3bd5eaa578314afc38c46d65e0eaa1e609d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206624, "uuid": "a2092c70-b941-4f88-ae16-9855cbbcd341", "comment": "Malware payload (AgentTesla)", "value": "4d30b747cd4e1080eb700a00445d174cd33c0ca850042825e24266650728295c7fa5755711983010df627b89e4096895", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206624, "uuid": "19929b78-b870-4cd6-8ea0-67c55d180800", "value": "23E43379032B472CFF78C781E4AB86088C5F4079BD9A61ADC5839B0D667497DD8F12B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206624, "uuid": "049a61eb-c7c0-4e09-98fb-e5c2b0175c84", "value": "12288:XZpAOunc9pYk7hZ1WMcxKPZj8Xwclftpn8nGe1UFFxZ6G30FtZFZWsgCxsGalW:XZS/c1Z1W3xKZj8lfj8Lw163H6Cxs/lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206624, "uuid": "7620a088-549f-4c5b-a8dd-568fc154061d", "value": 709644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206624, "uuid": "a8ff3eb4-32b3-4f93-8c9f-319ca824bc17", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206624, "uuid": "b950b6d7-7486-4f7b-8cda-2994cf525948", "value": "SOA.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aede949-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618242086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242086, "uuid": "2471881a-8b74-4f6d-9944-c9e562683d3c", "comment": "Malware payload", "value": "ffda421cad39343ff1f63eac5351a75b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242086, "uuid": "bbc5cb5f-fc6f-46f2-b69e-770872139eec", "comment": "Malware payload", "value": "90763bf058de7d4789f7fccaf109b656da872e27fe6691b47fbe563a3e004d63", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242086, "uuid": "2e5096a7-fbc8-47e2-b690-b9d8fc3a28b6", "comment": "Malware payload", "value": "5d4af4d67a7af92553cc9b14482e6b2a16593281", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242086, "uuid": "e8f41c5a-3078-45c9-85d0-91ee7edaee3b", "comment": "Malware payload", "value": "c55e2db36fac3b0565441fbb35fb5bc491604cafee246f0fec67ad24ba0c3d8cafa25742ca2189f71a35dcaeb3552ab2", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242086, "uuid": "57fc417b-a7c7-496e-a695-1452eaab291f", "value": "096423AEFDDFEA0DDC9E943D550BA9E1190178829780F80A368AE24D4ED949703DF1C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242086, "uuid": "00a84a21-624b-4ddf-9284-ad8aa12a11be", "value": "6144:ieKWJY/Q275u7GiSqFaCK80ks0Nd4feGab6Magxs/NIjMaKBOSByr:bJvaBqj0v0Nd4zyS3Ij3oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618242086, "uuid": "b63790de-b3a3-4f1b-8574-c285a65e2813", "value": 311387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618242086, "uuid": "17c2aa3a-45bd-4173-a2f0-db2ea9e2d606", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242086, "uuid": "3fb63e2d-1d05-4110-a659-c4cbf5e33609", "value": "Invoice #8884.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0312d9-9b77-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618222336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222336, "uuid": "d68b9b41-5d58-4c25-a32d-a48c1a7ce666", "comment": "Malware payload (AgentTesla)", "value": "55419a9a957f8383af80864cb2b5ea67", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222336, "uuid": "07d4e846-bf7f-44ae-9aa9-57adb8dccb34", "comment": "Malware payload (AgentTesla)", "value": "9078f8de7015e466c4d41f5e45b675b9c76db8efa6a7e9a77bfe7578a3fff7d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222336, "uuid": "35ad5661-e517-4332-8921-6595932fa884", "comment": "Malware payload (AgentTesla)", "value": "e909c20d489b53221df4a7f4948c5965aecc0603", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222336, "uuid": "f7df6f9d-c063-4122-8c98-b23a90ce98ed", "comment": "Malware payload (AgentTesla)", "value": "1cd62a7a93d7b50095ed0b0347ea7e9d53e05b563fa2534c7713ca7fdebc6b84654335f8ec518f0069e5de490f8014c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222336, "uuid": "5f182690-3462-41e3-9163-c265965c87ea", "value": "58D4338DD9D4EC439CF617345E8592143A508DF49CB9F70C3B087F22EE5A2486BA0BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222336, "uuid": "a2986bb2-abaf-417f-a07e-d0bbb174c44c", "value": "12288:bLWn9nRIdlc4haIu7h9usHz+E3dwagjVgrpPN9sJOXLM:fRu4htIGYdtnNh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222336, "uuid": "fa46f2c6-0aac-4a37-a7be-57bf37ca51e4", "value": 648802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222336, "uuid": "ac837bf4-d7ec-4655-8980-00c174c1dcb7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222336, "uuid": "550c84e4-db9d-47be-88a0-eeece9d165a8", "value": "RQF 100021790.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ae9460-9bac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618244873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244873, "uuid": "244c322a-0bd4-4843-8c66-d6cb4203b990", "comment": "Malware payload (AgentTesla)", "value": "308879ce913674953c5037e99602c880", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244873, "uuid": "c7908b5b-c545-481b-9908-15154f478782", "comment": "Malware payload (AgentTesla)", "value": "90dea85ad9ae332c6f09cb3e9852515e3ae4eddf9e59b5aca5d0c7e94ab8bbbc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244873, "uuid": "6bf5d857-a41e-4c81-87b3-bda20bd22ba7", "comment": "Malware payload (AgentTesla)", "value": "50ed4e90ac14f5ef0a42785224d6c548723f3c70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244873, "uuid": "84c87324-7f96-4ca3-8ef0-dd89281f587e", "comment": "Malware payload (AgentTesla)", "value": "7f0490ed6fd1bab52818be6bbe6877a1d08bc23d087bfd5058b3379f084bf3ff46455ac2cb0b3e5b0cb7d654d3d2d65b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244873, "uuid": "df53dd42-4292-4544-a2e1-36e4fe1704ad", "value": "65E40121B796CB87C83A47F65072900347B5F1DE7823EF984C92A1D6212AB4C9DE5DE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244873, "uuid": "737f2eab-1039-4d01-95aa-9ec0a7bfcec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244873, "uuid": "33cb6ebf-7c5b-428b-a52f-c6a568744904", "value": "12288:MRd3HbQSXZb6CHYXE3HSdCHqe//tb1atADUf2jzN3ObJ:MDHsSXHOE3SdCH13zUfyzN+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618244873, "uuid": "67bfefaa-8bf0-4783-9bb2-60c82ac9d5d0", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618244873, "uuid": "7c21189d-fda0-41a3-b584-1594af361114", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244873, "uuid": "54ce5c82-79dd-4587-beb2-a16717d65e38", "value": "PROJECT SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b18cfeb-9b85-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618228155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228155, "uuid": "596525ec-4e49-41b2-a02f-faa6e2f96f52", "comment": "Malware payload (Formbook)", "value": "75612f2e3922d80afe14068c3a510c99", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228155, "uuid": "c54bbad7-463d-4179-aee4-50c2fef0a145", "comment": "Malware payload (Formbook)", "value": "913b12686b62bfbaa6cd0169c2b37bb2d06d095335f3ac14047ec49d3a755b2d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228155, "uuid": "d3c85da7-d51b-475a-b571-5649287f3c48", "comment": "Malware payload (Formbook)", "value": "ade818e1272e6131c504273ca678ff805d01d41d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618228155, "uuid": "6d8274f1-31a5-49d6-8e17-098209c34bcb", "comment": "Malware payload (Formbook)", "value": "03f64008ce9346f9f5bcf9c0330b8a38646662147ca8b611d7831c8411d5b9a2a175c23dd29aa69bf6649ddc6d40ae4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228155, "uuid": "147adfd5-7d97-445d-bcd5-5c9faeb418a2", "value": "EB24122719E5FC73E5931BB204FBE3299377A760210A358B8F103FB52691C93C66E15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228155, "uuid": "5fce2508-3ed9-4f89-952f-34d6aad3f26b", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228155, "uuid": "7bd96b6a-b93f-47b2-82b0-92c53205dfac", "value": "6144:HdP4bcqOmuNjVODr4i19VXuO06LAtSXpITmneW9wR:dyKNjUVXuO06cbTmneW98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618228155, "uuid": "04c3a610-22c0-4c25-bf30-dc4a0b603081", "value": 228086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618228155, "uuid": "635c436e-d7cb-469a-8587-b49806accd60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618228155, "uuid": "010b4235-27e3-498e-903a-ab321fc90824", "value": "Contract Agreement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5debb93-9b72-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618220281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220281, "uuid": "883c646f-b7e7-4129-853c-393c920e7888", "comment": "Malware payload (AgentTesla)", "value": "3d8f18eee3e71204a461636effc37213", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220281, "uuid": "25633507-50ff-4262-a77b-3b792f46e5d9", "comment": "Malware payload (AgentTesla)", "value": "91a7bb03cf79ba91331bd14baa59e7714fb0627e45d9eab2401816ed613cae9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220281, "uuid": "887248e4-0b53-4ee6-90d7-99deab52e42f", "comment": "Malware payload (AgentTesla)", "value": "016c7ec7eca701750fdd77411977b9e93e891f3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220281, "uuid": "d82dff1e-576a-452b-b097-580a9883cbc3", "comment": "Malware payload (AgentTesla)", "value": "46fbcf46e2e3f3fd90a020b0e00a388c536095fc8bf6eaf1a94c6ce05180d12d1c2c0939c25da9979da5f1e2d46e5034", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220281, "uuid": "ff9d3ae8-b6cb-4c75-bc50-df0be02322ed", "value": "BBF423EC9FE437B8046F162EC473190538337A4AAA6354D28C684F3BA54607EF6DE690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220281, "uuid": "5a5ba217-7101-4633-a1d8-1c08fd8d377b", "value": "12288:elOn/bzHzi/3jHifr4nEkSo2jDhekT23P7MJZKWOdwElwiZPyTA9A7B:EEPHz03bifEnoo2jd6P7mK/JlXPyToAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220281, "uuid": "9dcfe697-4d94-4caa-b47d-e89bdbc9100b", "value": 728333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220281, "uuid": "cf5790b9-4b4d-4e8b-8602-b03aa0e56ae6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220281, "uuid": "82691ffc-6b38-4b41-9f25-8a74f5cee766", "value": "SOA,.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5338ce1-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1618207448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207448, "uuid": "91edfa57-b249-43d4-98c4-25db7c6752ed", "comment": "Malware payload (BitRAT)", "value": "3f02190df38e5dadd7e1b694f547c539", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207448, "uuid": "3ad1ce05-8280-4a76-b5a9-08bc4a8264f4", "comment": "Malware payload (BitRAT)", "value": "91b24eab863880a23663f812e043b6b83dab1e658b234b1b98521e28071527b9", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207448, "uuid": "7cd98d54-03ee-4e4b-bd05-de186f6595fd", "comment": "Malware payload (BitRAT)", "value": "32769a00df7264940c155f9a2222812e0fbf86be", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207448, "uuid": "d95f232c-2413-48a2-9cc3-fb93a35ad32d", "comment": "Malware payload (BitRAT)", "value": "ab8d2374355ce08a13d280f098de351cd590f2038c5cc0b544495ec468ddffc807688b0f826af7e88832674884217faf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207448, "uuid": "01fde4e8-fa73-45de-88d2-c4612bdd6eab", "value": "C5B533468461C306E7D8727D8FAAD2B04B31FFAFB80955A215E47E8B35FEB1B49406C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207448, "uuid": "0c03c376-b134-4cbc-81b5-fab7d4e23615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207448, "uuid": "7f8498d4-bec1-4455-8c40-eea3a29e7347", "value": "49152:9dSKw1LSbBGRPpaif65XFH6hLufnSAq58PUYY0qfduFZ2:9dS5+bBGRP0SYFHILq5q0WM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207448, "uuid": "bc9bdfcb-ae75-4f5c-8ae3-c681449755a4", "value": 2416544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207448, "uuid": "7b54a059-e39f-4206-879d-00bb9bcc21ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207448, "uuid": "4dcfb18a-5f70-493d-96f9-cfcd417ef11a", "value": "RequestORDERQuote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c925ad0-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207944, "uuid": "14ecc75f-bbfa-40b8-ba65-5a94e6bad8ee", "comment": "Malware payload (Formbook)", "value": "f8bc8e88779495f204f636e2eecd4ad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207944, "uuid": "9d7d31ba-d2d3-44c7-98dd-94ec16f795ea", "comment": "Malware payload (Formbook)", "value": "9228218645556ce72ea3edbbd15269271add3188de47ff4171e643312a010b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207944, "uuid": "3ad10386-5301-49c4-b404-48d187e51fa8", "comment": "Malware payload (Formbook)", "value": "434740b382f5667691cd75afb43540e57e9c7b85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207944, "uuid": "7082fefb-4b16-41f2-8785-9266eb0a7906", "comment": "Malware payload (Formbook)", "value": "b089949acb3b3cad994c2847c12e0dd7a1ef03965eaf465eaef334250ca124302d9534bdffeea8a24983dac887ab8689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207944, "uuid": "c62b702d-0d53-4bd9-bc73-f6f5de739852", "value": "0D25ACC09E8ABA2EC02E7374302094FCC3A36D2656DDE3E66BCBFDDA976355441906D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207944, "uuid": "94bc049d-7d64-4456-bae1-454e2f3a0326", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207944, "uuid": "e2aa5569-1664-4e83-a81f-d460337fc5e5", "value": "24576:L6gXUKkp0hlqxcc2N6BsdHh3i1hxP51G5WahCfLc:dgmqeUsdhuh15Q5WvLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207944, "uuid": "62287ab2-0be8-4a0a-a770-eb04c8678265", "value": 994304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207944, "uuid": "f443fdad-d726-4aa0-be6a-cc3f4860cc83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207944, "uuid": "01cecb57-3a77-42ca-8071-457642ff86d4", "value": "wOPGM5LfSdNOEOp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78087892-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230029, "uuid": "5fbe8422-0efe-46ec-9e54-9e04b33d594e", "comment": "Malware payload (Formbook)", "value": "c41fd90fc1e23885a1e075ce11d612e8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230029, "uuid": "3862e635-91db-4729-9321-8aed04f67f08", "comment": "Malware payload (Formbook)", "value": "9328d5dcf7664d4a92915ba032a183e63ef8602445737f42bf4d479b8037e1c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230029, "uuid": "e9accb5e-5259-4066-a86a-aa766628138d", "comment": "Malware payload (Formbook)", "value": "d1903963f15c001baceb7c0e92998bc38a19f318", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230029, "uuid": "cbab5aa7-523b-4ba1-b7df-63a79c4d5066", "comment": "Malware payload (Formbook)", "value": "0b032a3c5e3003c3708db850eec3dbe21d07352e98f5a08f6757badba04d26f83e2c58352e5ab2faefb27977c70f8023", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230029, "uuid": "e25f65b2-657b-40ff-912b-bdf7ed68db79", "value": "A8C5330979EA5E03C349DAF8C4DB4618408DDD103A641A16776CF65F76372B0FBEABA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230029, "uuid": "cfc23428-f9b6-483e-b793-7546004c3557", "value": "49152:bUq/pJZx7mCy1a3/XUms8aop6WVlswMRkVo7szzYHdw6b+75eXu8:bU0HZxb6a39sOpmwioo7sYHdw6a7MXu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230029, "uuid": "01bdcac4-565e-4b98-9e6a-6b9881b09a16", "value": 2693120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230029, "uuid": "68b89fa9-35a3-4e25-b6e0-fbe63fc1226b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230029, "uuid": "890deddf-cbab-443d-8768-cf6c5d629559", "value": "Processed APR12.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edf07aa-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208055, "uuid": "e0fe2eb2-aeb3-4335-9699-19c639d6e292", "comment": "Malware payload (Formbook)", "value": "75d9448f6884550dca51581765dce439", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208055, "uuid": "7d24263c-ba3d-440f-ae2c-8e19f650add1", "comment": "Malware payload (Formbook)", "value": "94428a043bf7444907313b0aaacedd245ca1a753db2fd0c268037f59c6d93002", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208055, "uuid": "9edfcc19-5c0f-4454-aff2-2206ad8c089f", "comment": "Malware payload (Formbook)", "value": "e397f51129ccaa4d6fe402fe0cda7cfeefdba8c4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208055, "uuid": "bf1818cf-5b9a-4719-a148-40b794888e58", "comment": "Malware payload (Formbook)", "value": "35e219fb31d0fe6a8ef188e85f5097a6700b375a753e172c88cb14024e5ec8c826e4687375451bd52e6b0bc401b6ed4d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208055, "uuid": "2330e246-4d4a-476c-b290-52674123ed28", "value": "FC451216F623D8D8FE53317A5AB69E220F31B46B9426594C308DB3257F53322406BAF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208055, "uuid": "248a1e74-7938-4b5e-aac9-0fd6d3eecb82", "value": "12288:xMGTkPvCLhm6nDabAKCcXjcgMuwS2T8Xo2i10Ol/:uGAP+hnDCAKbjxFWgXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208055, "uuid": "4b5d1364-8e4c-42be-b0e7-3fc0f0a91301", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208055, "uuid": "25334509-8e16-484f-8484-359d52a69ac8", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208055, "uuid": "2baba313-b489-46db-9908-3e325ed05435", "value": "RFQ 541120421.pdf.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa8a2d7-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235920, "uuid": "1c6e829a-5314-41e7-8dab-65c9cb7297dc", "comment": "Malware payload (AgentTesla)", "value": "893f9f6664c537f5d540be6d616288d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235920, "uuid": "775f8972-007d-4cd3-908b-124df0796e54", "comment": "Malware payload (AgentTesla)", "value": "94cf6a006229ebd5b43fd23823b11d91f51a2ed5ddb10a285bc1d92b4f22a052", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235920, "uuid": "d335852e-c26a-4ec8-93ff-efc2e2f1abc5", "comment": "Malware payload (AgentTesla)", "value": "28b089ef95ed317c9adaa72a477b22e257c559a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235920, "uuid": "d1cf8dde-e785-4060-960d-fb87afa56ff0", "comment": "Malware payload (AgentTesla)", "value": "ca515fe0add559d7106beee9a0b488bf1a2cca6c7cf1e8c3df2c80f8655a2bbbe6751f89881792f501616f677f73638e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235920, "uuid": "1e914e66-2e70-4c6b-9574-bfcc344ddd64", "value": "CAF43391FECB77B3C4EA5E54800FC075EEB6362CE80C4D1958C49E9C5A3B85A49532BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235920, "uuid": "c08ab837-6e48-420b-8641-e429c27f9448", "value": "12288:mm2KIAh79C7Di0SrolJJYRS73w+02Ut++310s4fju6x/Z04l0KJ8nU3DQvjvFFF:m/KIehC7DOolJaS73BtuP0fS61JrTQvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235920, "uuid": "172f6a52-9ecc-458b-9cbe-999eb1dba8dc", "value": 754628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235920, "uuid": "e0b037cd-11fd-480c-a87c-7ea418389fa2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235920, "uuid": "412444f7-b72f-4f0f-8892-003c6b3e13f8", "value": "MAR 2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c2de53-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618253404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253404, "uuid": "7f1567c7-1e7c-44f1-9851-2e1d4e996f8e", "comment": "Malware payload (AgentTesla)", "value": "e34880f77348bec259761a86d2e12ec6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253404, "uuid": "4d8fbf3c-e816-4df5-912b-4905420f6fca", "comment": "Malware payload (AgentTesla)", "value": "9545e357a8251a2f1b2988644b819d218d5c78df9a589d6352e6f9daebe5cf34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253404, "uuid": "a6d8f9fc-b42d-4e33-8282-1ed672d3b8b3", "comment": "Malware payload (AgentTesla)", "value": "dfde77e578f452fd3db9b58b52ea0b21fd3d5cc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253404, "uuid": "f8ac3793-500a-48da-bc88-635bf1a6657f", "comment": "Malware payload (AgentTesla)", "value": "0ee9655407e23898fd7fda0fc3f205725a78607c65c562fd12aa72cd85f0bc082fb900e344fbb9c4c69af4c2c27efbc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253404, "uuid": "a977360e-4660-4186-8618-17392bdc0fdf", "value": "550501A567AACD95DC3E0BF528B1510003B5AD098527E20E60FD393F3E733D285AB75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253404, "uuid": "89141437-6ce9-43b6-a001-3d65aa41a734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253404, "uuid": "5baed141-9319-4db3-9d05-d095193e36e4", "value": "24576:1QhBzRUqwJUTzVdkUtyzq0GD3KdOWpz1M:2fUq6UPV5/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253404, "uuid": "e692de03-7f85-4f68-8523-2660945af0d4", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253404, "uuid": "a22bdeb8-02dc-4875-923a-ad7733b2ac6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253404, "uuid": "afdfcba3-23df-4b32-9d1b-c7a97735ab46", "value": "e34880f77348bec259761a86d2e12ec6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faccd6d0-9b98-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618236690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236690, "uuid": "a47caca6-029a-444f-967c-8be3989a17c5", "comment": "Malware payload (AgentTesla)", "value": "89e6403280d5500d8644f70b688f74e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236690, "uuid": "35406074-ffe6-4857-9bbc-2ff0510999ff", "comment": "Malware payload (AgentTesla)", "value": "9550766fd28f726271b31d179f082c0cc1b95b331d65d9161ccfb96c4b42ed6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236690, "uuid": "f6caaed9-cf25-4367-8d0b-77eaa47495a8", "comment": "Malware payload (AgentTesla)", "value": "b8f62688cbb40c76b9c63551d8a040d5d5bd7215", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618236690, "uuid": "d5aee2b8-c011-484b-a140-fed5fefb65ad", "comment": "Malware payload (AgentTesla)", "value": "a1399e1948bc1be0382261efeca6d5751dcb39b7ec9fc537d1866e35e1a1892b31ca69cd2a5ca56452a9b93bcce71235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236690, "uuid": "3bcbb802-d3d9-4c3c-909e-6e22e8e8e092", "value": "61F43307A332D872584B263362F72848D337D1D0DAC7CE6369414B336B63E57899B986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236690, "uuid": "daba2b91-d76d-4323-8370-f2916bd02ccd", "value": "12288:JLyLavlE2aKppNz4FqXgALVRff7W7kjUpysphbbAY5G4VFr2HLchbiNHNIjxmq:dyWvlZaKrN8F9ALvff7WHygbUY5G4/bZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618236690, "uuid": "f76c77d1-bcc7-460e-8118-dded54c38020", "value": 726580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618236690, "uuid": "2bf600fc-6efa-4d16-871f-8a8d698795f8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618236690, "uuid": "0e8a6b48-8727-45c5-b00b-af7203b2ef1e", "value": "Payment_Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa5b2a5-9b9b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618237925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237925, "uuid": "ac80b6bb-ab01-492e-ba9b-4917282d5c0c", "comment": "Malware payload", "value": "4fa48f514dd9d46e00bb33becb89f6be", "object_relation": "md5", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237925, "uuid": "aeac8cea-f8ff-4e62-901a-a22766c85219", "comment": "Malware payload", "value": "95b2fda9f43bb360e283a1c049fd06c686646415a0e9ebd93943df6d76dddd7e", "object_relation": "sha256", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237925, "uuid": "a5d67967-5ab2-4c38-8edc-9a61b7665d95", "comment": "Malware payload", "value": "19148c24e53b6b04020acedae9f60eed4f9db943", "object_relation": "sha1", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237925, "uuid": "1188e9a8-e762-44f2-a532-81c084b7db64", "comment": "Malware payload", "value": "48eb4ad51e033957d3a7405a2697a2cd16be68aa64c8610f92ece84e51ed3ac78eba25b0b5264d83cb0a7b27c16ba14c", "object_relation": "sha3-384", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237925, "uuid": "c42285c9-ab07-4767-81ff-070b5e73052d", "value": "1A656B4BE9424F67C9AD433E54FB036073757544AB438B57041AE2B8FD432D1ABEBA88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237925, "uuid": "6aee88f1-aa54-4bb1-9942-f273849fae8b", "value": "24576:Ag6365XIulSVaDZu94hyIP9rol78glLNBcm/5VO8opyQr:Dfdklo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237925, "uuid": "4ef24b7d-cea1-4b40-9277-5c76577ccf45", "value": 1536508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237925, "uuid": "be3a5887-4991-4ede-983c-33f8da131641", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237925, "uuid": "a8c6a629-ff66-4e36-a36d-115f8ac226bf", "value": "classes-v1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06de0407-9bb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618248307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248307, "uuid": "0de90827-74d8-4e45-953a-fd24e79fdad6", "comment": "Malware payload (Formbook)", "value": "b5e79593a67940d39fb6ef30d83e46b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248307, "uuid": "fd72f959-8f18-441f-acbb-8162fef1356f", "comment": "Malware payload (Formbook)", "value": "95f895f0fa6ca71614c6a00738f35ef6c7b21721b6657f273b79a4b3c85c4e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248307, "uuid": "4cda5c9e-595c-4603-afef-0b0d7df25d61", "comment": "Malware payload (Formbook)", "value": "3ffe5e10c5dc15672b6ba59607863efc3dfedc9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248307, "uuid": "927a1c92-f46a-432b-984a-3fc05dc4b2e2", "comment": "Malware payload (Formbook)", "value": "5853f9406bd50c5bd766b15c974514f4ecaa487c58ab1c96b0e0e639ec5824252bedac601b230610f7af6d1a89616606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248307, "uuid": "02ce827e-491a-4e59-867c-84dc79a671f5", "value": "5C241323B2F09A33ED174DB10EBA957ADBBD4555003133431FF08A7A7D2A9D2C1292E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248307, "uuid": "c3de65b6-c01e-41f6-ae67-89b4d506d76e", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248307, "uuid": "e881b22d-7150-422d-8cd1-50082e8e7af3", "value": "6144:HdYaJQkisnQCTOMrTaka6p5ErSr2S6M6J/K:DJQkis59Br2/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248307, "uuid": "dd514f8b-19c8-4aa4-868c-317e4fa5e7d6", "value": 227562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248307, "uuid": "d8a64674-aed4-4d4f-ad1a-16ea8275c330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248307, "uuid": "5f477364-3d25-46f3-b32f-5f248dae4b40", "value": "Doc.70035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfde445-9bbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618252990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252990, "uuid": "f3807cfa-0eb7-4e9d-820e-e46d8e54e051", "comment": "Malware payload (Dridex)", "value": "1267ea32156f03a5c4c893da4fbbee9e", "object_relation": "md5", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252990, "uuid": "1db12134-6dd9-4630-9052-32e584bf4383", "comment": "Malware payload (Dridex)", "value": "96db4ec33cf5d06c782e333675d84017faab807c4bebe66aa3ccecaa9a42388f", "object_relation": "sha256", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252990, "uuid": "ade94014-bca9-4496-85e9-a86800f113cf", "comment": "Malware payload (Dridex)", "value": "8a933653973179b23dfd043d145931c8a2b2ae98", "object_relation": "sha1", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252990, "uuid": "7e462ca4-d54c-46e9-843d-a65b751d69ed", "comment": "Malware payload (Dridex)", "value": "15f654652c6140e5ce28387c08d0fa80bbc552a751c77ceb60a268997a2b3980ca89a6f6d89b69bd6a5afe5f6505c2b8", "object_relation": "sha3-384", "Tag": [ { "name": "40112", "colour": "#3CFE62", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252990, "uuid": "8f33924f-4733-4e25-abea-6a9f414798a5", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252990, "uuid": "7b2b47e9-dd02-4b8e-9c8c-1279f5f47205", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252990, "uuid": "84f15abd-8ed7-4eee-a6c2-b786f81894c6", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618252990, "uuid": "ff381c68-dc43-4400-a145-aa94618d8189", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618252990, "uuid": "6ad7057c-b9ea-44f3-a0b1-d6a2a5f405c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252990, "uuid": "17ef4b7e-7336-48d2-8e5d-eba9d7695f09", "value": "1267ea32156f03a5c4c893da4fbbee9e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e26dcd6-9bdd-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618266063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266063, "uuid": "4a9f586f-93f4-45cd-9c8e-07628f3ff412", "comment": "Malware payload", "value": "e58b0ef1ef50c4a838391379ef04c004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266063, "uuid": "1dade4e4-abd0-45dd-85d5-37ea4a27615f", "comment": "Malware payload", "value": "96dca0919cad781d37394c458a80602424417868cb506d3001ebf453fb880057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266063, "uuid": "4d16e612-9d7f-4221-a211-af4d7729def3", "comment": "Malware payload", "value": "011a2044e09e893d7571bbfb6302a3d4bf31330f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618266063, "uuid": "012fdd46-6bc0-449f-9d6b-8c0d42744086", "comment": "Malware payload", "value": "188b505c5f76305c3c79ca063e5e98fb19e5905565d13a5f05571c7a558fd6edd6249f8859b4502c091b54cce705f135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266063, "uuid": "d9d36272-2b7e-4ce0-90ee-9acc9e7ce71e", "value": "33E4CFA5DA84CB50DD3EAB7910321D1503F3FD5AEB31E64CADAC70E51AB36C24532A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266063, "uuid": "4843b277-0082-40f4-b7c2-54b01216bc6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266063, "uuid": "f6908a9a-43b3-4db1-ad02-9efac8f4b3af", "value": "12288:mRyFg8To3wZ7A/K826sNsPzcH0bsvQ4bm8Bpm5qMS8XJK:AIsLU2so46epmUMS8XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618266063, "uuid": "23ea586e-0246-4530-87dd-34444160b3fe", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618266063, "uuid": "d595332e-037d-40fb-b2ab-8dcc175ba620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618266063, "uuid": "649fd2f7-b89e-457a-9495-e0240dabb4c2", "value": "HOGA2324042021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6437faa0-9b3f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618198213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198213, "uuid": "319b72f3-29f2-4314-a2d6-d7077c5ce5f6", "comment": "Malware payload (Loki)", "value": "712d96a04e0f45566ca93b89d6a78380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198213, "uuid": "4fed4862-9df0-404e-8be5-e51d7cc0fe3b", "comment": "Malware payload (Loki)", "value": "9731e42149108584580a300cd09e22f243ec673b804205ce2bb8b21a5ddd76d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198213, "uuid": "8941e522-3bee-4b16-b0fa-02b6d8b7d87f", "comment": "Malware payload (Loki)", "value": "4748329b74b5c4692b7efb85ec05c019a65218d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618198213, "uuid": "c62efd4e-f6e6-477e-ae90-919f9fd254df", "comment": "Malware payload (Loki)", "value": "8b7170a72a447833c829bd7a9b59482db3554c767f3600f2ff04c46b0a15a2048a7020e30cf9382d209bca7b2636a7ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198213, "uuid": "d5c4d9a9-b899-4c8d-98d1-a22c161bd309", "value": "03E412165F4C4B3FE67E14F48935906253F1C4E22FA2E74AFCF470E819A27DC8A6119A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198213, "uuid": "b3ec9dc3-536f-4038-a70c-4cc433c14ec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198213, "uuid": "b258b1c0-1e42-4acc-85de-ffab0f0ae57a", "value": "12288:bEn61bXz8p8ztlPPN/seZVcfczRw5kpRAyoqYQTKqKa/phRbxlZMuaB5VRs7miE7:gn61bj8p8ztltVaczSkFR94aJNvMuabd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618198213, "uuid": "dc5bcc9e-b351-4218-92a5-617b7b7839a7", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618198213, "uuid": "52f329cd-5b87-41c9-8a02-2bf2b803a959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618198213, "uuid": "b233e51f-4b38-406e-8a52-a158357c2851", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d586f2-9b6f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618218756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218756, "uuid": "a28e4edf-d764-4e64-b113-9543ca1d5e2a", "comment": "Malware payload (AgentTesla)", "value": "669b4375f4f8af8af78abdccb3ff6ec7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218756, "uuid": "6022876a-a10c-49ed-9f9e-f9348f687847", "comment": "Malware payload (AgentTesla)", "value": "97c5e6525bcb02ae907130a7520c441b1526e0c20fb9e9ebbcdc29f8c848a6cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218756, "uuid": "1c22a733-7e8c-4e96-96a3-5ae5893d4e27", "comment": "Malware payload (AgentTesla)", "value": "e64c971cee60bf56b64a14fc63cbddf3cbf5b45b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218756, "uuid": "e7dad2be-4336-4388-8b83-79e0459ed1ab", "comment": "Malware payload (AgentTesla)", "value": "008e4086e578cbf7a9abd558da1c365497a35f0cebba74e3a6cecf0e541e272632d17d2e7ed6d1baa0755be35d0da269", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218756, "uuid": "c22f9085-34b5-4708-92b7-8029bb98cf13", "value": "84F423EC9FE436BC046F162EC473590538337A4AAA6354D28C784F3BA54607EF6DE690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218756, "uuid": "6dc7dad7-a462-4da2-88b9-4581a8b4021d", "value": "12288:2lOn/bzHzi/3jHifr4nEkSo2jDhekT23P7MJZKWOdwElwiZPyTA9A7L:cEPHz03bifEnoo2jd6P7mK/JlXPyToAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618218756, "uuid": "602763d4-e553-4912-892f-786849ba6d03", "value": 728363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618218756, "uuid": "841e588d-bc5b-4787-b8bc-69a6a6d81c04", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218756, "uuid": "7590734a-ae9e-40c4-bf66-297aac9c5aa1", "value": "Remittance Details,.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4a4693-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207464, "uuid": "88403e8d-691f-4b3c-b272-1bf123b5457d", "comment": "Malware payload (AgentTesla)", "value": "b0732087e51ac577457b63c5ac4c1d2b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207464, "uuid": "6329098a-14a4-4ea3-8547-b56d8b940226", "comment": "Malware payload (AgentTesla)", "value": "97ca015faecee9201a0f29e3c8d02ac4fa77bbf6cade68f329459c39ae4ba37d", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207464, "uuid": "5d213092-8955-45ec-8987-060ee8f42a18", "comment": "Malware payload (AgentTesla)", "value": "8a26ebe5727d1842bebe515153da2587f5c359a7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207464, "uuid": "6ecf178d-6c96-4cdb-8323-a3a74fd66a51", "comment": "Malware payload (AgentTesla)", "value": "cc73b6b97f783a50ea851ad8055078ec095f3c4d7a83e743eff31f4c0518f54ce0589f800193f654aed9b2a527aba063", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207464, "uuid": "fd56c4b1-fa88-4008-bd03-a1f14c31af66", "value": "24F4338D47B8E0DC18E6F4848FF974A66257DD77F839E3CAB6D47838420A85C94E8B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207464, "uuid": "dfd70bfb-baca-41c3-a054-926b91dc91ef", "value": "12288:6/08n5+gMyYBtF4TUXhvOHf0IHw+Yxywu4uVIRzxUY9FRrRN/zNjsJL72dMuYA5:6/085lMDDiURvOtQdxywujVIRznTR1Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207464, "uuid": "d24a7057-b681-4d80-9b0c-3451bb498f9a", "value": 772522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207464, "uuid": "5c298de4-e42a-4e1f-a479-8ae4bc276ead", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207464, "uuid": "5d87da60-c0d4-42dd-99c1-5b3df417fdaa", "value": "Quotation2001100200.PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798f0fef-9ba9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618243775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243775, "uuid": "7c587d01-4e39-4bb0-b1b1-de7b9935e67d", "comment": "Malware payload (Formbook)", "value": "25a21da1a53c4a37cd18fa653bf608ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243775, "uuid": "6ada4f4e-af19-4c29-aa21-4ad0829337c5", "comment": "Malware payload (Formbook)", "value": "9828cca70146c05504416707e7ed4d4f0e5e0987a8bc25d76e4b3f80123721a0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243775, "uuid": "c852a838-dd2b-463a-b947-8896e8a474df", "comment": "Malware payload (Formbook)", "value": "2879f2cc0798dc4c620f8c22cea1b81f45ca8510", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243775, "uuid": "13f04475-7e1a-453b-ba70-f232c80d564f", "comment": "Malware payload (Formbook)", "value": "0149f845c55abc629840cfa4cca31bb84ecad673df7d34918b7e3006a89c100f1546a9566ba60266b42e07c23c603c75", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243775, "uuid": "fd4b6960-caa4-45c7-9e61-4e35ffa8b7f6", "value": "9D05022D67E49916D9BE0F7558E192101770B1607B23E31EBE6C50AC2F733E2976B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243775, "uuid": "1563244a-2c59-47d2-b3b6-e0719f8bee4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243775, "uuid": "d150171b-33fe-4c26-825f-35762bfbdb0a", "value": "24576:CCEvjLtnM/oNJwgbm21u0eMFFzDyhqB4qlErWYTV:HP/KGL280eyPZTl6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618243775, "uuid": "8177c1db-8bb6-4556-8f71-65c08d882a68", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618243775, "uuid": "b56ea7e6-a425-41d9-8417-705ad270aeda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243775, "uuid": "80304265-816f-4426-9df2-f27888fcbfdd", "value": "SecuriteInfo.com.Trojan.PackedNET.646.29811.14442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b451d2b-9b95-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618235134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235134, "uuid": "0498e7d9-4756-43fb-9e3f-abcd7befbf35", "comment": "Malware payload (AveMariaRAT)", "value": "b23af6c6f1a909df7d67de1e4c2aaa8c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235134, "uuid": "9ba1ee95-faa9-40ee-9385-c19e737b83f6", "comment": "Malware payload (AveMariaRAT)", "value": "98bfe099448bb6fd9805a64eef2cdcf84c7ea5ac8112540d5f21cc5e8294ed94", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235134, "uuid": "11dae404-f988-4c69-8dc7-cb1d96c5ca3d", "comment": "Malware payload (AveMariaRAT)", "value": "197d74e8a1d544f8e58b576b7a9944cf3dc1e802", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235134, "uuid": "16c74a25-6f2e-4b9e-97b6-69ebe74ffff5", "comment": "Malware payload (AveMariaRAT)", "value": "91650fa7ce27e31e15f59563c667b351b8949155447a6051d90f0186de72088c3c15aa0a791c329cc2b0144bda07472d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235134, "uuid": "92d78ded-73b8-46ae-8104-725d31e6ae32", "value": "0E853AA057C0525FF5EE923987BA5B604578D2E6AB500ED703C497C8AE4C3EEB43C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235134, "uuid": "59eb85ed-1e86-42d1-a65e-c7850d84ee41", "value": "403dd600b89f7fbd0ff9bd9eb624c5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235134, "uuid": "02d079cf-c5b4-41c1-8f3d-b7e451a296fd", "value": "12288:trDRwp8F0xFZqtUQxEEnZjPyKcPb/hKc9+94NVpmw3EzxBllk:tIe0xFdQsKcDkcYi/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235134, "uuid": "2fa915d8-963e-418a-b35b-9024a3b41fc7", "value": 1857024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235134, "uuid": "0dbea55b-a895-4052-b6f0-bf5bf70f58bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235134, "uuid": "7680fef8-5dde-4ad6-885e-a06618663175", "value": "SecuriteInfo.com.ArtemisB23AF6C6F1A9.18153.5594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2289961a-9bcb-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1618258232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258232, "uuid": "5a4b8d00-e04c-47b6-9d1a-153af3c3c5e3", "comment": "Malware payload (Amadey)", "value": "4eb21d088f620a9f5c312849430476f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258232, "uuid": "d984c929-2e5d-47b7-89f2-074071e1fdc7", "comment": "Malware payload (Amadey)", "value": "98d1aae2b75e1bc8086558b25489e6a808ecb1cbd361b2ddd9cc8c8ac6d7f03b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258232, "uuid": "45d5e8de-a4dd-4bdf-80c3-6328691bfd31", "comment": "Malware payload (Amadey)", "value": "3b882b42b65067530fc51f490dd06b4ce2966acd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618258232, "uuid": "f0a1118e-03e7-48cd-834c-d571cddf7831", "comment": "Malware payload (Amadey)", "value": "eb0b5899e6245b09fbaa8ff85ab9e4c9b2708f4a4877841603e0b4a453daf0428097d08b98081dd1bcb56009a5af2fae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258232, "uuid": "ed336727-267a-4f7b-b411-4a4b50105099", "value": "8354CF0073D1C032D083617A8625C7B59EBFB876657AA98F7FD50FB94F242D19B2A309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258232, "uuid": "f2a61718-20d7-428f-b7d3-ffc7791c9cee", "value": "e124209f91a98dbd65697c49d4798cec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258232, "uuid": "4e054bdb-358d-4d05-b28f-61f8ef754594", "value": "6144:b1LhHngpYRCMJ7prwsHic2WhzNN1vMT2xdHxJ:5FgpYIMJ7qkiWJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618258232, "uuid": "4c0ce6e7-a38d-43c3-84a9-da4d121f7bb5", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618258232, "uuid": "103d8b5e-74fe-4f81-86af-ffe7a0be7d46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618258232, "uuid": "66ffc0fb-b6b4-4a0a-98d9-a7e00390e708", "value": "4EB21D088F620A9F5C312849430476F6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c01f1e-9b9b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1618237895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237895, "uuid": "3f5185db-5c10-4a01-be77-3b25ebf6262d", "comment": "Malware payload (Gozi)", "value": "b5696f2f15b78211565a1a9ddcc95f73", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237895, "uuid": "3cc76ad1-ee07-45a2-9d5a-1537675358b4", "comment": "Malware payload (Gozi)", "value": "98edae6374d446f0e4a26cd0b03c113457a98f63b978023b002bbe1dd506f0e2", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237895, "uuid": "e3258f13-c79d-4848-bd55-90ca6b5de4b4", "comment": "Malware payload (Gozi)", "value": "f9b1e2cb5f88582a36d1298a17e11e5de026c497", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237895, "uuid": "d1aa29d2-0e71-47ec-bac5-1ae77a765960", "comment": "Malware payload (Gozi)", "value": "a39cfedb6c2883a2575945ada711b43dbe4a308894694a149cca53b69f85eaab208764549f12d65258aa0b8ab80ee025", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237895, "uuid": "f8f91c08-17d4-4083-a434-3c5d57d6b40a", "value": "74246D6AA2E40195EDBBDAB5CA52C61BE7F334051B68C70F03B4CEA56F57331B218352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237895, "uuid": "00bea1b8-fe77-4d53-b007-54693c62d601", "value": "3072:/f0iSwbhJlRNAw4YboaEzitrOd9TRMm4hp1P1Pc3vrtrwrcGvjyKg5kw+SVl7:VSwbhZNzizeOd1VMp1NPAjtrGjs+0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237895, "uuid": "151a0764-05fd-49f7-9bd4-2b99ba5b8fee", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237895, "uuid": "408375cf-bb3d-41b4-a3e9-73868101424d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237895, "uuid": "04d6d5ee-664a-4093-8308-6af043ab525e", "value": "aa90000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3cf4e8-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618214443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214443, "uuid": "8cb48a2c-71ba-454d-b960-fec76b7c79dc", "comment": "Malware payload (Formbook)", "value": "36cf33e57ccccf3754b57ab14e623e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214443, "uuid": "09bc5ea8-1ab8-46fb-ab33-cb4ea74f2c41", "comment": "Malware payload (Formbook)", "value": "9914c8ad9ea0318f57214c6eb2f2e3f891b71ba054a9de071432ec92eb6bfe0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214443, "uuid": "53a66be7-cb06-4ac5-a7a4-6a202b599f51", "comment": "Malware payload (Formbook)", "value": "f54422966fd1e5f8180f618a51c938372d3711be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214443, "uuid": "48f46497-17aa-4519-928d-ffe3f5435230", "comment": "Malware payload (Formbook)", "value": "6ca5d0f33e4763bc83934773d8664732e6dd94f9742629a75850b97624a907a73307dd21fd9392643ba304065eb75735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214443, "uuid": "e672f0b2-7202-4015-b885-ff88022a5f64", "value": "BE845BC1E089F9E5D82510B5457A8530611FBF7FA8E486762D96752E20BB383B0B7E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214443, "uuid": "05d411f8-704e-4202-b016-41e668a59302", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214443, "uuid": "751f36a7-8b9c-4ab3-b67d-511c4829b233", "value": "6144:bd5+vAz3kwJcM25Py5Dniq2GMo0V8CvM7lSPOs90Zuz9QDN3OloB8Te:ivAz3kwJB0OBSDiYWDdOmCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214443, "uuid": "6b99d8e2-e15b-4ece-ab04-2b7f08ad8361", "value": 394513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214443, "uuid": "98054c4b-6bab-4415-ab19-c08698353d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214443, "uuid": "f8ee96f3-2563-4454-8414-d6b79e4ce37d", "value": "36cf33e57ccccf3754b57ab14e623e57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9199382c-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207738, "uuid": "2f66f9f4-cc92-4104-beab-2df43eec7bd9", "comment": "Malware payload (SnakeKeylogger)", "value": "ed71b955af6c4ac35bb7ebedf73f4e13", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207738, "uuid": "0e0219ae-b612-49c3-aa84-2b2685c7b40a", "comment": "Malware payload (SnakeKeylogger)", "value": "9928b92ab1e73249f0352cd0d2e841f158e686653cabf6794d8e50fabcc10b8b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207738, "uuid": "04d426a4-0dd5-4ddd-8c3f-d48ba864c400", "comment": "Malware payload (SnakeKeylogger)", "value": "6763e38dbd942caca191fbc255c1a7b56943a6ad", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207738, "uuid": "45a6dc12-7324-4f33-87d3-53584585ae73", "comment": "Malware payload (SnakeKeylogger)", "value": "84402637a99d781b01d3b31222a137e47adce62e6da3ad4a1d0f4cdc066b2533ce0e6632811938f4318bd701cb435aa4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207738, "uuid": "413551c4-f9df-44f0-92d9-3045f8fc68f2", "value": "3D25F15131AC82D7E4BD4AB2686AE13013F5789DE29AE10F3D8E77AD22B3341451E73D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207738, "uuid": "e99498d9-f20c-42a4-bf4b-1447830ef942", "value": "24576:05iUB46Q/hZiwfn4p54uZiBqO/X+MkVlWp:QJBOJZiwf4b489M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207738, "uuid": "913d7053-dee7-400b-90f2-6314b549b454", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207738, "uuid": "63605771-cd48-409e-a15c-9c96cd7e499d", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207738, "uuid": "8ece2627-83d6-477c-a20f-bf10b1141c1a", "value": "Confirm Order for SK TRIMS INDUSTRIES_DK4571,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded836a5-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618225047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225047, "uuid": "d2b5a6e6-5d8c-4ba1-a3fe-4d6e63dc1737", "comment": "Malware payload", "value": "a0ec8a66e481db30406efe417396138b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225047, "uuid": "a930d166-c240-4e1a-909c-13f4083f6c7f", "comment": "Malware payload", "value": "994a957818756e1e374f452b604456d5f2ba638a7b7a3fe5a186bef82ba6193a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225047, "uuid": "d60b466c-d6de-408d-bb40-3caf2ea5b27f", "comment": "Malware payload", "value": "c01c96a3c1b644dfa9256cc5694d31dfcc046cf8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225047, "uuid": "22a36c77-7681-4a01-9324-e676b964dcef", "comment": "Malware payload", "value": "d31444044c66935cf3f76d5acf7b0cda1c0c75b17616dd43f33829c5c169637d0b76dc35b8def5d88af8e02c54706ddc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225047, "uuid": "ac6c5445-2727-47d2-a626-3e1c7dcbc9ff", "value": "F2934D39736CDA25E67C4AB46470212A47F1E1CB2021F79B8EE1ACDA2E2778177045F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225047, "uuid": "4c713106-2041-469a-a210-33ea9af2a7d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225047, "uuid": "7ce7348c-fa4c-41b4-a9ad-939cda06a40f", "value": "1536:8bFrZPEsPfmvHIWYV/p7OcOxV6T+TZ1AQFuJQ4XAU93Mb3ArH+Sof5bRymodretf:RvvuYT+r3EWHyf5tyddSzKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225047, "uuid": "e14c3424-a776-4bbe-8aec-f5acf67c0357", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225047, "uuid": "a8d6eca8-85a2-4b16-b761-f33f222eec09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225047, "uuid": "704f74a2-d633-48bf-a34e-e88d704722de", "value": "SecuriteInfo.com.Trojan.DownloaderNET.108.5931.15613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cfb9ae-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230216, "uuid": "7c659e36-7504-4584-b60f-4eac3509c2f7", "comment": "Malware payload", "value": "f65d56538360398ccba1e7036182e6dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230216, "uuid": "943e5cfd-77df-4859-8c44-899f06a2b3a6", "comment": "Malware payload", "value": "9ad9bcad175f5c88325d8a589d38b63c16633ba2f295c8926455f02d3c682db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230216, "uuid": "30853503-9734-41cb-945f-87e5652cd22f", "comment": "Malware payload", "value": "dc5a539be1d59000dd214d3c323629a38a5a1558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230216, "uuid": "e100545a-8b8d-44cf-b5e9-741c72fc6710", "comment": "Malware payload", "value": "1664fa7d562ab1b6d374ce79104523818b5ba8a739a80d071e2d109ce620f25f8a9adbf84eae77e75a98fd51bbc2d190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230216, "uuid": "2e0b9005-bf0d-40c7-9fb4-888b892928f6", "value": "EE53F12BFBE2C061D15CA4700D4B0D589FE49E674A08012B56F6A48F5FF53837A259DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230216, "uuid": "3d708c15-a351-4ce0-be48-69ac21634af3", "value": "2fc48abcfc4886d28d2790323d96cffb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230216, "uuid": "4681110e-04a8-421c-98bb-3f963fa2aa5e", "value": "1536:d6jKCZZi9V2EHUaRF9fhLh81QLL15/hsIR:eKV9YKfh6iv/+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230216, "uuid": "a5f2078d-1673-4d2d-b545-d833e48f0329", "value": 61896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230216, "uuid": "4e92a5f3-03a0-42ee-9feb-8ee95ba7821d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230216, "uuid": "b81a0d61-0f87-4782-b503-c16800fb1602", "value": "updt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd7fbf5-9b51-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618205797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205797, "uuid": "cef9f059-401b-49bc-940a-d40ceb23077b", "comment": "Malware payload (NanoCore)", "value": "216f2652001700d1f7ac1109a508ce2d", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205797, "uuid": "77aac989-971f-4378-8456-077c8081e153", "comment": "Malware payload (NanoCore)", "value": "9b393f90c5fa6aabf671d0f80a9ee0e4f44330cd3ee14dc0d9066f978d9435ff", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205797, "uuid": "52d1413a-8c4d-4edb-9ef1-c311a4102092", "comment": "Malware payload (NanoCore)", "value": "82d3a0b7bb096d03f9f1a4de5444c216849d576b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205797, "uuid": "b3724d3b-02c8-48de-a1b3-267281499e8c", "comment": "Malware payload (NanoCore)", "value": "be565c77792414b004ca0bfd8068b8c4a8caa66c36efdc087e483f311695118e0297f3ceedd4c83a2df0a1ef145e176e", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205797, "uuid": "603b05d4-625e-4f08-9392-6c6904f57f8c", "value": "79B533D8B08B8B43C16B997CF359F1961C2A5F22A1B4CC1236D6B04258B77B897DD1CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205797, "uuid": "17eb6b7c-e12f-4a0e-b109-f40658fdc26e", "value": "49152:RgiTzvPAADDhb9t8qo8hcgu9iMi7SFIMYb9QRm13KFQtwLK:R9vPAAXhZaZX9iv7C1oQQcqwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205797, "uuid": "15f31e7d-96c5-4f3e-bba2-d23bda5c03df", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205797, "uuid": "35b993d2-6c9d-4972-8011-cd97c82c4f50", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205797, "uuid": "ef54d713-9979-4866-8e50-82bed16c4619", "value": "SOL2021-03-14-NETC-NI-21-049-CEVA INV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8aff59-9b53-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618206654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206654, "uuid": "2c47397e-8088-4cbe-af7f-899efebb5c33", "comment": "Malware payload (AgentTesla)", "value": "eeee3fbf33adb9bc197f2f1c67f33760", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206654, "uuid": "7fd67bc9-e203-4e96-b47d-faf0add61846", "comment": "Malware payload (AgentTesla)", "value": "9b49414b561762377b8620fda9cef607cbef08a07a33e94cb475f2730355fec3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206654, "uuid": "61fe9257-4282-41e8-90f9-a8a06f307ebc", "comment": "Malware payload (AgentTesla)", "value": "e7b22764a1b53741b15d8887253062d9bba35128", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206654, "uuid": "e304a4d0-7bb8-4824-aa03-0fd5ffb1b162", "comment": "Malware payload (AgentTesla)", "value": "6fc08e942b77e5e8a9e1801a16d399e3a507af248cbb91514f3ae5ecf14cb20fa0baae3eb80608f11714aa3d4e6cd163", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206654, "uuid": "df1bcfa5-d859-4eb0-a96b-cccbdf3cb2cc", "value": "6405024E6B889371D0F91BB9592099505BB8A40FA742E21E3EF5FDBD3873714C24C7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206654, "uuid": "e4c4eb85-ca28-412e-a946-b5faba3c8162", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206654, "uuid": "e2cb70f5-3260-4e44-8220-6a3df20cf679", "value": "12288:hSKvwTTVbSS99cK6fcvXS6c/p+V0X3GguNMjj1iiYXR7U7:hp4n5SSvcdfcq6IMa3GguOjj187U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206654, "uuid": "bc58c8ef-098e-4e21-9237-dc1aa7f2d411", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206654, "uuid": "296462d1-25c4-4c83-9a31-2e039a7ace75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206654, "uuid": "f01335b2-4c03-46c6-9ce2-c4222c1c5ca4", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed05a48-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230094, "uuid": "49af9c16-e9ac-4f04-80e7-6e5a6f100cf3", "comment": "Malware payload", "value": "675d82e79dce0bd4c82c970d7a72f240", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230094, "uuid": "8cdba649-3965-48e6-97e5-959696c7f5c3", "comment": "Malware payload", "value": "9b503183bec767c34370231bb3b3218b75698aa04f2aebec64c17bd2915ea2e5", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230094, "uuid": "c79e2f1e-ac87-4d24-8e61-3c0c4da20dc2", "comment": "Malware payload", "value": "1b56743c4f112f3d545b39b07495c3f42105dfb6", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230094, "uuid": "361574f6-5b88-4c9c-b3e4-45c6d6530284", "comment": "Malware payload", "value": "cb344c2cd072cf2a80a7b6cd2dd6fad3cd05fdc9f573b5cb7640e7955a35d89dd211766169fc1dd23a71085932425273", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230094, "uuid": "09db5f69-6374-4d38-a96c-23c4be02a4e4", "value": "EA9164CFDE5240523422F15DBB87A905A39FA80EF661A2DDF90FC7548B7C48701AD46E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230094, "uuid": "d7e85129-4e7b-4b86-b277-403381b22a03", "value": "48:rCT1bHsEpUFaXTf4QX1tZlXSGtD0MuxBCxpKn1we:KLs30hbxmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230094, "uuid": "5dff9160-0bd8-4733-9484-d17457d9dac9", "value": 4218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230094, "uuid": "43b93e6f-9e39-4e7d-bc3f-c4c3d5d73742", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230094, "uuid": "126e90a0-0707-4396-9e77-b071d4c224bb", "value": "QI57.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021e617e-9b80-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618225965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225965, "uuid": "162218a0-d72e-44be-98a9-b5561ad5c0ea", "comment": "Malware payload (RemcosRAT)", "value": "3e10e823dea4b76f6c615ecc4d0b0f2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225965, "uuid": "581d2398-7b50-4fb8-98c8-c819f60f4d1b", "comment": "Malware payload (RemcosRAT)", "value": "9b60c56b8f7498f7e371f406cfaf73b30b31de1e687e911e96a7e448e1e6e781", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225965, "uuid": "8017b315-f5b1-41a3-827c-a652cd6fbb2d", "comment": "Malware payload (RemcosRAT)", "value": "862fb80840dcc8b710d53cc0af505ed1b7d39374", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225965, "uuid": "b38a4597-3812-4a63-89fd-f4b0c07778cb", "comment": "Malware payload (RemcosRAT)", "value": "d861c6308cdf675a66b18aa3ce70dc387384f573fec971a79e40cd71070fdc3d965566c0bd6788a41779943c0fcf0f0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225965, "uuid": "2592d7ad-2f24-4dc0-aec6-3439d90aa73d", "value": "8105AD33F2E18437C16E5A3D9D2BA7E89826FF11FE64994A67F40C484F357503A26293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225965, "uuid": "90c69d6d-f84f-4b7b-94d0-3e667af6c82b", "value": "12288:FjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c0WKRmpW:FjMmMH8XEgfqFDd0WK8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225965, "uuid": "8c430042-663d-4045-9940-19d97ffe824c", "value": 811802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225965, "uuid": "4b0b3dac-8def-4e85-a5ea-8906c7dddb04", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225965, "uuid": "43b96b3f-7254-43c9-98f7-e25e9bdd38a9", "value": "docs-00425.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f269967d-9b60-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618212625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212625, "uuid": "f2de9afb-8cd7-4fa1-a115-5e052cadbf6e", "comment": "Malware payload (Loki)", "value": "9551c3fb2d30f8a1241759a1c860512a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212625, "uuid": "26bc03ad-af67-440c-8fe2-97227fb07526", "comment": "Malware payload (Loki)", "value": "9b6df093d8dce111a7b89be6ab67723a33128905257a779cb3c52fdc695eddaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212625, "uuid": "5c896278-b512-4e2c-b22e-b025208cdc41", "comment": "Malware payload (Loki)", "value": "e53bbc4d2a21813bfefe1fa16fe255d596bbf685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212625, "uuid": "4c92c27f-7021-41f5-a122-0224fb4a1717", "comment": "Malware payload (Loki)", "value": "aad29476ac80b7e8109eda05ba926a6a247e79b368f81f291e371fb04ff0578835191974342d018caab80fdc1d0fd1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212625, "uuid": "ba8ea8c6-3c66-4188-b553-ac6e8f49388c", "value": "10E30265B6C0AC67EA179F310A7F6B3AD1738342242295470B80BE67772B943D53F18D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212625, "uuid": "8fa03dcb-0feb-4803-ae43-d47c76a2edb3", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212625, "uuid": "3e19004e-d0bb-4de6-9884-00a3a299c28d", "value": "3072:HyewmN4skJ6TkyQMhDK+NXJKaa0I2KmNafiEQKojHu9HUoq:HdfrQMhDBNXJK3IIW7O9HUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618212625, "uuid": "039380a8-6406-4121-8897-2ab04a64af76", "value": 148744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618212625, "uuid": "d63456d1-0185-43c7-ae4f-a4fc92493bb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212625, "uuid": "d2fb3c2b-cb80-4357-9aab-df5da683189b", "value": "NEW ODERPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a54300b-9b69-11eb-abe1-42010a9c0039", "comment": "Malware payload (Phobos)", "timestamp": 1618216208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216208, "uuid": "f0031da0-9da8-40d8-b242-a92d6381d97c", "comment": "Malware payload (Phobos)", "value": "9e79576cbd90a80fe04a8f4afa7cbece", "object_relation": "md5", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216208, "uuid": "bf2f10ea-3ae6-4977-92dd-7bda734582d1", "comment": "Malware payload (Phobos)", "value": "9bd421c6f7f7d8278036944fcad3e04db408619678acf1b2024ef69d85c3932b", "object_relation": "sha256", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216208, "uuid": "d6fab03a-a1ff-409e-8ce6-2174b61002f4", "comment": "Malware payload (Phobos)", "value": "3d51b94960c3bb966a8a886aacf75cbb6ff98556", "object_relation": "sha1", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216208, "uuid": "5c6b02be-85f3-4cd9-97b2-a4d449c7383a", "comment": "Malware payload (Phobos)", "value": "5ee586fc3bfc4f156af1f9eec2aec29790895a854add833e1c3526aef6c385dfc59b7de3d4bc5c36e79b6c22ec682b48", "object_relation": "sha3-384", "Tag": [ { "name": "Elbie", "colour": "#403DDD", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216208, "uuid": "cb4debad-bbc6-4b29-ad33-1b64b4677f11", "value": "9F43B00A746984B2CD6645B1293A2F5F4FBE650140B844838F3D4DD63FE5076EB3A37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216208, "uuid": "d30ffd93-b785-4acd-8ef7-69086339c90b", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216208, "uuid": "79f3a81e-2c1c-4291-bc5e-3d090a432ef2", "value": "1536:kNeRBl5PT/rx1mzwRMSTdLpJeB6EP4oKeRwBB4rk:kQRrmzwR5JGhQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618216208, "uuid": "e7dafbf4-6216-4d3f-a998-0e8eaaf4855a", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618216208, "uuid": "5cfde626-8159-4756-97cf-428c12065d38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216208, "uuid": "3da8a631-295e-4960-baaa-5718e5c24538", "value": "9bd421c6f7f7d8278036944fcad3e04db408619678acf1b2024ef69d85c3932b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf20fb7-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207381, "uuid": "9f8a9b2f-e603-4b39-90b7-512e22ed787c", "comment": "Malware payload", "value": "52960b6f789a6942b0f5409cd73ae41f", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207381, "uuid": "9164eb61-0444-40fd-921e-f6454497cac5", "comment": "Malware payload", "value": "9bd86ffcaf0602976fbd469177d07d2630e48f38b5a1f8cc8242e99229eba39d", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207381, "uuid": "9f82c170-9c1b-435d-8488-f88cae70e08c", "comment": "Malware payload", "value": "9b6e81c4c3357d47f56e9e84abefe18673253508", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207381, "uuid": "99ad64ae-e474-4a86-87da-98e44089bafe", "comment": "Malware payload", "value": "d6c1056a23aea3c6066d1ed03d327ad665b00c0446e712406ac17cc6e89ecf357d5e66303c4b62baf4685a21652abb72", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207381, "uuid": "ccb32430-26e9-4dc1-b4c4-0f53b521cbb6", "value": "D9D423CD3B2C1A81915EBAA98ED13B732AF14CD685CDCDA1C64E9BE4C1CC1CCA591D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207381, "uuid": "d7e45dd0-8b4a-4e62-bcf5-10b613f21d53", "value": "12288:Jj28hQqWz5PLVn7WueLxUb8X9Tf94/IEEHLyb4HaFVhgaKuehJTmlZNKCLysizYL:EWy1TV7CVUb8XF9KIEEHI4HaThgr5wim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207381, "uuid": "20d3f0e7-36f9-4d08-bd37-3c7e9d5e2a43", "value": 599016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207381, "uuid": "a8b0ae77-c7d6-4286-8d87-720e5506e4ae", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207381, "uuid": "defa7460-4be9-43b4-9665-95b5f028285f", "value": "NEW ORDER 292-2CN2-XWJ932-AB3C-38ABR-DS2-2821NJN1I0HDBW.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c0c3e3-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207315, "uuid": "0be75946-2ce2-4f40-965e-48635a8abbca", "comment": "Malware payload (SnakeKeylogger)", "value": "7be78d4201e3539455992308bcb4af71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207315, "uuid": "d470bb92-9bbb-4dfd-9d0c-5a1c1cb2d8e9", "comment": "Malware payload (SnakeKeylogger)", "value": "9cf1c65aa49a75606cff88efd0d401a3de5d395e25a5ffbde0688b44d48c8ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207315, "uuid": "c84d92fd-571f-4d5e-9e41-cf31b11f3a12", "comment": "Malware payload (SnakeKeylogger)", "value": "76622f5ad16e8dff5d84da6d189ac507a4de2db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207315, "uuid": "12515cd8-78dc-416e-a5cb-5179ca00766d", "comment": "Malware payload (SnakeKeylogger)", "value": "b701ef49fb4651441b7d795c0cbc029595a6305f4c94aaebaddf25f7fa4b41a25dbf53ad109a8aa6005e12e8fbbdcde9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207315, "uuid": "5a65cc04-c163-4cf8-8d7b-33cc4a26e6eb", "value": "62057C987600F4CEC4578D72C9545CF09620ACEAC31BE243A0573D99B97D68FDEA68F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207315, "uuid": "4e297ec2-f025-474b-a5fa-354357c7f0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207315, "uuid": "d273a52d-42ae-4e31-9380-af6020b99d73", "value": "24576:bmYp3lsTvT8rxAsVqpVFkHfzSl/Xn3uB:bv7s25VqxQE/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207315, "uuid": "445cb5a4-ebe6-460b-b561-ffab33b83575", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207315, "uuid": "e005d807-9517-481e-ae44-2bab98819fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207315, "uuid": "599bbfa2-3275-4b51-9e16-2dbc9d924e25", "value": "fyi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7361d6d5-9b5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (ServHelper)", "timestamp": 1618209835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209835, "uuid": "6aab500f-4a00-4362-affa-79d3d34de158", "comment": "Malware payload (ServHelper)", "value": "40367f496f45ba45b8545f90065b6940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209835, "uuid": "8b1bb36d-d646-428d-b009-02691dcdd20d", "comment": "Malware payload (ServHelper)", "value": "9d1ca3a1dad26b6c0195ac41fe5fa6e5e03706496944383ca9156fa99e57dc8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209835, "uuid": "20cc7724-6e29-4f1a-b23c-e01152a784f1", "comment": "Malware payload (ServHelper)", "value": "1d7bd76d538e1c1859999b807c071d6f1b930597", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209835, "uuid": "2f5e84db-d1a2-4337-af09-bc05baeed4df", "comment": "Malware payload (ServHelper)", "value": "01fe715c850926bae1ceae510aa4f9f0ec4752fe48e0ccdba5b5a5e9113ff7c7a9c4503e431be9533014699438ad9264", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209835, "uuid": "f8e78031-8a07-4920-b559-3eaef0ed15f1", "value": "8F56E056B8D288FAC53DE134456293E17A713CB007327BD71E94B9AA2B75FD42A3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209835, "uuid": "8a87c8a8-37c9-45c6-a7ae-e269082db2e9", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209835, "uuid": "b761f4f8-c6be-4590-98f1-09b16f1c4986", "value": "49152:JbtrUXdIFcV5RsizUE3q0b5+jOAjMNmSuDyYNq9YIrhSIdR1bRYU2Q55YhUxyb6j:nrUXdIFcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209835, "uuid": "6d813c7e-30b5-48c4-a099-936e9049ec48", "value": 6404096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209835, "uuid": "9821ec1d-2c76-416c-ab43-94ef6f42829d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209835, "uuid": "e90255d7-16c0-49b2-8e02-cc77ed22c7be", "value": "40367f496f45ba45b8545f90065b6940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9d7d11-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618206411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206411, "uuid": "6795a763-4515-4956-a9c9-5059cf8c7e02", "comment": "Malware payload (Formbook)", "value": "ea550bfdba64f60aea8ad136d92ddfde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206411, "uuid": "6daeda5c-3d44-4599-85bf-490b1b8211da", "comment": "Malware payload (Formbook)", "value": "9dbdef7d88f84edb9e7e45115e8186915f6c37b0fd7b29b5db64689b14f28b9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206411, "uuid": "c5a765be-477c-443d-b4e1-e2c96bcd48d4", "comment": "Malware payload (Formbook)", "value": "174ace61a651205e84ebd54aedf36d2ddefe031e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206411, "uuid": "c2f02d22-1f60-4904-aa94-bc3d4b4988c3", "comment": "Malware payload (Formbook)", "value": "d5f874b12927c5998db3ee881f932fd5ec7052c377f1a9774e4bae0986beeb36105661079ed1ca16022ac0a5ac4bb2ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206411, "uuid": "7c1b5d58-4768-4831-9307-395cfbc79e7a", "value": "24E4BF5AB960A3A4EBD44872EE0BE7720E155C9F5902106327F8BE273FFD527DA15230", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206411, "uuid": "020976b0-5194-4329-954b-b3b41fe62149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206411, "uuid": "5338ccf8-3564-4af6-bee9-ac0b34ab9f3a", "value": "12288:bbyh90/3ZdEz5KNu55RIPDQRPo1wcgMuwS2T8Xo2i10Ol8Kiq:fvZdEz5KvPDQpwwxFWgXhjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206411, "uuid": "0542ba62-8fa3-48db-987f-91a8793c1f2f", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206411, "uuid": "5d17671f-3d49-4d03-bf3a-f974866a4e8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206411, "uuid": "29ec4391-812d-4bbe-a15a-fcec8c57f6a6", "value": "Account Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d4cdc7-9bdb-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618265109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618265109, "uuid": "810cbdd0-a763-4e91-9e2f-1fbc3aa69c98", "comment": "Malware payload", "value": "a57d87b1c8bb885ae3d95e7a2e1b956d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618265109, "uuid": "2d8931a4-006a-40f7-9ac3-3db25f0c38b4", "comment": "Malware payload", "value": "9e6a1b779bf86a9d7da07792fcbce5588a6ea69b1a26639a820548a856d9c4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618265109, "uuid": "feda2e60-1fd2-4307-a393-2aa73281569e", "comment": "Malware payload", "value": "9a960552b64ff5642d017c4fb90a96cc8558dc4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618265109, "uuid": "dc3d798c-09eb-42b4-8f7e-88c38025ce02", "comment": "Malware payload", "value": "a51b607084e687fcac366f431a8e8f17a27e30e5c2c9ac5987defe49c0aee8a6d6d9d6c8a3a9fe62b64f7d3a8133e50b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618265109, "uuid": "eb9a1589-c86d-45e3-8d57-d6aedd925e53", "value": "F5A47E63E2E18973D1331B789D1B629CA8267F102D38A4467BE91E4C9F3D681352F397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618265109, "uuid": "af5232ba-fd98-49d6-bbc1-150b2d5a4def", "value": "ee7305e3e2317f68194c70d55843d343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618265109, "uuid": "24f9b0ce-e6e8-4374-bc9d-940640d4d9a0", "value": "6144:jx7DbYTRT9LNw9zcGJFelnblbDPQ/EZUYvF+2cOMHAohX/tcfQ3gcPhThtvU+nCi:jtYTLiZhJFelnbdv7MHQQwA5hC6symk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618265109, "uuid": "2a2042b7-2fc6-42c5-a252-e70bfd4f8114", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618265109, "uuid": "523362ee-2b7b-435d-9f5e-3591a141883f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618265109, "uuid": "0a4eef96-ee8f-40b2-86e7-17accb418390", "value": "regdrv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7debf2e-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618207453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207453, "uuid": "bbdeabda-b505-40f7-97a3-704d28bfedcb", "comment": "Malware payload (AveMariaRAT)", "value": "a09d8920b2194efc427c81a9b38601c6", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207453, "uuid": "28fca5b3-7673-4f83-8460-c0d9d703287f", "comment": "Malware payload (AveMariaRAT)", "value": "9e6ea5594c167846b2b0c41a357e083ebddf4a2d7b4774acd24cbc5e6417a795", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207453, "uuid": "d0a819e7-f366-4828-af83-695e88d365f8", "comment": "Malware payload (AveMariaRAT)", "value": "cd6ee7d49bd54fdf36be9953b785d272b040ae06", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207453, "uuid": "26231b32-cb4c-406c-8078-c5c5d7f28542", "comment": "Malware payload (AveMariaRAT)", "value": "3fcb4b7657b95dbc18529f108223c06dc44e2ac712096a2acfa0319d920a5d1bcbdcfcd2707a18bc4f0fb5fbab78dfeb", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207453, "uuid": "b771a099-0d8c-4b11-be41-574542d42580", "value": "423422C3DD2D4893E1A718F901FA1FC9B8E26E6BFC2B558DD8DB11D9A0529B4101D2A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207453, "uuid": "c25f196c-cb75-4c6e-aa70-762684ae584d", "value": "6144:alCo4DAE6TXNQ8kbG/ljhrFjQlm+SO07fzPSnwlFkN3yyrXAtoi:al34DAEQdQ/bG/ldKvqemkwyEtoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207453, "uuid": "61f8e813-5a28-4cd6-94b9-f7010dff791a", "value": 249816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207453, "uuid": "4e604dfd-5910-4cb8-b697-c1515a78a29d", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207453, "uuid": "4bfa2db7-8fe3-46b6-9660-63ef8b991444", "value": "PO NUMBER 3120386 3120393 SIGNED.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a02d847-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207161, "uuid": "bd770d70-a881-4241-b629-7802416869c9", "comment": "Malware payload (Formbook)", "value": "21aad0673241c158fc79f936083bae08", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207161, "uuid": "5b1be17d-06ab-4a0d-96a8-c12805ac22f8", "comment": "Malware payload (Formbook)", "value": "9eb7e4c4e62731910f56537e4af9171ff5c68d02b8b55fea6ac0fa2bbc447c45", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207161, "uuid": "e4aeb92d-a7bf-4f5a-b671-aac1aaf032ae", "comment": "Malware payload (Formbook)", "value": "1d5a662098533e802e1b1e5083eed115210fa05a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207161, "uuid": "f80abeee-2253-44e3-b114-cd65fa13114d", "comment": "Malware payload (Formbook)", "value": "b4a1fdfd7b38a5ad2cec6bb6607ee4e35bf4776cc349cd99336b6b66b388eca3eb8f67aa1ee65655c0a183bd4c09a447", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207161, "uuid": "cbec8522-98c5-41c3-aa79-2dbb0dc801bf", "value": "7045A8D1F19088DAED6B09F1BD2BA53024D7BE9C54A4410C669DBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207161, "uuid": "1143339b-6add-49b7-95ef-cb91deec35a7", "value": "6144:HdWoMy7GHKp+MFop+5u7iwCQ3cwpMaq/P4nOaYW:ketpfG+crCQMwpbGqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207161, "uuid": "8ba2b947-8e10-4d3d-9166-6649319f2190", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207161, "uuid": "fc316760-b827-4c6b-8f07-9273c0910d21", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207161, "uuid": "221c4f8f-c52d-485f-ac66-f6063e36c6d5", "value": "New order 9494994.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2e618e-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618208264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208264, "uuid": "831594d4-2564-48bb-825d-b63ea83917da", "comment": "Malware payload (RemcosRAT)", "value": "21ddadf5de107fa03f7017c8b1fad03a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208264, "uuid": "4b1731f7-7eca-4ce5-b0c7-c5d1a9503f16", "comment": "Malware payload (RemcosRAT)", "value": "a05ec6cf1960139637a289c4257fd7a7bf4e1009b1b2269871cb6bc581a797e8", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208264, "uuid": "baea84a1-b62c-488b-8e10-b730fd6025b3", "comment": "Malware payload (RemcosRAT)", "value": "4350c326066de0a9082c9beb92bb6f3f0975b08d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208264, "uuid": "3d82867b-fe8a-4476-852f-59355f4a7695", "comment": "Malware payload (RemcosRAT)", "value": "75e28f864eb3442e9d76674516d5b0660bff0d4be5b37fb6a40c34d0bedaa1f3058c516fb6c58e0174945d2e555ffe17", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208264, "uuid": "055b4dd4-fa3e-4eac-bac6-89e990fa56d1", "value": "FBE4CF3233C4A289D87E27750830614013B6BD06AA25E74E7D9C719DAF73B93C762B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208264, "uuid": "a954286b-ccfa-426c-9be3-0a6faaeb8546", "value": "12288:lbD0Gj6QnxgXqkyVWWsA1S/yVSLu9/ioiHBUqhpccRhUML8c1Ddjy1:l8KoQIK9/5iS2DRAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208264, "uuid": "0cad4e3e-9f3f-4078-8ae7-96e52807e5f3", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208264, "uuid": "48c501ee-3a8f-43ab-b2e9-ecba9d2d9062", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208264, "uuid": "27040378-cf2a-45b5-8b19-44d60b1846e8", "value": "RFQ_AP65425652_032421 urgentes,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c5c5111-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Matiex)", "timestamp": 1618207299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207299, "uuid": "88b4a676-9186-404d-bbf0-75a9273cd0b3", "comment": "Malware payload (Matiex)", "value": "23af642a48892e044327f74a89a97f72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207299, "uuid": "8510b900-da1c-4a3f-af39-08c90f379757", "comment": "Malware payload (Matiex)", "value": "a0d80aba40063662d5a5e1257ce33985dbd1bc3517950c5e35cf8075c72454ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207299, "uuid": "da6c0bd8-032c-43fe-a1bf-ad7b7753e2ec", "comment": "Malware payload (Matiex)", "value": "fb780966ab3e98bdda8e12923e38afb29db0e280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207299, "uuid": "2a273b29-b37b-424f-9afa-1755bcd06372", "comment": "Malware payload (Matiex)", "value": "9c4f5b95cdcb9e40940ed3c532c09e482667f3348fc8f99fdbcc444162879f588e7899e4c4bb073c888025006f6e533d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207299, "uuid": "4bb256ca-cdba-4a8d-965d-18da4dba7bf5", "value": "88F42249BBC89385E4AD97BAA1218D0013F1FD6E67B3D56F5FD674AD1A33B80CB02901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207299, "uuid": "5660808d-04e0-4722-8d61-19afbe5dd814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207299, "uuid": "66393d71-44bd-4740-8264-9dfddbc7e2f4", "value": "12288:pE7KJjbZ2UNHgqw4BF9wYTQgFOI+8kxtBTgrNpxMPJQYaOJeOOKgk:pE+J0UNHlw4BPwYTQoOI+8Qkz6L7JLjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207299, "uuid": "d5cd9c2d-53f1-4f63-a87b-470cf765fb06", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207299, "uuid": "1db36c70-27b3-4008-adf6-5d0f231245de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207299, "uuid": "246b7206-de94-4d61-b417-d56d4afb9062", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f95f91b-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618229934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229934, "uuid": "95b662c1-0566-4a2d-a888-b71575e1e994", "comment": "Malware payload (AgentTesla)", "value": "8648267830a23e39c5bc162f4ad72f85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229934, "uuid": "0f6bb1ff-1096-4181-b731-197dc30690dd", "comment": "Malware payload (AgentTesla)", "value": "a1b7cd862762ff80cf95b544e80dfc6f887d9e0e9a8fffeec7c2574812b917d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229934, "uuid": "c0364993-e5fc-4af2-9d3b-f865564e7ea5", "comment": "Malware payload (AgentTesla)", "value": "6a0436200203698fbb93170bb93ddc794d5f968e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618229934, "uuid": "928b03d8-5d85-4798-8b55-363d4d0388d7", "comment": "Malware payload (AgentTesla)", "value": "e1abccd659fe3fafc64e1656ff0b340cdb02a5125c0977d708447fad057153ebf54d94fab486e4ce677b67853feb78fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229934, "uuid": "26618348-c85e-4747-bf06-95ae02dc46a1", "value": "D2F4AFBC75047DE6266F176FDA96ACDC13B627239A8BA4CD806477C305A3376EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229934, "uuid": "90b47a13-59e5-410d-898b-aefc57f56637", "value": "12288:SeYGY8R1Fk1P3o5gGJGe2mqWnMJx4+xI3I7t2nWnD8CnU6/t25opkvDA/yl9MEsR:SvGTnFw3o5gCGDpDI3IfDtl250SAA9Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618229934, "uuid": "9aac446a-0430-430a-98fd-b9d6a8d80b5a", "value": 762054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618229934, "uuid": "4c8eebcf-4af9-4038-b007-407b39d98013", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618229934, "uuid": "c0422380-b073-4df0-abfd-bc71ec592ef1", "value": "RFQ ..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274a2f35-9ba0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618239772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239772, "uuid": "e5a0d9f7-6701-4418-95a6-867a6f9b65c8", "comment": "Malware payload (AgentTesla)", "value": "acab61f181eff6f416e6ff87ec2b27ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239772, "uuid": "052daf7e-9496-4c61-92b2-0b3f2cc6e71c", "comment": "Malware payload (AgentTesla)", "value": "a241414f53c05d3210e5283cc3ecac0f7a38384d1b89c3fea4447f263dc2ca7e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239772, "uuid": "fc572172-1c63-4b05-bbc2-edf231bfa891", "comment": "Malware payload (AgentTesla)", "value": "89ff5a2e386ae3ce4f0e6ecceaf57b2dcef63c28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239772, "uuid": "b3334e06-8ed2-441d-9f55-2d913e67abb8", "comment": "Malware payload (AgentTesla)", "value": "b5f9e8208f514bb33d68c06dbec5d1010ae3ec4a948535deb5ccb8f538fc90aceb75db5e15df31269d362c69f5c409e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239772, "uuid": "6d1bfdfa-bd22-45de-b3e9-f66ec65df09f", "value": "1FE4337672768EFD6FBC9A79B071C203AF188A071401A1727EBC15D9890CCC8D6F65E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239772, "uuid": "8f1471e5-535a-4ae0-8135-a6a3e63bdb4b", "value": "12288:oqDEiptT+tMyyeazY4/M4Dui6i902WYSo/t7MSeZ+KTg9AvQVldBRMA:zEirT0Nye2F/MYukMO7xeZ+K09AvQVlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618239772, "uuid": "b91bb68d-932d-409a-aeef-4f96c2c1c44e", "value": 685280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618239772, "uuid": "cf0c5cc6-3b3a-40a9-9fd2-92ecf5aa8c69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239772, "uuid": "e44035ee-84ff-4fa0-9e08-eefb3aa3294a", "value": "GS_ PO NO.1862021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bec406-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618209490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209490, "uuid": "29088782-b422-48f0-b08d-f28d8e96ea2c", "comment": "Malware payload (AgentTesla)", "value": "5bdd6d07da8cb6b006c7ae61411b9a32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209490, "uuid": "d9e00faf-5900-4e50-b557-37f370465d30", "comment": "Malware payload (AgentTesla)", "value": "a288b15ae6541bff16fb179d38805f056c08845c5013decce21ed228df8222d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209490, "uuid": "d6c2dda9-c4c1-4bbb-bd2a-5aa1e71711ff", "comment": "Malware payload (AgentTesla)", "value": "431d3fbff1ea98e3cf95667d9dbddb983172ff0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209490, "uuid": "3f98fdb1-c3ee-499a-95c4-2e3ef8aae32f", "comment": "Malware payload (AgentTesla)", "value": "d8dd339ac7fa442371bd33a7b444563abb9d78687f231bd76501f7a9d3345d51e2a9b2ab33ae122554b092db00d3832f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209490, "uuid": "85f618c2-3a63-4e80-a860-bd92cf9dad89", "value": "C545331CAE4C98D570BDF33BF056E6D03579BF8B9ED00AD99BF56A2008D28B6914B412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209490, "uuid": "9240d720-73f7-471f-8fa9-c869ce6770c1", "value": "24576:t1no+5+fR+N5F2oU8MkxbHk8Fq4S2cLq7XDREM6MiTa36ofk81:bo+5SR+NZJMykwqlXLuRE9dg6o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209490, "uuid": "6cdbc889-bbdf-4019-a5da-bdb23e71dd6a", "value": 1235262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209490, "uuid": "83d2247b-966d-4d0a-808e-4d0fa05d2456", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209490, "uuid": "7d88d963-aa43-4f48-b60c-7bc66f8205fb", "value": "Facturas Pagadas al Vencimiento.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0691e76d-9b3e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618197626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618197626, "uuid": "d1044b4b-fa13-4196-874a-89f968c57987", "comment": "Malware payload (AsyncRAT)", "value": "35297dea132997a4e101aabf8af24c2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618197626, "uuid": "12c2749e-33f0-4b19-9a9a-37593f2c248b", "comment": "Malware payload (AsyncRAT)", "value": "a4a1cc64bf8784adca123132ebe6235f49dec898b5e0e7fe3b1fdb4099e4b42a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618197626, "uuid": "679a9a78-44c9-4177-a597-6436b4220b91", "comment": "Malware payload (AsyncRAT)", "value": "44e08ff9c8dbc7d8b5a65cf87ff4099f38cf3e86", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618197626, "uuid": "b197fafd-210f-4871-8376-cbf0bf392487", "comment": "Malware payload (AsyncRAT)", "value": "5fd6ef5d187075fe941dfcb1f591d0be1891d23304e3c9a4d57bcbbbba26d0a7a1f1b54a673a790b9065feb2dcf06c23", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618197626, "uuid": "f0ef2b0e-9552-446c-b6f5-df68d32f8050", "value": "3B014C16932444E33441FE4761E70169CEA55AEB42C5A1600031E87659BD2FABDC38E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618197626, "uuid": "ad7953c8-ea7d-40c0-a2e9-c82d40f06bf6", "value": "12:Whmlh4iBHodpd0LynPFhyBF3zTcg3NHXtfjRu+lNmY/OLAW:Wk80Hgd1niBF3zl3NHXBRu6NmTLAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618197626, "uuid": "75fd2fd2-30f5-40f6-bb74-2618c87dcf22", "value": 675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618197626, "uuid": "be5192de-eb56-4f71-a555-5fbdd69aa3d1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618197626, "uuid": "d1be390c-3dc1-4e30-828a-69ef846bf6c3", "value": "Invoice-ID-(87656532).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e3a996-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (ServHelper)", "timestamp": 1618253084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253084, "uuid": "84197dff-599d-448a-b86c-e025086af165", "comment": "Malware payload (ServHelper)", "value": "f78a379ee9cc836cd89aeec0cce871fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253084, "uuid": "e676d0eb-bee8-4686-9171-6877d7c57e3b", "comment": "Malware payload (ServHelper)", "value": "a5ce80281a88db0129bcdadd338ccf21d07b4b960ea92dc3b1861b7276d354ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253084, "uuid": "bd671efc-ad40-4954-9dc0-281f7c81b1e3", "comment": "Malware payload (ServHelper)", "value": "c0db39af894e76500c3febae9a3565856b25fd68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253084, "uuid": "f35a2cbc-9838-4b02-94d2-f3be979c6b88", "comment": "Malware payload (ServHelper)", "value": "f9e60e7ee0cf0331a201e04a3da31bbb3eeb8d4331e15efda7cb8622f7ef27185f65b9c7952b6d9d22fee338e3ffb73d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253084, "uuid": "f8298b48-38a2-4252-a242-03cf7d3d6372", "value": "5156E156BCD248BAC43EE134855293A176713CB407727BD32F94B96A2AB5FD82E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253084, "uuid": "120d105b-c225-456b-8661-30a8667af45f", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253084, "uuid": "7de1b404-9f11-415b-934a-c0cc22d7f6be", "value": "49152:A5DZCLw38whj5wDNri4sVAsszBOQRo8GejEG0JO3AcDiaiXGg8cqQIgeHjuSDW9g:eDMLw38whc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253084, "uuid": "6062f0a5-48c4-4069-9680-94e20d8551d7", "value": 6404608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253084, "uuid": "095be840-74ac-43e8-81b5-5c04953c0146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253084, "uuid": "42d40c3e-1120-45c2-b76b-d08a674f6643", "value": "f78a379ee9cc836cd89aeec0cce871fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb6e81e-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618233499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233499, "uuid": "09da1d6b-98b6-43b6-b8ff-95ad8be73b34", "comment": "Malware payload", "value": "a94fce0a8083336cf473139a85a55b77", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233499, "uuid": "7e9cc542-52db-4d98-8f10-99739ae9ec9a", "comment": "Malware payload", "value": "a7d5405eacbc93389d694230affda4962e1f890c5bb81b89e863493665a58ca9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233499, "uuid": "4efd33a0-ee8f-4258-8671-bdc1d90dbd71", "comment": "Malware payload", "value": "2f80907716c46f28989b2170de553a0c371f9d16", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233499, "uuid": "24e5e598-64b6-4bdf-acc9-070a48a88da9", "comment": "Malware payload", "value": "2aa2889f1649ed7b23e6f5bb92a47a8391867311847d1adfd570120edc389402ad1e8f3de09f5cf2ad5c8da7eac2971a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233499, "uuid": "7f46cd0d-3372-480b-9699-258d7d015e8a", "value": "A4F523239B9EF02AD027F135E1AD3593495D04BC8A14FA513AA5A79CCEFBC409E05B3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233499, "uuid": "0292e7cd-e4d2-4406-a96a-d265c42224b3", "value": "98304:wKiVS2YvLjZRFJOAC7Jy7KAoyry9FeYm2:CSpj7FJKY7loPUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233499, "uuid": "d4e209af-b623-4f06-a58b-6a5cd0f6eadd", "value": 3540951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233499, "uuid": "a19be088-8628-4cbc-9736-e7bfee514dc5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233499, "uuid": "abf3e658-d0be-40e6-9ac8-c21bfd5c1618", "value": "dhl.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323bfdcf-9ba1-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1618240219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240219, "uuid": "905998a0-2f17-4e44-8802-c6a615e46d49", "comment": "Malware payload (BitRAT)", "value": "008fa3f529f9182ff7ee2d7801dc4e7e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240219, "uuid": "7079076a-ff4c-4573-9590-5dceb43f0f30", "comment": "Malware payload (BitRAT)", "value": "a89639671659b81c5fcbdd2760590d6150fb4b1cd35ad0ac24ff6cdcf59bb079", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240219, "uuid": "b8b03eb5-1508-431d-92b1-935a9fd6fa4b", "comment": "Malware payload (BitRAT)", "value": "f17eb890b7563e30de2940c02c333628f4a862d6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240219, "uuid": "9059edf7-2319-4a53-80ff-f7b65a8a79c3", "comment": "Malware payload (BitRAT)", "value": "c19ad89f4c53876c3ac9698b1802cd71e28017363436f57b94d15fd5a10484b15a20406a58300cdda22a6862d0d44b20", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240219, "uuid": "ca6b1beb-0b37-41b1-bb58-5dbac9101c00", "value": "D6A53356A811C206C2863D78FE6FB2F057F1FF57F49A119F4052BEE138B2A0686D16C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240219, "uuid": "234d67ab-6e3f-4760-b090-36c2534c1e19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240219, "uuid": "0959d501-7458-4350-b685-5cdfc73be563", "value": "49152:xWHthbBGRPpaif65XFH6hLufnSAq58PUYY0VFZM:xWNhbBGRP0SYFHILq5q0PG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240219, "uuid": "6574e0e6-50d7-407d-ad36-9dff190f7070", "value": 2267304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240219, "uuid": "6cf42514-f4c4-465f-87b6-ea341b3ae87b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240219, "uuid": "bd6be71d-05d9-4228-8bde-5dca70ec4fb1", "value": "Payment Confirmation wrt0412894526254 -copy- .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b24a2a-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618214429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214429, "uuid": "790f170b-cc7c-40e1-9e9d-8287abe89585", "comment": "Malware payload (Formbook)", "value": "3fef6985af0d52ab6701df170096b504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214429, "uuid": "840bf60d-e350-4066-a4fd-9e150b91748e", "comment": "Malware payload (Formbook)", "value": "a9c3d37d324e9b6a0ebf9f9369c68cc288117edc4657d086b0fbc0cbafee9e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214429, "uuid": "0df07662-c293-47e1-9e8f-7784f9de66a7", "comment": "Malware payload (Formbook)", "value": "ac8db3220c960262f8e666eae676066cec541b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214429, "uuid": "45f2fc9b-58e6-4c8a-99f0-102bfd970e06", "comment": "Malware payload (Formbook)", "value": "97600ef62573c4f68b1d85b0da84001de0281ee924fde15335823c58ad23b6c6fa548f1c83cef593bcecf0688af5e471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214429, "uuid": "d3463423-0ad3-48cc-9cc9-b3b76028041a", "value": "5B1412192780FC33E8024E3A887B73BAC67F4EA0546195CB87444F3FB76E602CA19795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214429, "uuid": "4a734185-ebee-4dfb-be5a-dcc73ccc82e3", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214429, "uuid": "6b9113aa-2467-408b-a667-a3228337be0e", "value": "3072:HyewmN4skJ6VtZmtsl0UDwDZ6jnJ+vmebKkjgiuK5svdujBO1niLCA0RvNbBorAC:HddmedJjkvxKvMCA0TirvG6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214429, "uuid": "55f28961-587f-4d1c-813d-f827fec73e87", "value": 207111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214429, "uuid": "476bba43-d540-406c-bc6a-7585234ce4ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214429, "uuid": "d7165a0d-8ff0-4247-8982-2772dd1ad9cb", "value": "3fef6985af0d52ab6701df170096b504.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daa6395-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230092, "uuid": "a73244ad-bfef-4554-8db2-97f0042dff64", "comment": "Malware payload", "value": "61d46a36f42c7f737dad44ef676b95cf", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230092, "uuid": "5ddb0693-1c76-442d-ab15-f3e08591f3f6", "comment": "Malware payload", "value": "aaad4cc2c5434a32bad9c7f4eeaf7d6cb762a46b09dba7ab04ac70377f11c670", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230092, "uuid": "51c972c8-1b13-4182-9c9c-e9ee7ba47182", "comment": "Malware payload", "value": "9ba94afe0326998b2633deabfea9aab6d5a210a2", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230092, "uuid": "714ac405-ef2a-4ac3-aaa1-34ecd6cef760", "comment": "Malware payload", "value": "b10c51af185c43c4686b30c0371a3804806673babe53b2e08708d62f2966d7f3bd4999a8f27e9ea7af2906305ae05d21", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230092, "uuid": "5004f38b-017f-4bbf-a4e9-73bc86989252", "value": "3B431CCFCE420056F021B57DB7836904A39FA80EB6B16299F50FCB248B6F947055D76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230092, "uuid": "fcd24f35-9e56-40d6-904e-7b5d606f5fec", "value": "48:5sWCT1bHsEpUFaXTf4QX1tZlXSGtD0MuxBCxpKn1w6dtJr:5ILs30hbxmtHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230092, "uuid": "8b8fa83a-c591-457d-ac71-2665febb3f6b", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230092, "uuid": "9a416f7b-2347-4d68-bce1-999cbfdc5586", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230092, "uuid": "0a26b738-5374-4979-b891-ef47fe52215f", "value": "QI57.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88452ebf-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207293, "uuid": "16779158-d932-451a-a012-c94fd3fbe2d7", "comment": "Malware payload (Formbook)", "value": "7882383b735195790e0b589aff2215c0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207293, "uuid": "317ad4a9-5a9d-4313-833c-bb89aac24e39", "comment": "Malware payload (Formbook)", "value": "ab537a706267c13250f66a8a88f468804c101f8cd086ba9ad351c559e86aaaec", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207293, "uuid": "e9029d0a-6f37-4464-8a3d-4aea37f829ae", "comment": "Malware payload (Formbook)", "value": "260bbfd9cfafc2a6d4e6c4a06527f83b10f004e2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207293, "uuid": "b71121ad-328b-4bc1-bff0-f0c88d42ec5e", "comment": "Malware payload (Formbook)", "value": "0b7d33a51d8865677d0aa85a552db9d245a6633f7e7d7bee50399df13c3066e61422e5cbb50bc2365fd51ad46c20b994", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207293, "uuid": "c88bf0c3-e926-4b1e-99d4-2a8ff506ed7a", "value": "7CD42361D2F9211AE3B26CD904C3933E4E8A9D19D7B37DA4C0E098F3507A811F9AE74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207293, "uuid": "5a20eabd-fdfa-450e-afac-c56c802873c7", "value": "12288:aIfuhKXkY8lK6Dq1Gu5ABQzl9B5cbVb9pUpJO4OXDHxICryS77S:5mK0YCxy15I4UbVbYStTRICryq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207293, "uuid": "f302464f-fd32-4679-be4b-2ef3dbe82042", "value": 642735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207293, "uuid": "787f674f-9215-4b35-8eb8-c66570616fde", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207293, "uuid": "2869f6d6-af07-4b66-b053-ce4eb1f70882", "value": "INQUIRY 1820521 pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d88596-9bd0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618260576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618260576, "uuid": "6742daf4-c45c-4541-8cbe-c08bc4d6311f", "comment": "Malware payload", "value": "811f8cf79cd0e1d1d47cdff33c88d442", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618260576, "uuid": "1cf9c06f-8c8c-4b2e-b8d1-ef211c923306", "comment": "Malware payload", "value": "ab7825daf98d841039d0c09a92e69143b36e71fe70ab04010219608ccb632bac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618260576, "uuid": "3156763d-e169-42de-a1cb-2be31324b1af", "comment": "Malware payload", "value": "1cc403f3425cd7dda4f0fc118e2d1ac197048cd0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618260576, "uuid": "62985881-0130-4ebd-b4a9-e3f6e0c8e044", "comment": "Malware payload", "value": "4afa0f0ad2c598f8bfa1d6e4f4fdaea52dce6819a23023e2f19372d4a5588079d65d41f603466f9032e188d1a1f9b3cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618260576, "uuid": "9e1baf5a-2a9a-40d0-9c74-064053929b7c", "value": "59937DD2726244B2CA7310BD527A2E268EFCE51510B3FD87E78858495FE1CC1E73A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618260576, "uuid": "0d77a8a0-282e-45bf-b953-add13d360109", "value": "ab4cfbd329db2b9a060d2b38fbc91219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618260576, "uuid": "88ffe388-2e60-494f-a732-f4022cf4e03f", "value": "1536:9dTLmaYpDTKRgYav8kz6NOUD+stj8GI1SEcTkrnKtaF1ry73PoZveq:X1Y56N/VZkDFpy7wZ2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618260576, "uuid": "1b51d9af-ba2c-4149-b6b1-a3b4c770f5ee", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618260576, "uuid": "e8e9308f-acd1-4ae1-adff-eef9a6350e7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618260576, "uuid": "3177a925-99f4-4487-8a85-d85d092acbfb", "value": "80000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a210a07-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618209389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209389, "uuid": "01f41b51-58af-41fa-8cd0-a07aa3378186", "comment": "Malware payload (RaccoonStealer)", "value": "dcd1e195ad1945389bc4d87dae82a164", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209389, "uuid": "990c39b3-d0ae-440a-8c8d-a29b7c4d918a", "comment": "Malware payload (RaccoonStealer)", "value": "ac2c2e2b67deca31d1f61ff956ef8b676fa733da9c682f26fbda28b46c6e6f63", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209389, "uuid": "1a031f1a-4131-4e7a-b193-a3c1feec3ea4", "comment": "Malware payload (RaccoonStealer)", "value": "7c1aed93371a31888752afd9bfc7d76379940732", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209389, "uuid": "fa36ce78-8cea-4608-b259-c45e94e1e2c8", "comment": "Malware payload (RaccoonStealer)", "value": "b13b763bcb066203796e9d65138ee2bc061da80a165a36a6e36d14568fde8eed270591b0efb1f7a8b22355de6487e2bc", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209389, "uuid": "9d877a41-6d97-4ece-a760-f19adf809756", "value": "2944C01073D0C033C002657A8526C7B24A7A7DB169BABA9FBFC54AF54F3A2D1A71570A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209389, "uuid": "966b5fb0-f100-4a17-8042-de4e1d0ef0f1", "value": "b01a75d18da2a47c4a0580e81251ecb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209389, "uuid": "9f43b337-52a3-4cda-8dd5-e1dab8ceede8", "value": "6144:B6b1Lf49xqeQzbx2CjGyGsswS1B00cuU5:B6x0qeCiIswOB01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209389, "uuid": "8689bd36-35ce-4fe8-bf7c-2150476364a9", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209389, "uuid": "7f6ad9a3-cf55-42df-8954-63df3c64e7df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209389, "uuid": "2cd4526d-0887-4b78-8050-01c724789671", "value": "setup(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b5f724-9bba-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618251201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251201, "uuid": "28a36554-c67b-4c02-b3e0-b2cc0eeb7038", "comment": "Malware payload", "value": "21a54adf75595b0d332b4201b1508b04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251201, "uuid": "6c89d2d7-80cb-477b-838b-1665f9b3718b", "comment": "Malware payload", "value": "acd957cbaa42734fe2e702d373b6a84292da0f25d25a35e294bec2e2d6543d8e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251201, "uuid": "7f4a8dc2-6712-4c7d-8bc1-43c54e5f2223", "comment": "Malware payload", "value": "708020d647d912371e1b449458bfd68cd9a08cc3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251201, "uuid": "de364196-2d6b-4591-bf7b-4e2c1a67b5a0", "comment": "Malware payload", "value": "1b44e1c7486c8a808460e84b54d6e6e870d0cde4ada82f9a9c061c044ca784356340fee529c0d646bd305f62202a3044", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251201, "uuid": "0f2bcb93-90d5-449f-853d-4bcdeceb7d34", "value": "7AA63302AC824839CC6ACE371CF8E9FD146BED159B1C14D256887CF12D97F94ADB7129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251201, "uuid": "aa197e22-73ed-4636-ad2a-a97ca7bf198d", "value": "38cec625fecfa77d86b81445b2b79675", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251201, "uuid": "b783884b-d365-42a0-931d-795aa07248f1", "value": "196608:ZzXuF1rMZHAsmBXGitbYPvbJQlHmYu8CxqZ8iTmXlm:IF1YgNGikJQlGmZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618251201, "uuid": "94ee0bf1-02c2-40e4-ae84-9559f567155d", "value": 9813964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618251201, "uuid": "41489aea-42e9-485a-b002-74e4e6f35306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251201, "uuid": "c832c0ac-c721-4d57-8acb-575ef0ca40f8", "value": "acd957cbaa42734fe2e702d373b6a84292da0f25d25a35e294bec2e2d6543d8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdffed84-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208698, "uuid": "70eac87e-2de1-4216-8154-ad86af8e748f", "comment": "Malware payload (Formbook)", "value": "de09c3fb28d3c6947ab804ce2b789aa2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208698, "uuid": "fab8a283-b92b-45b4-a6c9-11f8f3394eca", "comment": "Malware payload (Formbook)", "value": "acee640096f7e141ca83e9640c50a69b378059dd92a786c2374d97848da7cd49", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208698, "uuid": "cd37fdac-b500-4916-82fe-3b0184639e1e", "comment": "Malware payload (Formbook)", "value": "4e08cde0d030559b28d2936ec1e2ee0e68ac0255", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208698, "uuid": "d48b9093-00d1-455f-86e1-4d78cc2e760b", "comment": "Malware payload (Formbook)", "value": "5f98b09e033e2af514c1878f3e639059bdc571d7e9989eec3a450fd1ffce61a079dc6840088f98177bffc8d5f75187ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208698, "uuid": "ab105b98-d2d9-41d8-93b0-97ca410b1d47", "value": "EB059E21B2D19437D12E4639ED2797E8982AFE10FE74D94A77FC0C0C5F283517A6A293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208698, "uuid": "db69d8ec-6f81-4911-997a-09fcb897cf79", "value": "12288:ZjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c0fKRmp:ZjMmMH8XEgfqFDd0fK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208698, "uuid": "9deb16db-78d2-4219-a793-4d13231ef454", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208698, "uuid": "b6bde1f5-cf53-459f-a020-248ca62b3fc9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208698, "uuid": "b4a090fe-62d6-436c-a5da-c0b847a63a2c", "value": "12042021493876783,xlsx.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a375ba9-9b6b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618217201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217201, "uuid": "2e5acb91-f2cf-49e3-99f0-9e84cfd95650", "comment": "Malware payload (AgentTesla)", "value": "c70decc03a9214f65a58ae036149fb17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217201, "uuid": "0cdf70e4-720b-4961-92c9-bcbb9ebaeb29", "comment": "Malware payload (AgentTesla)", "value": "af1d434f702045685e163c36d8d24098389e7675eed56ae34a90532764df2d3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217201, "uuid": "52c78edf-f880-4b05-bbd2-351f097b445f", "comment": "Malware payload (AgentTesla)", "value": "2acb36495475fb87f39379d1dabbbaca0fba7a1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217201, "uuid": "e73766b4-1e06-44ad-a9e8-cd5c20e35f13", "comment": "Malware payload (AgentTesla)", "value": "c0480abb517e72a2caa3ea260f8e7aa50ef8294b8763b5dc6bf34ef26ed1723f18626a6aec8a892cf9f918da2f571554", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217201, "uuid": "07de756e-b6da-4bbe-bb09-6fbd5252b30b", "value": "6DE4F111B79ACB95C8354BF65432904347BAF1EA3413EF990E85D0EA342AB0C9DE5DE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217201, "uuid": "8b2d2419-5d45-4c0d-9b65-22d466b6db85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217201, "uuid": "e5a1b91b-7bd6-4c7c-b322-325f3ec9c338", "value": "12288:R7WAGdp+LZ6FVQrWYRTCtmp2q/iTS9u6MYy:NWAGd0LZ6FiWYRTCU45PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618217201, "uuid": "402ec727-5a8c-4e04-89e1-b8954f00e266", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618217201, "uuid": "710195d1-ffff-4721-8919-bc4b5e4b4feb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217201, "uuid": "ea03751d-e62d-4821-aaf0-8850c46ac688", "value": "Import shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e92e70-9b5c-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618210775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210775, "uuid": "71547654-896a-4d44-b65e-38ba3f9c70fc", "comment": "Malware payload (AgentTesla)", "value": "b735dfe7cf1f034130e0a1a675faa226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210775, "uuid": "9f566fa5-db35-4f3f-b630-175599eb5b5d", "comment": "Malware payload (AgentTesla)", "value": "afc59eda3cd3ae17fcb0217e3e63779accc7d539cb9ea0cc9e72003c2b9ef51a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210775, "uuid": "018fcd80-a021-485d-9b8e-daf3afbee7a1", "comment": "Malware payload (AgentTesla)", "value": "5739cd17b58c0a2a26a18e00b245244d930b0d2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210775, "uuid": "c823742e-a275-49cd-a5b3-6ed4ee68bff7", "comment": "Malware payload (AgentTesla)", "value": "aca54fc3efefe3cdce14204ba442667b0e996f906e9cd8f549d008c664bc35d625da0b95238f821443b25458697be1a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210775, "uuid": "fc78af36-8758-44e4-9708-5cad415a449b", "value": "7405F1213BA88F41E47F673B0232905113F2BD6ED33AE6187DD832DC2A76A455673B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210775, "uuid": "3cc845fa-f61c-4638-ad5d-0a6c94561a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210775, "uuid": "d0cbd81b-ccc2-422c-b349-14727aee4893", "value": "12288:k20kdkI5K19je3HRrGlDjf1USrAOmdcXZctguDuOArz0jt16v8XR+DUC3f8:z0kdr5K103R6GSrjUcblXOv6vgct3f8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618210775, "uuid": "4a274256-24b2-442f-a38c-01ccef52078c", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618210775, "uuid": "faabd988-a301-4da3-8e80-f68f5c3c924b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210775, "uuid": "5f90acae-f96e-4c6a-b1b9-ba7f6f55b60b", "value": "e0xd7qhFaMk3Dpx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95563f63-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618242104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242104, "uuid": "9f22610c-94e0-473f-9c08-4c8e5d8fbdf9", "comment": "Malware payload", "value": "3bbf7ada52932d578d114b2215e6bfb1", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242104, "uuid": "fa42d6b9-dd64-487b-a21b-3c8074c7a0c7", "comment": "Malware payload", "value": "b053e871089776edb74938981d82d1f05078aaa45d83c0574f8dfcc9bb7775ce", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242104, "uuid": "42119987-ec54-484e-b672-297a6e05400b", "comment": "Malware payload", "value": "c4e52054139eef065fcf23807e98816704548c4f", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242104, "uuid": "01461724-4b7b-4a8e-b981-172bbd47b651", "comment": "Malware payload", "value": "ba5ca25c9741f2186bc6ac16473d748c62c9dc0c480e73444f4b49bc61b910f38c318ba154cbb0e3edc3589604bc29df", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242104, "uuid": "0e3f367c-d408-4c1c-b85f-d0f6823cc789", "value": "D654232DF6D9C570F7B298BE105D39478F59E2F47D28F0AF398982C431105BA53091AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242104, "uuid": "c0b44f71-0d88-4ff7-90c4-106b9cb61aef", "value": "6144:QoCo6OiJxQxT8HcZuINxv6yk8wGoDqKzyyoNE+W0WxwpFI:QoiUxgc4c638pCvwpFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618242104, "uuid": "03b9448b-4d9d-42e1-a528-70f1fd6fbe95", "value": 292541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618242104, "uuid": "c8bc9a15-7961-43b8-9d45-339e64bb55c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242104, "uuid": "46dd48cd-92c2-41e6-bfe6-be3351743d9e", "value": "Invoice_#_833.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d2442a-9b79-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618223294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223294, "uuid": "828c9ea5-c7d3-4284-9c36-b6c21accbec7", "comment": "Malware payload (AgentTesla)", "value": "012e3db8ffdb666fc92a8135a5729d7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223294, "uuid": "5e50d502-8468-4050-b1ce-d45921d9ca1e", "comment": "Malware payload (AgentTesla)", "value": "b090ff4be100eed450c48e10aa6d736ebdb5518851dc04ba0fed4514db64df6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223294, "uuid": "dddd8409-8a3e-445d-9eb9-fe81b9d2ed9b", "comment": "Malware payload (AgentTesla)", "value": "3de9e2234c7f974cf7bd4fb99ea73311f07fc1fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223294, "uuid": "57b977bd-f62c-4dd0-b587-0154d896aa8b", "comment": "Malware payload (AgentTesla)", "value": "4c4001d8adaad952ea12646a8178d7e8157027128dd905f9ddce774517efd710d3463a90b23a34467c35f34cfca25dc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223294, "uuid": "fabd6194-0ccf-4089-bc41-dc1e87c5aea3", "value": "47F423B4C270EA218982754C47D3FDC3A8A59FD8587BFDEF81FA4544A56A0B0DE7122C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223294, "uuid": "72e58201-1772-4e3a-ade3-cfebaeb2f6d3", "value": "12288:D+6aykOpikARZgjS77JfTWSeVwIycnqOP3AcCsPjUXYmhlp5X+yyywsySxNf:D+6ajqsftd4w12X1C0jUVfTOZYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618223294, "uuid": "b615bdc8-a80a-423a-bf08-20e9fafc4cd5", "value": 727783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618223294, "uuid": "6f695d6c-e8cd-44cb-8e9d-11043ba266a6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223294, "uuid": "b0c648a2-4084-4803-a1ee-c94db4817ea6", "value": "SOA.pdf.'.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59ff8dd-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207476, "uuid": "4a74cf87-2c62-4cc3-82cd-6f71aeb5123e", "comment": "Malware payload (RemcosRAT)", "value": "1d0346e46f0f4033bd9f771481f0f0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207476, "uuid": "6aac92ec-b6d9-4e14-9ec2-d31077b4449e", "comment": "Malware payload (RemcosRAT)", "value": "b09301520c31e805eb1c010b3ff87e2d7b1a2a6d849d2595d09006515c4fedc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207476, "uuid": "38833ac0-667f-4b7c-859d-5d68d0bc1dda", "comment": "Malware payload (RemcosRAT)", "value": "4be334c8cf00e45415cc074d6547df7ff30ed635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207476, "uuid": "6fcdb36c-f0f6-450b-a90d-a5cf2f5df568", "comment": "Malware payload (RemcosRAT)", "value": "773e5eb2ee5231cc2e8362ac1a899614e492855f0cb414b1da84e6d279d7bdf2b130b56fc228c575cca77295dfd79628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207476, "uuid": "15420b5e-243e-4981-b1a2-938eda65e223", "value": "DE93CF427A0191F5EC2C82B1DC3315850AB53C2F566235FE63BEFF2958623864E1BE39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207476, "uuid": "625235fe-b282-4572-bf0a-cb2a279abfa9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207476, "uuid": "61b894be-d40a-4e52-bb66-595aa8d424cc", "value": "1536:7zbY4QVbi7DiGl6UysCoNcG3TO6gv2I/SX0Bxi2Y:7z84MgZl6UqoN33T4v2CXi2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207476, "uuid": "e1486012-a790-46fb-b1a0-c6652917e6b1", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207476, "uuid": "afdb421d-e056-4823-9af0-fe43fd640587", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207476, "uuid": "9cc193df-b54b-4c19-bde5-c1386ea1b58e", "value": "ADJUNTO_SERFINANZA_4944554994988993701304_917044026594458105225_0145056552681626972688039354_571705222079348422219479_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba8fc70-9b3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618196722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196722, "uuid": "23af1243-818a-46e3-961c-ce5d6ef45c88", "comment": "Malware payload (Loki)", "value": "c0e4c7b681cc4518fe54ec7fd70ed72d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196722, "uuid": "3422f3bf-f5da-4c2b-8746-e305df1fb6ea", "comment": "Malware payload (Loki)", "value": "b0f872272fac17a0afc3a0cb41c9110725a6048e52aa9eec4ed567930a198ec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196722, "uuid": "28015af3-e7ff-4e24-bd64-c450df949083", "comment": "Malware payload (Loki)", "value": "8065dabecf6f54e60fba33f09a54785142ec62f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196722, "uuid": "d59b6a04-6593-40e5-a0a0-4d1e1dd36ab5", "comment": "Malware payload (Loki)", "value": "7e3a16976547e21d4286870a198f4a07eb095e5db3f9d0df061cf22722da32993e64a87c0dd01a3ed9b589d2c403733d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196722, "uuid": "4f2c8bca-458c-466f-96d9-21d4b54107cc", "value": "CE8401003994F80BDB6905740997E7784BB0AD905AD1C687BBF09EEF786A3D68C3C785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196722, "uuid": "644089d2-b7dc-4607-bd61-7979b2107563", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196722, "uuid": "7dcb6df4-18c7-489c-b819-9d756921e4f8", "value": "6144:YdYv9RX+P8pxIxKkYAfdlHJ7AZA4WlSM0xwULIZaLTX9:xv9J68rBkRV354pMQNTT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618196722, "uuid": "08214f0e-857c-4b06-8f4c-eaa0d1431a95", "value": 404197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618196722, "uuid": "962ca4b1-1fc8-432d-8ffe-3c2a5b498cb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196722, "uuid": "a761bffb-335e-4acf-8670-d914f7946a50", "value": "Required.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681ada92-9b80-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618226136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618226136, "uuid": "60a9b4f1-a219-47b0-ade1-d56c0c46c079", "comment": "Malware payload (Formbook)", "value": "3fdc2e4e52b6499def0ff7411a7e0060", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618226136, "uuid": "e6d66f87-3eee-4196-b313-864ba233e9ab", "comment": "Malware payload (Formbook)", "value": "b0fd3147d72cf3cbe23587740ca4a718671194b47aa5a4d030e689b4e8e1fd28", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618226136, "uuid": "932c2617-2d6d-41f2-bad6-cf09828ce554", "comment": "Malware payload (Formbook)", "value": "81c882a868140261f45531a7f2f486c4a5324fd2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618226136, "uuid": "59951ccf-2503-4c6d-9031-31044a24f172", "comment": "Malware payload (Formbook)", "value": "f2215720e1e9f13dc0579e67c992563eb45a3e3f22f916acc3ac6401a255c1527e23d000d8c2f7b66180495b6f4d56fb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618226136, "uuid": "7019494d-1033-4c97-930a-f8928d756632", "value": "3B225A2DCA14B91AD262043DD01916FAF31D41A7E243B92A315A768E4BA13D78B8F1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618226136, "uuid": "c5051bf2-6204-4610-98bd-17c3018c3578", "value": "192:ScIMmtPU9C2G/b26WhNenogS5SEzBC4vNq1ni3RR:SPXYOd6eovhlq1Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618226136, "uuid": "6802b621-4090-4c1b-af17-f583dc4bf6fd", "value": 10321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618226136, "uuid": "0a0b2ebf-66de-49ca-bc20-590666c142c1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618226136, "uuid": "f446b8a6-313c-4eb8-a61e-ac23ccf7625b", "value": "Proforma Invoice Payment Information_Purchase Order Confirmation.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c85b152-9be1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618267805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618267805, "uuid": "1c28ca5f-542d-4126-a77f-0bd14ae35864", "comment": "Malware payload (Loki)", "value": "e64cfb564307557c0a17d6afdb5e8ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618267805, "uuid": "4e6f969b-0f4d-46bf-aa2d-f6a45378fff5", "comment": "Malware payload (Loki)", "value": "b23e80c1232c1c91a330a8faaf58a97acbb7102e4322a9fdb05f8b17f7c07e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618267805, "uuid": "7c0e7f00-31e6-4848-b7b3-5371e92e3a12", "comment": "Malware payload (Loki)", "value": "ad9c53eddc052659de726dfacd5c78ee4501ef57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618267805, "uuid": "548f1b36-0a52-4d8c-b80f-7d99850afdd5", "comment": "Malware payload (Loki)", "value": "1b28d379838c01e31de5f16c79eb113c7ffcf1ff77499d77315f70568ca3e0e75ff124ae89632e0221beac5612521d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618267805, "uuid": "75fcf80c-78b2-436b-81b3-d66c28ce642f", "value": "29E302427AD2BDF3CE435A320C7BC375D6B24BA01525694B4F845F6B9B236C34B2A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618267805, "uuid": "7b09881e-2ac8-4286-9e7b-cc8ff233723a", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618267805, "uuid": "643cbab8-ca73-46ee-9f9b-1a5fa49e2704", "value": "3072:HyewmN4skJ6jCqZgjluz9/hEFfbC5uzio8TM4c9WLCp7S:HdDGj6If58ApQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618267805, "uuid": "9516a91a-b070-4a4e-a21b-861e3ccdee81", "value": 148486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618267805, "uuid": "25ed0b59-6ccc-4fd6-9240-37d22a8721d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618267805, "uuid": "9f7cbc6b-b166-47ce-8166-b3145284a2d5", "value": "e64cfb564307557c0a17d6afdb5e8ed1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61fbd71-9b69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618216469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216469, "uuid": "77d66185-e91a-42f3-944a-fc7722842d63", "comment": "Malware payload", "value": "bb4489ef3af30a3f1ac77bca896285b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216469, "uuid": "26380f86-ef30-4ba1-a51d-f2fe5482d274", "comment": "Malware payload", "value": "b2a66114f2afb03bd4087e7fc37d6c89ff7f3d3bd48d751dc9334a5a746f7c37", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216469, "uuid": "f9609e98-6b74-400a-8ee6-839df59cc0e5", "comment": "Malware payload", "value": "e447d424cccd2e632233f86d4b20c0718cc45fcd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216469, "uuid": "cbb03809-6d9f-42de-bcf3-22a638aec8ca", "comment": "Malware payload", "value": "f8d01ea12779d90083417be46a32212e59ac22a9d31375ffab087e9dba2ab4a54b27f0b678120164b31246188fdc0255", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216469, "uuid": "cfb278c5-3944-4da4-b1b4-4c5100d67cbb", "value": "FC05D039A214ED11E7B80777CCA1D6341739BE66AF92D72E18E430AD6F72FF90416206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216469, "uuid": "23ad23a8-f291-4eaf-bcd9-bc6bda1bbd3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216469, "uuid": "56f24aaa-4832-4e6e-8532-30185664a3f0", "value": "12288:MVzsxgkcHKyMDXpNEHWOx6//i8JrwOaBbKbx9h+YZjmPzLHDaLlPC9nMjvLek:Gzs4qyMDXnqCnvwxB6/hJtmv0vLek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618216469, "uuid": "dae89bf9-c2d4-497b-aa60-ac329122b789", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618216469, "uuid": "826f81ef-3880-4bae-8080-b4b547d58ec3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216469, "uuid": "83543bf8-7bfc-462b-85cd-ff5c8c275e12", "value": "MT103_Swift-confirmation#4425-28373XXX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8bf450-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618214578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214578, "uuid": "d076a5a2-d458-4166-bc62-50bce6c0408d", "comment": "Malware payload (RaccoonStealer)", "value": "cf6ac3e84ff3a09d7106e5b7157da8d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214578, "uuid": "173c1984-d863-46f6-bc51-f5a31fcdb921", "comment": "Malware payload (RaccoonStealer)", "value": "b2b8d24633abf976441e73febe9ca099157b1aa5011cc990cb045c5efd9ded0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214578, "uuid": "60cd8f3b-9a94-4658-9747-4506f120de28", "comment": "Malware payload (RaccoonStealer)", "value": "7074f9784ec58391c353bfacbc65f4f49418180f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214578, "uuid": "1cdac140-6dfb-4749-a0fb-7e9f54360606", "comment": "Malware payload (RaccoonStealer)", "value": "c0d5315067a3828a34e2dee05c1de9a078b6c177e34e44501075a34098f0d4dcd006b0e9dc277cffa95ccd42cec0ca36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214578, "uuid": "9fd977d3-2d17-4173-9f2f-09e5d0195214", "value": "5DC4E00173D0C073D45325B58516C7B49EBE78715A66A98FBBC81FBC2F24AD1A62630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214578, "uuid": "d0f58218-6fe8-489c-a428-3f8a484e9399", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214578, "uuid": "3192c394-09b8-4472-b8f4-f5f01d0ff05a", "value": "12288:A6EdD5okeYkljI9I7RX5H11ta+CsAKyCgFe65hLVgp09vTRDP:AV7wjI9I7HwnxKyHF3hLG091DP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214578, "uuid": "b6e3ca0e-31e1-440a-8f87-11a1ed6bf089", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214578, "uuid": "44de8bc1-f8bb-4df1-a438-7d6fc32d11f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214578, "uuid": "4f2a4af1-ff03-4e2f-9678-65c5a54f1979", "value": "cf6ac3e84ff3a09d7106e5b7157da8d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f06010-9ba0-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618239774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239774, "uuid": "e7c583a9-d5f7-4ce6-8515-724f3d8d3b06", "comment": "Malware payload (GuLoader)", "value": "43ffd09d0b5655c140063444da2ef104", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239774, "uuid": "45ea93a2-b943-4867-958f-54d951b426d8", "comment": "Malware payload (GuLoader)", "value": "b2c267c3ef336e879f1ecec51c36a5ad720222410a6ee3e1b0b8823b659f1915", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239774, "uuid": "8a7ef56c-8dbf-481c-aeb6-a81bcd3ea305", "comment": "Malware payload (GuLoader)", "value": "74cbf49263b6235b9050f2d2bb0d544756b98a72", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239774, "uuid": "dfc9c1f5-a350-4b9d-917d-dee48e997d64", "comment": "Malware payload (GuLoader)", "value": "9478c3884e2b6275913361ab15e57e0a02db5dd4bbdab8cab7edb1b482f4a8a764ab337d73c505819dc456f16258357a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239774, "uuid": "26f15aa5-2eb8-4bb4-9e95-bda4c262f3af", "value": "E0E30780B7B7A693D015C1B0A24F41A402E5FE31AAE56163EEC27F2D3D751E19821F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239774, "uuid": "0fea152c-8f9b-4644-9e5e-1d1546fda873", "value": "879f5bbda1e2f48716a0325e5b7fa215", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239774, "uuid": "ad1b75dd-0483-4d07-b23f-89bec0529433", "value": "3072:73E+UJybxl2ZLM8VmasONGQCq/kG144Vmy:73E+UJyll2Zg8suNB//kGRsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618239774, "uuid": "b7b4cbb6-5fca-492d-ab0b-477bc451f168", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618239774, "uuid": "c3ffd16a-7d4d-404d-be9d-e09f84da91f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239774, "uuid": "bce8c353-e252-420f-9d86-954cd3424c95", "value": "Zam\u00f3wienie 2021_12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20afe8ba-9b73-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618220433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220433, "uuid": "0d9b32ac-a3c6-415f-a242-79b3b5104aef", "comment": "Malware payload (AgentTesla)", "value": "c36cc78ea2e7654acdb1ed0255cd455c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220433, "uuid": "f882b16e-3f7f-4805-9dfa-92e7ce06aeb4", "comment": "Malware payload (AgentTesla)", "value": "b2f0f9600a699293598e04a5f85a6bacc96f310ec75009f694fa829beac60616", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220433, "uuid": "23a0c082-f90d-49cd-ade7-3e46f61e62c4", "comment": "Malware payload (AgentTesla)", "value": "5aa48645bf42bb9a20e8330caf220bf887b3f235", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220433, "uuid": "0aefb0c4-f36f-4b64-94a2-9187df5b5574", "comment": "Malware payload (AgentTesla)", "value": "78faee9822267db84b3cc76fb925ae4538f788cc32a9bc261e2dace485ad8c488b3b64bf73ac2f9104f2653984c07118", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220433, "uuid": "a6715ac7-0b1f-4a8f-bd40-e82bcae9e239", "value": "DFC423B320A244152646DDF50DA4F8FA1B0D17074E8F1DAAEBE9BC30E1C290DF6457E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220433, "uuid": "c31a9400-deb6-4dd8-980b-56322b3bc329", "value": "12288:BJ3v3vrly4LMg/hH6v4oCKl/rZdwFFWlfus1BVWsxYHD:BJ37//JHVlK5D0Wlfu6Yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220433, "uuid": "35b65742-d550-47e7-8c0f-285affa85251", "value": 590092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220433, "uuid": "4c67c427-0819-42d8-9eab-267b8a2ced21", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220433, "uuid": "33f494eb-3542-480a-b817-6ca79217e98f", "value": "TT Swift Copy.,..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a592d0cd-9b6d-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618218079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218079, "uuid": "57923bb5-0bef-4b23-b274-fd67482b7eed", "comment": "Malware payload (AgentTesla)", "value": "6ff964da370baa7921f68db9a8759a12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218079, "uuid": "58a60712-0d51-482a-a34e-0d24e06e5699", "comment": "Malware payload (AgentTesla)", "value": "b3fa756ea7d5eb48c679ac6e1dfae0c05bf40ddad435d3ba81887b3894db7fa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218079, "uuid": "2e61f499-11ed-45bc-b00c-9d0ea302e57a", "comment": "Malware payload (AgentTesla)", "value": "4509094a0fe5b3847fbb31fe26df77af1d2fff97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618218079, "uuid": "06769aff-fc79-4453-844f-f3890e1be6ca", "comment": "Malware payload (AgentTesla)", "value": "062481061cfa9575ccf653d527ed252e3c7c0a28abba8336b8c5aa56df33fafa1a89bb6a8e46af9c3779b44b9cc64e22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218079, "uuid": "3721b71c-f098-4892-8b31-5e6bf4e78b67", "value": "0C73621432D0D122E1210F328EDAD6F677387D906F8A433B3254733E6E7BA658B25B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218079, "uuid": "ed62f7a6-9e8d-4bc5-ace2-b759930d5078", "value": "384:xkn2+Ui2rLF4TvBBVrvaWmtRQiEL1mRWIBkcXNTDO0UMFlT9nclFo39D:K8i2d4rjRF2RQiEOhTDeMFB9ncjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618218079, "uuid": "914f96d0-c90f-452f-9de9-271d95b1087f", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618218079, "uuid": "979ec8a8-2e25-4983-ad45-d11d5bd9259a", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618218079, "uuid": "59d446ac-cc59-49c4-a491-4c50f4f18b43", "value": "Confirm Order for AKTEK Company_E4117.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b95c053-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207271, "uuid": "9563206d-9c84-4b0c-9818-fa9837e3bd52", "comment": "Malware payload (RemcosRAT)", "value": "1afff82abf295a6ffb2c8c8fa79fa82f", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207271, "uuid": "ef8ead03-8585-4f49-86ec-558a10371820", "comment": "Malware payload (RemcosRAT)", "value": "b46d0894a22f3938f55af9272b70247c0da125083a46e28448e2fd5c0f90c6cc", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207271, "uuid": "e0b9e304-aa4a-43af-a8c9-5885e9315758", "comment": "Malware payload (RemcosRAT)", "value": "c71524b7806b73ff079cf4a768f1a31ff132937b", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207271, "uuid": "c19934c7-e044-480b-b43f-57064000252b", "comment": "Malware payload (RemcosRAT)", "value": "0bac5e259ff8e9b209c3f67cfbbf9fd51a69783283e2486f371348bbfd7a0557194134a7b9a781bf8e2b2128203d4a8f", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207271, "uuid": "cbd823fa-2c9f-4f2e-8b00-a331f88e19c3", "value": "8D53029FE998460B17297A549DAF7F9C3321B1C69DC89354BD30C31CA220FE96B0658D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207271, "uuid": "1896be9b-933e-4328-92b8-99043c202f42", "value": "1536:4Bwdas60vrcCsseUayPM5gcuEu6SZkhOFUt+:/jZjirx5gcki0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207271, "uuid": "22a3e6f0-d1ae-455c-95d5-7c49bd310474", "value": 61760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207271, "uuid": "c1bf63a8-c94f-469b-a5fa-d5cf79c89736", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207271, "uuid": "580b900e-fce1-476f-b737-50c67b23709a", "value": "Cobro Juridico_0420198202_326828_4985792583130360_300690_8122300886764676459_5190713730838_pdf.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335696a9-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207150, "uuid": "fbbf8fad-9c30-4939-be87-3a64ac70bac4", "comment": "Malware payload (Formbook)", "value": "ac22d25d11ca0b0587004d23e8ade0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207150, "uuid": "8713928a-a2f8-4877-807c-9a420b5ffe52", "comment": "Malware payload (Formbook)", "value": "b4ac74f2835f4ba82a1539237b16c53e6537b0eede8d8bdf2b9ac781acb54a6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207150, "uuid": "90a71268-d34d-4aa4-8ebe-6be8310d1b33", "comment": "Malware payload (Formbook)", "value": "e89704bf4959816e9ffb36c75078e562a8f08efa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207150, "uuid": "5a5e6aeb-01dd-497f-bf36-173ddafca972", "comment": "Malware payload (Formbook)", "value": "9b70a25a7f03c7710ffec7b731316c5b17a72ac1bcda4e6de083c0c10fb0c23df540a52c8deb8677ea8454bc5a2f3d94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207150, "uuid": "6cddc6ae-5bf3-4753-b2cf-22dc3e92ff4a", "value": "8E2412B136E54CE3E301C93245B2B7B6C3B6D714043B19578F286EBBB5BA192CB5421B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207150, "uuid": "7a20feed-6121-490b-81ac-f9c9d9f2ddeb", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207150, "uuid": "66946500-5400-48d6-a6bb-07476879934f", "value": "3072:HyewmN4skJ6U5B3X93W8pfckRhgeyH3yhzuj+vv/vJlj78WzjKDX3+aYhOb0gxWH:HdQ5B3X95pZgeKozkyv/Lj1yDIg1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207150, "uuid": "da32678b-9285-4d58-b9db-3ee29bf27b60", "value": 228535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207150, "uuid": "752cf83f-53a2-41ae-95a1-134ec0e36679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207150, "uuid": "4775ada2-a1b9-45da-9dd4-aeefbb3e6715", "value": "MT103_004758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74626a44-9b76-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618221862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221862, "uuid": "3557a6a1-e26d-457b-8e5c-fe05e803bf23", "comment": "Malware payload (Formbook)", "value": "5ce7729e8dac4345f739645097a9c20b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221862, "uuid": "99a12dd8-ef2a-498b-90ee-6ac9c2bc35dd", "comment": "Malware payload (Formbook)", "value": "b529056dd98430990d4e81631bd9b3675a10544b167b0687710a90e811638dc9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221862, "uuid": "6153e000-d50f-4a38-b37e-1e2f0a0e6c63", "comment": "Malware payload (Formbook)", "value": "e77caa8844da3b1a4a2b344b8bd718a3608ebd90", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221862, "uuid": "508b5de9-9e11-47f9-8054-a199d6d2e1f5", "comment": "Malware payload (Formbook)", "value": "268157c316ac1212ad510bcb545a7ed2e302edae1d6e52cc80fb58f6de01834a44dc2890ac5fffdac552e2688136ce73", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221862, "uuid": "9544867f-fc6f-462a-976b-cc3dad0124c6", "value": "6624121F6FC6923A96D26645A402271CFE73E834F9E34D6B8CC193DBDED0A1B14DA148", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221862, "uuid": "a686bb56-a906-4f38-a942-8e1de1744c9d", "value": "6144:xevLWiSnBqBNWs+EN7iqv/Z4QIUhSdKewXJ3:IvL7nB0E4a/Z4NUhCJwXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221862, "uuid": "7c16a016-efba-419a-818c-965296a8eb2f", "value": 215743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221862, "uuid": "1186de95-7a9f-4a00-81c3-6080bc92fa2b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221862, "uuid": "b19ddc29-1946-40d3-acc7-b607bc7f40ea", "value": "COMPANY COMPLETE CATALOGE.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafefddb-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230114, "uuid": "4ac27383-31b0-47c1-9420-79b58e93d317", "comment": "Malware payload", "value": "801bd21f78c6d1eb470121e5ebd5d611", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230114, "uuid": "52724043-cf68-4563-a9de-78c3310c59f5", "comment": "Malware payload", "value": "b5950ad6b6faaab5ecf3921457dc94bb9b30fdd3707f1db56142b9e4777169d4", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230114, "uuid": "3250868f-121f-4122-99cd-da76ae019af2", "comment": "Malware payload", "value": "83c2103feb5cc91ced35b78326e926032dc3a291", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230114, "uuid": "8ef7337a-ab9e-4aa7-81c1-22989dfc182c", "comment": "Malware payload", "value": "7c676273127a0f6bc60c4dc01f8ddcc57bd35fe4828ddd89ce9d426e5ced09aa4ccbbb2a61716ebc78701a743058acb8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230114, "uuid": "200327bf-48b1-474d-95bd-aa1595610754", "value": "75433DC84ABB0220C731C6701BB85B47816FF0A676B24999F90C8D580FEFDB5655376E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230114, "uuid": "7d1ee4dd-bb73-4793-9d6e-3b21e64ffcd6", "value": "48:5eoERLiCYFjrEpUNaXTf4QX1tZlXSGtD0MuhhKxRC/FolgZJy:5eRLYFjrP8hbZeGgzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230114, "uuid": "7ee64bb3-a0e9-43af-a7a3-3e6557e5a0e1", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230114, "uuid": "47d44a1e-8bf8-4e2e-b679-cd6f6bb85449", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230114, "uuid": "a05e3f22-3fd3-4242-8d09-b3cd1a9074f1", "value": "ZR71.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d5cbbb-9bbc-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618251906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251906, "uuid": "4668be36-57e0-497f-84d0-afaee48f2405", "comment": "Malware payload (AgentTesla)", "value": "30fd4ef5a9d5ab15d56e7510148debcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251906, "uuid": "193bc6e2-adfc-4c04-a36b-44f5739ff039", "comment": "Malware payload (AgentTesla)", "value": "b5be17b9a7cb258eeeb27f08c5ba197c47e87b052ce41b150e9945b17d1308c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251906, "uuid": "78eb4e7a-a086-4c2f-8dfb-2a8bb5abb4d0", "comment": "Malware payload (AgentTesla)", "value": "e18cefab22a82f2f77bca420dcbd42375542593f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618251906, "uuid": "c61e06ee-bb1e-4eaa-a1e7-eb713e1519d7", "comment": "Malware payload (AgentTesla)", "value": "0bcada9d318662d30fc171726936fbfc19dc6523c4999771f4ddcd0434f0e6b7f5961ccdc7eee88efeeba42e152b0bc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251906, "uuid": "8cda9cb1-34e0-4ef9-a396-f09c304093a1", "value": "F1F40101220897AAD0ECF3B4DD30C7104FFABF19EA16DE0F7E96719909E3B479646256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251906, "uuid": "440da3cc-65ab-4edd-a8df-3d60e9ee925b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251906, "uuid": "45608721-ee64-4df5-9dee-5ba35c51b074", "value": "12288:A4kmd8gFidq/z/iYAPpAquKwYXWpZO4mEZzKg3VTGrrT+KL11K:ADgFidkzePequxpA4mEV34nnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618251906, "uuid": "1b13764e-7369-491c-998d-6de5cf7d41fa", "value": 748544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618251906, "uuid": "b96c050e-9311-4f14-978c-6f5e01392c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618251906, "uuid": "81d9eaa5-cd70-40a2-b63c-c9c8dea51c14", "value": "548235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d770885-9b53-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618206818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206818, "uuid": "a61bd6f9-27b0-4ac5-970a-aecebe1c2826", "comment": "Malware payload (AgentTesla)", "value": "bb421db55987440f1c674b043d940cff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206818, "uuid": "36532e58-faca-4a41-ac82-15f70fa5b43a", "comment": "Malware payload (AgentTesla)", "value": "b6333a0cb0b187782ed23fa9af1a381f8dac3f6785c568b2995509ad4acba4b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206818, "uuid": "56fb291c-30dc-484a-a56a-f66a84fd469f", "comment": "Malware payload (AgentTesla)", "value": "6d9efdcb5e3f800c407540bfe568d030e0644afd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206818, "uuid": "4dd72660-c585-468e-8beb-1740cdd68e84", "comment": "Malware payload (AgentTesla)", "value": "6671beae592813976ea6096b6353e3c81fd4301a05b5adfde32213bb1fdf9bf4fc6d0d4bf7c9e60f3a03631a33768af4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206818, "uuid": "80b58c35-1be0-4ae4-8344-37f8c7c1f622", "value": "CDE43387A9105811F346E67431E79A7B194F009F94ADADF8BB304FA68F1E75C0E58F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206818, "uuid": "b35e3170-e686-4972-a0f0-f51847740d9c", "value": "12288:Gll+OTJVtg5+m5oSW/WXPMLrEX7YXj2kQfkr6dRQWSRXoLqFVjWx:GeqgX5oSjXULixkm8wRQzIqFVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206818, "uuid": "bf25eb60-0ce6-49c8-8cec-8756c72eee5b", "value": 700751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206818, "uuid": "de24e54c-35c6-4e15-8a42-cd74830418cb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206818, "uuid": "af8a699c-84e9-4970-8d87-7ab123fb30f2", "value": "Payment_Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e76ce1-9b80-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618225968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225968, "uuid": "24924ed3-d9bf-4406-8f2c-3ebe004a81a8", "comment": "Malware payload (RemcosRAT)", "value": "448ca1ff37a446037046671705d166bc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225968, "uuid": "0a49557a-84a0-4425-bfe4-307acf7df4b0", "comment": "Malware payload (RemcosRAT)", "value": "b63a672f485defdec1774da3ab65fa6e8ec2525d3740dd1ba79c28d0945aa04d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225968, "uuid": "058af6dd-6f43-48fa-ab72-2a7fd9422031", "comment": "Malware payload (RemcosRAT)", "value": "c4fd0a4f9ea92cf1dd3083b549c2f6405759d5f1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225968, "uuid": "79719f76-7a35-415f-a952-efd88687bc97", "comment": "Malware payload (RemcosRAT)", "value": "c26b93809e68e61ff9d654bbeac993f121e841bef1777eadabde25573d4698aa1e3c06f16102ce2a5c3582cf614c30ef", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225968, "uuid": "62c61298-e535-4590-9649-c5fc569f8ee4", "value": "25F4AD33F2E18437C16E5A3D9D1BA7D8982AFF21FE64994A67F40C484F357503A26293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225968, "uuid": "735e09aa-5fdd-490f-9926-e5e9f95ffc27", "value": "23399c21b0aa604a8aa13da9702198d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225968, "uuid": "4e03b323-0888-4780-ac84-cdd7e1f8d530", "value": "12288:wjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c0WKRmpP:wjMmMH8XEgfqFDd0WK8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225968, "uuid": "63eb5128-fd75-4cc9-ae74-7de9d763ba3b", "value": 787600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225968, "uuid": "f0e56cbd-67c6-439f-94d4-f5858d29e1be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225968, "uuid": "83fe36a7-6a16-4b50-a960-83060187f545", "value": "docs-00425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0894ee-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618233577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233577, "uuid": "516b76de-253d-4e8c-b586-2433de608058", "comment": "Malware payload (AgentTesla)", "value": "7a7078e03fd2fee66b7436da7222d2e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233577, "uuid": "4e4ca546-2b82-42d8-a518-dbe5a10320b1", "comment": "Malware payload (AgentTesla)", "value": "b655965e57f392a0c5d82d2f248d432575b4f7092fa87a8bd868e56e6e32d546", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233577, "uuid": "9e74269d-7d41-4792-9a1c-5a8c95fd56f8", "comment": "Malware payload (AgentTesla)", "value": "03f9dd35d1d16d69da789e8e1e0119f0163adaae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233577, "uuid": "4fcf2e70-56c9-4e3f-b970-9741bea0c751", "comment": "Malware payload (AgentTesla)", "value": "ff395829986f034425135fcec7e7a55481520111e8dbb3ad08de76d0b935cd6f35d2d2b32e8f5ac563ce6e85e5753de3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233577, "uuid": "918de93f-1f0a-4a98-8792-df7c0dc7f672", "value": "85D4CFA5DA849585EC2D2F7510726D141377BD22BA76F60DA99C70782FB33C38037A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233577, "uuid": "f9d34076-bd1a-4b54-8534-bcae39e72e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233577, "uuid": "fbcc4406-d6da-43b6-8c57-999b70e1386c", "value": "12288:rxpH6m/fCbppI+hEUdrTcxp/mYkTTMQBLAhkDKi:7r3CPIOrV4x0YmTMQyhkmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233577, "uuid": "955e8eb3-f9e5-4dbd-bf84-18ef204f1622", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233577, "uuid": "7a12fd83-832f-4e3e-8507-92db243d37d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233577, "uuid": "3f0f5fd4-845c-4824-8393-39e6b0eb0e9f", "value": "DUBAI CHEMEX REGA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7bd0cf-9b74-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618220909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220909, "uuid": "8cb02e03-60f3-4707-afe1-74a420448637", "comment": "Malware payload (AgentTesla)", "value": "42ffdd434efb48304897358b608ec54b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220909, "uuid": "152f35d5-012a-4f51-b3c4-0b21aff2dfa9", "comment": "Malware payload (AgentTesla)", "value": "b68ec64435f531b2cf211c6012726ec96585a06aa3da09bde450d04c7f7754b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220909, "uuid": "6d00188c-0469-4b8d-be5b-12eba95c9ffe", "comment": "Malware payload (AgentTesla)", "value": "eedf22856000a4725f04b4a104548b6cee6d2fbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220909, "uuid": "a4c3906d-7087-494c-bbe9-2c8ee6475f8d", "comment": "Malware payload (AgentTesla)", "value": "46828a5241cbbefedba9d6a6c067ee5b2f24fa3eb2a198b80bdb8f862864a0e155ee500fe5506d0a251e0651e1315c9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220909, "uuid": "1605a9a5-2816-404b-9232-30bed2d05476", "value": "7D158C987604F5CEC857C932C9545CF09620ACEAC31BE60360573D98B97D68FDEA68F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220909, "uuid": "a2d90bb6-eb36-4357-b88e-bb7085a17713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220909, "uuid": "f12ae58c-378f-425e-bd6a-4899c0ccc909", "value": "12288:vixi30Q+fHfsyj9o9JMctMBgqas7/2jSvNcZlm46OLszjG25Ka/S6Pn645qZLm6g:asmsyxo95t8WQ/2oc36OAz75Kx6v645", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220909, "uuid": "7e42e187-c4b7-4c04-a045-882ac7d1697e", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220909, "uuid": "70247f4d-2e57-4bb1-be10-686fcf8d68fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220909, "uuid": "efb2587d-1ed8-4de5-b8c1-981871509640", "value": "Order 00223342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ea40da-9b63-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618213726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213726, "uuid": "150c1449-98cd-42cb-9395-03a7b277639a", "comment": "Malware payload (Loki)", "value": "76b9a5e8e8365698b7c23fe8f53aa6a8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213726, "uuid": "914c0a4a-39b1-4f26-a2f7-ee5122f5b0f6", "comment": "Malware payload (Loki)", "value": "b702ef5ed85b62617f910754a74dbc20ffb9ba9f1e196832979d1e6b5b4ae6a3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213726, "uuid": "f60b6409-865e-4ef5-a7fd-f4cae551702c", "comment": "Malware payload (Loki)", "value": "43e7a55fbfb8a5c8032f56900760a75ee606a829", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213726, "uuid": "31d15aff-94ce-4294-9fb8-e216f3e47b4c", "comment": "Malware payload (Loki)", "value": "8edf34599dee82057c829b6f674bf2dd3f0679d51e6b9cd75a5798ceb1fa6b441d5dfdd02a32f3d69f8b843db7a4262b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213726, "uuid": "ff75603d-9646-4350-ac67-084a61ab84af", "value": "03C5330EFFCB8766D1E205B70574A92C29519F1A6E1149076B3BBEA52037F33A79231C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213726, "uuid": "da2c6919-4385-43eb-8472-501595b5a529", "value": "49152:HMCD6pwNW89EAMZkM0op7L/XONlhCOtYx6L4OHXtKSxFW2fifzSOw2:su6K9EAuyoxLolMObvdKSxFWi4N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618213726, "uuid": "a0412d5c-6f94-4215-a342-75b960751539", "value": 2574848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618213726, "uuid": "ed9c4de9-dc11-48e0-969a-c3705571fd90", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213726, "uuid": "5d19c674-fced-4bca-aeec-e94785fdd5f1", "value": "PROFORMA INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ae38be-9b96-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618235523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235523, "uuid": "4e7aef5d-a008-4870-a335-8b6510c7a5f6", "comment": "Malware payload (Loki)", "value": "4ed556ceabbf1ca101bdfc7957650c35", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235523, "uuid": "8a78225c-2968-4bb0-b7a3-5fdd67d3d2ba", "comment": "Malware payload (Loki)", "value": "b70692be0301359c39dff01e592c18d6b983c14515da66a0a16f9933d3d04258", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235523, "uuid": "88f65b1c-7b9a-4137-8a61-5f1c214776d8", "comment": "Malware payload (Loki)", "value": "1d38dd418cf9d473b97385003bfec4fe1de70c38", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235523, "uuid": "0e36534b-3996-449b-9171-e7476dd2c3c7", "comment": "Malware payload (Loki)", "value": "3a5eb1aedbd09da15c166f0e390dc348f1232772ddf91fb47e3561c20fa7dffa23d20f3e8b6596d51256cd00ebf8ab1f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235523, "uuid": "f09eddcc-1c57-401f-b1b3-bd840ee4191b", "value": "D2A53342EEC35F49EA6C4A70D82E162C117C8C472A5A8C76BE9FB075767236007E977C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235523, "uuid": "27a6d9cc-9efa-4e11-9cd1-9691271c35bb", "value": "49152:W4mcb0CRAXMvYwRdquX26kiW0evyFeFwHDFD:zjoci6+0evCeOjFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235523, "uuid": "728fcf5d-52c8-40b4-b377-a69e157169e5", "value": 2177024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235523, "uuid": "06003fde-d6ed-470a-8b43-d63d27111bf9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235523, "uuid": "70b1856f-36c2-4296-a8e9-0e9118c69a17", "value": "_RFQ_Hongjin_.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4fb6cb-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207304, "uuid": "11ba5a8c-8f4f-43ba-bcf3-b6c8da98cfa1", "comment": "Malware payload (AgentTesla)", "value": "da60d646e63e252736a76998f36a6547", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207304, "uuid": "e2c14681-3c35-4e7b-b73a-d41cfc0373cc", "comment": "Malware payload (AgentTesla)", "value": "b728133491571b5473adba573e27014ccd8a83a337549e1cd61bb53675d9af81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207304, "uuid": "c781735e-73ac-479e-86bc-78885101e4c9", "comment": "Malware payload (AgentTesla)", "value": "ca9af1d7be7667784742ced9b33141d7c6a4e0ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207304, "uuid": "312c29f8-c916-4f81-82a0-b93372f015b8", "comment": "Malware payload (AgentTesla)", "value": "a5ba99387d36d6fe183aa2d54cf856ef183d1cf9ca1ee8d048a9d89502eec4a042c9cc9aa21cc1c68c59785178b51bad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207304, "uuid": "51fde4a8-f922-4030-bbca-592ffc4c4837", "value": "56F4CF2F3780296AD91C0E7B941B448063F4CC67A63AF31E7DC636E58FB1A1B553B216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207304, "uuid": "9b099a6b-9c15-4502-935e-10ca91b932c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207304, "uuid": "c66e593d-a3e0-4aff-bbe9-7b3e4bce8991", "value": "12288:uDZtOcgfiRzqqB3PQhPp5owKZW010CjZH+TqUXHImiN+ladNWQLurd:uy4zqIgfoo01LVH+OUXHjiN+lablLurd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207304, "uuid": "050645ac-e659-4ed0-b5cc-dc535a5d3546", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207304, "uuid": "b415133c-9aab-4585-8da3-83b53879c4a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207304, "uuid": "e0573dbf-0ed5-415b-9fed-ab636ac5a43a", "value": "APRILQUOTATIONS#QQO2103060_Hangzhou_Zhongniu_Import_Export_Co.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8695eb6-9ba0-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618240122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240122, "uuid": "b2d4f22a-4454-47f2-bd0f-01de9f93d351", "comment": "Malware payload (AgentTesla)", "value": "9dff2f34e08f130b6ed8255404fa5c9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240122, "uuid": "8fce2901-ab41-4fc3-9e1c-1d96ac40a856", "comment": "Malware payload (AgentTesla)", "value": "b852dbb19b335378582a2ec131f5a362c51a4d8c63bd832cd9afd4c064d449fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240122, "uuid": "156beb8a-895b-4e0e-83c9-c6cb5a825977", "comment": "Malware payload (AgentTesla)", "value": "502704687545231b2a2a10416357e894d5773b76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240122, "uuid": "138f30f3-6943-4724-b4c2-360c7645fb84", "comment": "Malware payload (AgentTesla)", "value": "bbc6fd4a6fc6616ee958907093bde5647a65d44c1d9013d04e6fd7bfa0fb10c783ca2492f23617f86e0abd0ff2003efe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240122, "uuid": "1f97eecf-53ff-431e-a507-655345741721", "value": "7905022927D08E17C6BE4B7954B1A2504375F1209B73E70ABAAC207D6EB3BD14B5B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240122, "uuid": "6e62bb39-ef8e-437d-bb74-655eea80c6b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240122, "uuid": "f92e2369-ec2f-4e0d-ac70-8c9c55bb0b58", "value": "12288:dZn2YfE5ipS/aOBqQkeKVDt5GzKVUPjsEJRt5Nt8mhhNKDkaCN4WswHAlKGWYTlT:eIUBqhPVJ0zKVUPLH88TK44W6YGWYTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240122, "uuid": "6c0237a3-7bdf-4034-a9ee-49656f4caa75", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240122, "uuid": "ad3ca03c-cf9d-4639-844b-be7e2784e4ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240122, "uuid": "8a50e4d5-66b7-424e-9fde-f7cd105f50fb", "value": "Arrival Notice - S2101280194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c8b558-9b6c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618217415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217415, "uuid": "d932f1ea-f889-4f2e-ba71-b9e3f44e51a5", "comment": "Malware payload (Loki)", "value": "9f8ba15a07b809f914043965847ea8a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217415, "uuid": "c3d11c72-f3f5-4a6e-a469-fc1445990738", "comment": "Malware payload (Loki)", "value": "b8e31a8f1ef8221b96abf4468003515208dde7809211a620a4609ba2e57cf080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217415, "uuid": "83dada5f-3592-44c9-a555-039d221eabff", "comment": "Malware payload (Loki)", "value": "5a12bbe663c7392e8e3309942850dec891b98f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618217415, "uuid": "409c4d50-52bb-4deb-b3e2-89718596b8e6", "comment": "Malware payload (Loki)", "value": "76c8733919aef30bf9e818f36b43ceefea49ce08b476af6d63df062425a83967d13f9fdfb7907208e5429472ab33c0b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217415, "uuid": "df0b2943-9997-4d77-86e4-fac5a2ca15a7", "value": "98E30213E2D1DC2BEAC0D6710E772B2BD7B3C271112A35474BF11F3BAA61642AE16166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217415, "uuid": "cf8cd8ed-788a-4721-bce8-f2215669422a", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217415, "uuid": "1e254cae-7821-4fde-b446-6da0d084766d", "value": "3072:HyewmN4skJ6oDJ4BSlhqteaiUR4ZHWyqgtGN4pKvEIPt9ibt0hR5ndC:HdwJA2hW6GurqgmWI1jR5nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618217415, "uuid": "ecff2fae-0d7e-43a3-9219-67817ffb47aa", "value": 148269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618217415, "uuid": "52681cca-fdc7-420e-8f8d-a3f2e9f96c97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618217415, "uuid": "8657ffe5-86ce-4af0-95ed-e4e874be7b3e", "value": "9f8ba15a07b809f914043965847ea8a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0325ff5c-9bae-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1618245724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245724, "uuid": "aaf4e937-0fce-4a15-9702-53749c7c03d6", "comment": "Malware payload (Quakbot)", "value": "64ce728339d9ca928a4f2643b6098dda", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245724, "uuid": "3a61eabd-19eb-4449-b7aa-a98edefce90b", "comment": "Malware payload (Quakbot)", "value": "b93a9e972d297bb2a0ae163d5c9a087bf29dc5db48eaab8d9e0e5560f48065c0", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245724, "uuid": "fa3113f7-d529-4324-add6-411f07afe23a", "comment": "Malware payload (Quakbot)", "value": "43fb58a8536b4b97cb812f8c02329703d3085cc7", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245724, "uuid": "87f977be-2438-4ae7-ab76-a7f0967b606d", "comment": "Malware payload (Quakbot)", "value": "9279fce292707a5400c1552e3e234e0ddd0da6cbf375018313c9fab7f408faba09d27a07c3fb8412324c931c6799a534", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245724, "uuid": "53af5d49-1091-498d-be67-98f74c6871f9", "value": "77A39DDDCD12B4C5D2109F7C8A09B2C518F4D0B63A1FB10A6589A22E1D81FAA198F7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245724, "uuid": "b86b80a4-7359-4d08-ac55-2555cf9f3b35", "value": "1536:PRI2I6xsXKM92hawT0DausD9Byrty30wEGttZv9xofadh/:PRIvMWMHfD9ByrtyOG7ZVxoch/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618245724, "uuid": "a5ac1ce2-0d01-433c-baf9-6d8b55457409", "value": 98273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618245724, "uuid": "c4d3fc6e-6c90-447b-96a5-46520b180cad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245724, "uuid": "3327f8df-d2a7-42fe-af7f-44e3e48d4799", "value": "documents-122179384.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fcb8f18-9ba2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618240806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240806, "uuid": "94aef5bc-e61e-47b5-904b-f712cb79ed46", "comment": "Malware payload (Dridex)", "value": "2df91ffcda07c9dc029555acba10e93f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240806, "uuid": "1a877f54-5ee3-466d-a1f6-1065cacd8266", "comment": "Malware payload (Dridex)", "value": "baab3b0780e45d8065f01299472a252ba5a1657ee410530d892ccbb1afb29666", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240806, "uuid": "91fc46b5-7b22-4324-a2fa-d3e5328686c5", "comment": "Malware payload (Dridex)", "value": "66b5cb294da1d3f5a863a97fd3bd9dab73a75f6e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240806, "uuid": "7d6bffda-863c-41bf-a12e-2c050adb1a6c", "comment": "Malware payload (Dridex)", "value": "84898dcbe09f08129588a5f915c79438598e5a832fa67ab464e84c43f3e6f8f933dacbf52cff0d767875f0cb1bd9112a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "macros", "colour": "#F0E650", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240806, "uuid": "10d55678-d6e8-4a8a-a183-d4f1051aae5f", "value": "48A39DDDCC53B4C6D6148FBC8A0971C514F4C4B63A2FB10A6989A26F0D41FAE198E79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240806, "uuid": "c387144e-d425-41d9-aff9-63a1e170c014", "value": "1536:jRI/KKxQe72hawT0DausD9Byrty30wEGttZv9xof46:jRI/KKOkMHfD9ByrtyOG7ZVxo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240806, "uuid": "8314ed7d-c061-4dbe-887c-2a361632caa7", "value": 98209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240806, "uuid": "013f3b2b-f5d0-497b-845b-f058cd927163", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240806, "uuid": "fbbb0f32-912a-4a54-a978-af839885399a", "value": "documents-264987217.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335a492e-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618209298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209298, "uuid": "66b9eae8-1658-4ef8-99cd-af9749ce71eb", "comment": "Malware payload", "value": "876669a7e683b6f3d9ad736fda82f407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209298, "uuid": "d69786c3-1db5-43a5-9ac4-13b1f1423c7c", "comment": "Malware payload", "value": "bc7b8561256da883ee46e68ee4f635d2e11a3436247ab61fa5b88455739aaf8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209298, "uuid": "476cd5ec-fe94-4c58-b2a7-7497164e1727", "comment": "Malware payload", "value": "f997263035266c945e43cf332ef20102a4e9c8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209298, "uuid": "5070cc3b-70b9-44cd-b396-5b3963c0210c", "comment": "Malware payload", "value": "1665645f6b6e5aeefffc8a1665fb4fed3f3f2314f8d1d59a52eb07f9b6740803fc18626268bb991fd5673d29455588ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209298, "uuid": "aebbd955-694d-464e-aeb9-1505d1e7a6e5", "value": "23623C455FDC6A34FBB643365E71C9603334B9872522DF5E78C42264AED93480EA1FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209298, "uuid": "bb522278-257b-443c-9e7d-513d284f5fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209298, "uuid": "f6e3a23b-a0b1-4daa-b87f-ba205de13d7f", "value": "384:+8amR1rDp47LsnVQ2UPVhKrUzZvAWnXRX7zx7J:+8RRl+eneVAihrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209298, "uuid": "de5df6db-0be6-4ff6-8691-6086435041c2", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209298, "uuid": "01600d0d-1305-4ed3-96b1-e77f9cb70f70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209298, "uuid": "34356992-7f1b-4276-a7dc-c1b732b55abd", "value": "876669a7e683b6f3d9ad736fda82f407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c241c8-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618209402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209402, "uuid": "25cb24d0-633d-4b86-9004-36b808da1acd", "comment": "Malware payload (GuLoader)", "value": "ad0c93b574bb947cff15483eda82811e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209402, "uuid": "ce5830d2-72e9-4a94-aa9d-6d611a78ae80", "comment": "Malware payload (GuLoader)", "value": "bcaac39113bd17158fe86a77328f97e9c3fa14860c9c4449a8ae0768c85243f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209402, "uuid": "b62c1987-0129-436f-83c8-e441ab5d516b", "comment": "Malware payload (GuLoader)", "value": "ad379c5a86bf646c4a079e737a364ab352107e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209402, "uuid": "71c2a1a6-285a-4f9d-934b-9b04a04370d6", "comment": "Malware payload (GuLoader)", "value": "625df0081ce57995719e03c93eadce990d9f634915f0e58d08af26563ac95e318c2c27aaa37f3673971b731bd985b317", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209402, "uuid": "5a04e91f-9d9a-4f5a-9690-57bbc98fc1e3", "value": "1C84C566B509A02BD996D5F0316AF10AB1753D3206B99C1FBB90FF3A6070593B5BC30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209402, "uuid": "3a7e7ee5-ddc0-4a85-8c30-c62e3b580374", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209402, "uuid": "7842f244-af08-4618-8345-859f04890da5", "value": "6144:zvEN2U+T6i5LirrllHy4HUcMQY6ZOaoi7ru0qFkBYDoogRI30z0noojfIVAdayb1:zENN+T5xYrllrU7QY65oiHuhGYDoogR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209402, "uuid": "f3ffb84e-262e-45b7-b036-2da776051706", "value": 379720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209402, "uuid": "5a32bb5f-62b2-4fde-ac9e-dd94958a5901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209402, "uuid": "8fdd91ee-4cb1-4601-b04a-85622f55d99f", "value": "ad0c93b574bb947cff15483eda82811e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb926c6-9b83-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618227651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227651, "uuid": "e19a5733-7542-45d4-aa3b-296b30a2b216", "comment": "Malware payload (AgentTesla)", "value": "62cffbe922a88ebae13ab4aebfd8ed2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227651, "uuid": "3f5712ec-ab84-49c3-a6fa-0fc536a1fe8a", "comment": "Malware payload (AgentTesla)", "value": "bcb425236d9708acd844d3abf15e14a33f029ee760d1dacf9c590a70c2283e75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227651, "uuid": "8f779416-21a9-4c73-a51b-1a3cab38dfed", "comment": "Malware payload (AgentTesla)", "value": "569321846759678308cb52d01537aefc2d9d8389", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618227651, "uuid": "e21ad145-e3c9-4c99-a851-560a7e453974", "comment": "Malware payload (AgentTesla)", "value": "1a23c59f6559b505fe4feefb0e0ed58ad4ae348e051d94928c697527f84fbae7e666e92c4491b50d82775e9087dfd916", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227651, "uuid": "15065876-ba93-440b-a275-0ebfc2f8af67", "value": "CF05023953EB4A15E4BE1F3940F0604503B5BD169A23E30EEAA8306D5E737D6862F367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227651, "uuid": "883470cd-6f3a-49ba-9480-428eee2edfc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227651, "uuid": "45311f72-30e0-4456-9e43-6b5fd5f116b6", "value": "12288:SopTcgSA5FMxYj3yATy1nWPGNUsSvjHAE0diJHXbms5PulZWYNh3Cq4HrRDi4DHL:PTNHgYjiA21WL7PNas5PuyY/d4HNhmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618227651, "uuid": "5400d0a6-9940-4fd4-8aac-7703b191637a", "value": 818176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618227651, "uuid": "ea499a80-6dff-43f4-b07b-cabfcbf79036", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618227651, "uuid": "68c5ec4c-783a-45d7-9f22-fd3d401fbbd5", "value": "UOB_BANK_MT104_SCAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe45d57-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207520, "uuid": "c4750bbe-d8c9-400d-8f8b-625841308c43", "comment": "Malware payload (Formbook)", "value": "525cb22afe0244e45b2831b243b27a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207520, "uuid": "9d8eaece-44d5-47d5-a013-b3d7ae46151b", "comment": "Malware payload (Formbook)", "value": "bcbdc1722d82cfdd00d6748654937dd6e79b81661df159ea9387d61f3ed38034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207520, "uuid": "c959b565-7ee8-4cf6-891a-329f7e70c3d4", "comment": "Malware payload (Formbook)", "value": "df33a4a91f50e49ee7c3283b1022024fca7ceade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207520, "uuid": "1f08f64c-cca3-436f-9e1d-d204e57edab2", "comment": "Malware payload (Formbook)", "value": "78d985e9e28f5f7d0c13ef3c6a7055a583facad228a66d406b603922b36276b5f51ade34d24d74a4404dd72959ab76df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207520, "uuid": "def8bb40-8cb0-4eb3-b78f-82e893b9b5a3", "value": "B1E4F1207BD6C752C93A07F69432900307BAF1DE7817EBA84D4590DA2526F4C9DEADE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207520, "uuid": "68143272-e5ae-4b54-922a-aa5c96f792f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207520, "uuid": "2775d6c7-e411-48f4-a72e-128e177822cd", "value": "12288:eUA8Dpprq/7mz98ARu519pEpCPXD3XkeXxSHnob0agtjty2PouxcM1:eUA8iy5NO1YGnzQZnyIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207520, "uuid": "2ae4bf46-2adb-4a4f-85c5-0564f0b666c2", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207520, "uuid": "27d73aff-213e-467e-b4f5-822280d4ebbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207520, "uuid": "567fc9f7-735a-4019-aff2-7b88131809db", "value": "\ud55c\ub77c\uc0b0\uc5c5\uac1c\ubc1c(2021.04.12).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09396872-9b51-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618205791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205791, "uuid": "0e3ef18e-4227-41fa-999d-a5b33f2dad9a", "comment": "Malware payload (Formbook)", "value": "f965a43e33c428797f0610b57ee55cec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205791, "uuid": "3210f372-e47f-40d6-b305-1d6176706015", "comment": "Malware payload (Formbook)", "value": "bccbb448b3d5d03eb9495ccafab25799b6a7dab80283e899c763d460345435b4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205791, "uuid": "ee8afb4f-2db5-4374-9fa8-2f5349937fc1", "comment": "Malware payload (Formbook)", "value": "6fa2f341f1238124c723602c3ed368ae2a5d7db6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205791, "uuid": "bfefcbf3-b954-44c1-8c2a-ab264c87e5dc", "comment": "Malware payload (Formbook)", "value": "c100c0710cc952084158871f71d359051f58e20dc8382c984bb7925bb6dbeb8490b69d6d41b253129da95bfc6604e32e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205791, "uuid": "ccd33b22-ac32-46f5-93e8-9e2c08997c1d", "value": "81C533272EC25F07E03DE835E5BFE21C0928EE1169855D71BF1E3A10B4BA6F82D96354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205791, "uuid": "65105faa-e1c7-4fae-ba12-55eb3055cfd3", "value": "49152:zJTNVFNEu1iK5nevkSjDSEC4tAW4FXYzfVWh0kRlcm4jPT:zZNne8YSUtniozfVWh0yzqPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205791, "uuid": "7c77c0b6-e31b-4d4b-8e09-398374cde255", "value": 2510336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205791, "uuid": "76ca3c22-ae77-462c-a063-144d96a9dca6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205791, "uuid": "95983ed0-a6d7-41e6-a6be-4c95f1c53640", "value": "remittance info.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b184be77-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207791, "uuid": "30e60a1d-2519-4648-8a28-e643407dcaa7", "comment": "Malware payload (Formbook)", "value": "f94f8e53665dc53c2ed24487e7225f6f", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207791, "uuid": "12bddd8c-1fd5-45ac-9066-16a6b4f8dd04", "comment": "Malware payload (Formbook)", "value": "bcea945b35f3da8c374d7474e0437436ac16f2f58ed17003fe1e3307ad7ebaa6", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207791, "uuid": "ba332789-31cf-4ae4-b4d1-25bfe2fa5911", "comment": "Malware payload (Formbook)", "value": "89258010794ed01c10eed889d851f07304354b4e", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207791, "uuid": "e6891278-be9c-468e-b079-1c6af6adc30b", "comment": "Malware payload (Formbook)", "value": "58c878601e8b9c0e985b7e2260fda835b25d92f3e83331c130e2653999461e68f2ca1e842f3ea7b88dc85e7a544f9cb1", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207791, "uuid": "43345fd4-1e9a-40bd-be4e-d3157454f6f8", "value": "F5E423E7B2AD81981094E93FE7162C65C63FA3BCF63D8535EB2B69A4E442734FA40051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207791, "uuid": "d64c30a4-3dcc-451d-9efa-911a572e2937", "value": "12288:SAEQV0npCBjdt8DljiW4PjM0fsvshjDCQDdhzTg4Ho1MRsjL3FZto:vTU7ljgPjxfsujDCQDd1g4HodLRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207791, "uuid": "e5fa8223-cf47-4bdf-bbfc-a4c05f5da79d", "value": 700146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207791, "uuid": "a7d570ff-67c4-4aa3-82d5-a90e000632e9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207791, "uuid": "9b3ae4dd-ef76-4890-a25c-e2c30a5da1b1", "value": "DHL_document11022020680908006.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e8a048-9b39-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618195818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618195818, "uuid": "8eaa53e2-8dad-4f79-a92d-e87e8366306e", "comment": "Malware payload (Loki)", "value": "655aef15dc4c4cc28011960bb0c77b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618195818, "uuid": "e0b1963e-7c83-4be0-83da-90e3b84df593", "comment": "Malware payload (Loki)", "value": "bd9b38770c31a550cf3474af717dba80fa74f3189352c53e747e439721d80cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618195818, "uuid": "36e3bd75-f0a5-4be4-bc76-10a5399fbf66", "comment": "Malware payload (Loki)", "value": "e20dedb43c4be7cc65dd5507fa9c1ebc40768efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618195818, "uuid": "554abe3e-2cbf-45f3-abca-52a6f4613373", "comment": "Malware payload (Loki)", "value": "909ea6aea218ea69ec99b9c2b3cfdca5dc1919110f94752f62d95f0b5a5e0310d6f04d0fc5a45ed13b24753b3537affa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618195818, "uuid": "5fd449be-6b38-4d9d-81fb-151f6ee6c39a", "value": "88E3028166E55C73E622B0390977533BC3B74A9024221BA74FE54F7FD762B43C9292C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618195818, "uuid": "143d9955-85e0-41fa-a698-d9ffaa3899b3", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618195818, "uuid": "4ea14934-1cce-422f-b68a-983f27243b6f", "value": "3072:HyewmN4skJ610iISE2e6Ud/1lsvcpealBhmA2XXPI7iX0p5Ad91oSPC:Hdp0oxUDKavlLzporov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618195818, "uuid": "7a2514f8-81e3-42cf-9ac8-145e22dbffd3", "value": 148757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618195818, "uuid": "6f6a697a-05c5-4760-b84b-c8c1680c7770", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618195818, "uuid": "983d410a-b318-4547-bb86-d43454123adc", "value": "PONO.238275Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4aeca4-9b50-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618205746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205746, "uuid": "ac224368-97c9-407a-b37e-7582661fa1ef", "comment": "Malware payload (Formbook)", "value": "e5fb3d32d5611f31989d93dbdc90664f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205746, "uuid": "21dd8aec-9421-4a9a-9c8c-fbd6d303ea92", "comment": "Malware payload (Formbook)", "value": "bdbc9a2d2224b9c0d5dd1c3c778215bfed55213e4408f75ed93b735661b921e7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205746, "uuid": "2e6053d8-5d78-428c-a1f3-dfb5bfcf340f", "comment": "Malware payload (Formbook)", "value": "429f2d62be1a0f82a877a93d3a87c6cdce7b167d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205746, "uuid": "adfd728b-6ebb-44e8-9924-c3d2e50395f2", "comment": "Malware payload (Formbook)", "value": "2292bf0cf911fd201c76afe94d05179cdd5c0e1fcc05851fb5a3eb98a009a57c91bb9d592147a49559cf8177eb41b8f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205746, "uuid": "89b6ec5e-7974-42ac-bfe9-02e3431af062", "value": "18C533A7DCEBDF20EE1F58FB8166E97911AA9E445890A413777C396C26B34302BD210D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205746, "uuid": "a4e43433-e1b9-465b-b5b0-cc7aca9b03ee", "value": "49152:fN2tac8SYLgXepFw3NJBZr3BrhAe1NN8IFgC0POsJll+C9DtoMRbc:fN2ZjOpFKjrD1j8YV5sJll+qDDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205746, "uuid": "5049b4f8-1461-4308-b631-0f61ef5ce0bb", "value": 2591744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205746, "uuid": "a1ed7f2d-7fa0-4db5-963b-5b2c6ed7ae75", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205746, "uuid": "f8eb3ad4-a7dc-4c62-9ec9-e377757f66c2", "value": "Payment advice IN18663Q0031139I.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e327fe91-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230208, "uuid": "12993fd3-5c06-4937-8665-6d309e28a599", "comment": "Malware payload (Formbook)", "value": "ebfeaa73811b084ff7ec882503205988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230208, "uuid": "bd3edab3-b175-49de-8358-e81e620bbf71", "comment": "Malware payload (Formbook)", "value": "bde02a4b70a0070b28f0e812f6f7a857f2d57e2c8b6f3d0f11c9bb6a66cdc05a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230208, "uuid": "e33e5c14-a59f-4390-8b24-e1ad4622a895", "comment": "Malware payload (Formbook)", "value": "893e9fd1b6f1ccb56dbc389799b93ecbf116ee74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230208, "uuid": "eeb491f3-a99a-419c-9960-ae43c32118fd", "comment": "Malware payload (Formbook)", "value": "d8a566eeb7080cf6ede99623e22dc595de0c51427c616b0cb9ae7dfe1091416d3b4f5cc295659aca0de776b3ef0600c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230208, "uuid": "355e355a-331b-416f-bd41-e837f7fba4db", "value": "9CE4893366FD32FBE1981B785557165A0F207F76AA33DA4D5572B8F1A33AF804022E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230208, "uuid": "dffab821-ebc5-4c66-a2f3-f65141e56f82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230208, "uuid": "b4d96255-58c4-4e7e-9908-e75d868beffc", "value": "12288:5NkKNu55RIPDQRPo1eviHXJgoYcgMuwS2T8Xo2i10OlYa:5qKvPDQpweiXJ3YxFWgXhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230208, "uuid": "4716634e-ba7a-4f2e-b868-2e4298c12472", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230208, "uuid": "708547df-6b9e-481d-8396-968bcca8e3d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230208, "uuid": "4d0f32ae-ddbc-4be8-ba1e-a224f7a50cfe", "value": "Payment Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5540dea-9b70-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618219448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219448, "uuid": "63dc95ba-9181-4ff9-a376-045f0656e6b8", "comment": "Malware payload (AgentTesla)", "value": "3e12d73850e8d9123f410160888583fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219448, "uuid": "84fa0b7d-f773-450b-8bf9-95bef9751cd0", "comment": "Malware payload (AgentTesla)", "value": "be48e27318c1fa71231553d56d22eeee70e1fb66e0cdc9bcfcaddac95cf7763c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219448, "uuid": "92a29df9-f2b8-4f58-8cb1-d5cdb2f2d10c", "comment": "Malware payload (AgentTesla)", "value": "85538a2279ad0a55a62a90661dc1f6f9e7c1f461", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219448, "uuid": "40f267c9-23b5-490c-b797-6f75a1bc00ac", "comment": "Malware payload (AgentTesla)", "value": "86541e702f6d55be72776e8a3e0e7e6e75b0057cffc9c481965d1d7453cfbc4bda0ada0a8315f9470a46bead158e4c3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219448, "uuid": "79fdf2a4-e61d-4e68-a036-cf20892c4ef6", "value": "3D9412B0FBB79747CDA305B1B9828B6A9909CD60035DB9B2B33FB3175434B6D4992138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219448, "uuid": "099778c3-6558-4a20-a9b4-10848ca62de9", "value": "6144:MqXlxQhAy6S8pK0/UkW8RQH5TyPwTQoUXu18/LvzI7KvhGmUyhSrfz4rYM25e/e1:flxmH2XsLrHIwTOu18/OYUmTSb0rYMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219448, "uuid": "32c2882b-941e-4bc3-a59b-fe081dd056a3", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219448, "uuid": "4be5c325-39c0-4547-b642-70993c7a0ef3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219448, "uuid": "6f6031a5-b3d8-4963-b831-d1f085d448dc", "value": "presupuesto.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fe707c-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618214562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214562, "uuid": "83d08791-9672-4a54-a415-cccd8b21733a", "comment": "Malware payload (Formbook)", "value": "1575a90d70a067e1f29ebfb9b83bdb5f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214562, "uuid": "5f4325b6-7f54-4b12-86d9-3214aac9a298", "comment": "Malware payload (Formbook)", "value": "bf1a73dd226861f1fa12ee848127d78e51ca105f7dd6d153a50ff90a9ac8cbb5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214562, "uuid": "1c692f72-17ca-4850-947d-496b5547fb39", "comment": "Malware payload (Formbook)", "value": "ea2ee76efae60bbc61ef2baacd1a359d39403968", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214562, "uuid": "d1a0bf39-6899-4691-9315-fc06fa8f8c90", "comment": "Malware payload (Formbook)", "value": "4282b808d2bb223426058c3e7c38f59b307004f582b71dcdc1182bfdc09bb5cef7dc3224dd2a5d3c5fd69db092a82f78", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214562, "uuid": "e206d4e9-ebd0-4f53-aa14-f8f504099b37", "value": "BCF433F62017EC02C80F299113FB361F1EA7997609A6EAF3BD9876738FD79816701911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214562, "uuid": "d033cf5c-57f5-4bcb-b8bd-f6f560595e5d", "value": "12288:MvWA5uqu/yLzEgvUke9gCoMqWPdxNGdRJ1hHdYpmrTMXGO6rPPphEf85Uq5:MXd0K4GUke92ZWPaRJ19dYcrwGzzE675", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214562, "uuid": "88e672d8-7bb1-4dc9-a5dc-d8978a576ae6", "value": 727515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214562, "uuid": "8a06c16a-7cf0-4a27-9ed1-d10a6cfdcd6f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214562, "uuid": "61ccf3fa-09be-494d-8530-9d5651ce03d3", "value": "Paiement.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391f21ed-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618253116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253116, "uuid": "cdec4e98-eaea-4d64-a5e5-868e0088a39a", "comment": "Malware payload (Formbook)", "value": "967f1d16bade2332af66c593e15e9882", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253116, "uuid": "acc5b50a-7442-4167-9725-19a06cf97f6a", "comment": "Malware payload (Formbook)", "value": "bfa5c7ef6ac526946d60e2ebcb22c2f9e3ffeec8c9d42bc6d54a6d3373815034", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253116, "uuid": "5a9a05dd-5113-43dc-951b-419850c8eee5", "comment": "Malware payload (Formbook)", "value": "60b1b0e0936d9bed5f41227b988b9a19e8c34f1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253116, "uuid": "176f2a85-4c54-4fc6-a57e-cf28a76d175d", "comment": "Malware payload (Formbook)", "value": "4338212ac24fcf4b81d3db6bbec2e596659bd433f1eff587507a8c4b9efed398a51c8458d05b9f43ab55ce6c8d793002", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253116, "uuid": "1873e632-1f3d-48e8-aea2-171eb4c7c91f", "value": "F505E16533E88B09E4BEABB518B0614007F1B545EB36DB4D7EE5188E0D72F918732B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253116, "uuid": "8ad9a41d-582c-42bb-a67f-bb4809701e84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253116, "uuid": "5cdbf4d4-e6f7-4fc5-b7cb-6dcbe643ac70", "value": "24576:carpHcQ3S1u074/02f4DdSLYaXEw2ZRcL:lpraU82wDdSLYyEw+Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253116, "uuid": "1c004d29-f25c-4204-8be2-e4fba5d94107", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253116, "uuid": "856b73b7-f5d6-4d71-8d6a-9e6e2416c505", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253116, "uuid": "b99eac75-416d-41a7-b9aa-18c06d2d4c1f", "value": "TAX INVOICE pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b303b3-9b61-11eb-abe1-42010a9c0039", "comment": "Malware payload (Qealler)", "timestamp": 1618212927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212927, "uuid": "d3a5c03e-5476-45fa-a98e-e2a6b8b4d977", "comment": "Malware payload (Qealler)", "value": "7312c90ad802c82304d349e671ba451c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212927, "uuid": "6e3b5c86-693a-421e-9d60-df4cad45749c", "comment": "Malware payload (Qealler)", "value": "bff29658367064ac1f96303526bb6d9879d1384afd1100bfc9abafb2fb118735", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212927, "uuid": "a9ac09c2-0d06-47ba-b33c-d8695a080b81", "comment": "Malware payload (Qealler)", "value": "5a61149e0c79cc7dccbace1b875973eab93f63dc", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212927, "uuid": "4101f03d-23c0-4b7b-aa22-aa7518752f9b", "comment": "Malware payload (Qealler)", "value": "9bf1e42ed5563b8410bda3ba65b4fa2cf513db8b67a89efc6ff092b87389a7f19c511768c63652dfff0ae1819bf21c39", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212927, "uuid": "9f7d1d9d-dd6f-4e90-a8a6-621ccf9891e9", "value": "DF947D1FBE8490A5E847A1B5034285F2ED3C4EDAED15A45B11748ADCEC10CD8BB9BEDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212927, "uuid": "5a8460d7-0d39-496d-ab79-085c5839fbdb", "value": "6144:7ry3dM2i/EdV8VTuJAGjwozkPaSG7uZ3cQG1XViUDR2f+4MfAxbGmA20YPgNClnn:vytG/rVCJDwVSSG7w3cN5FyBMo6tCh0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618212927, "uuid": "534a6aa7-1c5a-4531-9e1a-ab6247355389", "value": 443396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618212927, "uuid": "513454ea-bc18-4195-bbbf-c6ba09b2a333", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212927, "uuid": "dae56add-f5f7-442c-a018-07bce24fb0a9", "value": "7312c90ad802c82304d349e671ba451c.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c7f8ba-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230211, "uuid": "8b3c84e4-ade1-4cdb-ad94-7ff48535d6c5", "comment": "Malware payload (Formbook)", "value": "44f90859deeaddb27086f3b264484f14", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230211, "uuid": "c9095f54-3236-4ff7-930d-09a2ebfb0e03", "comment": "Malware payload (Formbook)", "value": "c155cdabe1d15050db0dd49057e832816ad5376a5ef744cad846230df27d527e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230211, "uuid": "ef312ff1-3ae3-40fd-bfc6-95f839762661", "comment": "Malware payload (Formbook)", "value": "c559626cd02cd55f43c62df52b3e953d2121dae2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230211, "uuid": "1c67949e-ec70-40e4-8bea-97cf4414b775", "comment": "Malware payload (Formbook)", "value": "2057ca52b2f82498cffd5c565a7a9ad6fbcb7f80c2372f30fef48401f906595cd5188774e27a3c29016311d6d7ce8598", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230211, "uuid": "0eae2aa7-06b5-46d7-921b-624623652989", "value": "6BB423D9676B27964374A740C455009F28AEAA03E3FA9413127FFEED5C4CFB1A2454B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230211, "uuid": "825b9610-f0fd-4ea2-b676-49903d4ca282", "value": "12288:umWt1egtDF/uIxon2NRIv73USPAIQ/PZXv0+HAdYhpJcjpBq2EK0+:7WtogtVm6Y3PoPZs+fhpWjn/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230211, "uuid": "7be32323-8f44-4f94-9810-e605641b1c03", "value": 530958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230211, "uuid": "079b8ada-1615-41e8-b60d-339712bd2e8b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230211, "uuid": "8ee57da1-8255-4812-8761-aa75d966969d", "value": "Require your Sales Ledger from 01-April-2020.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc518efc-9b69-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618216426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216426, "uuid": "8542937b-2393-4815-9ad9-293345ecc429", "comment": "Malware payload", "value": "c05b73fac4010193c9b36d5ce29e20aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216426, "uuid": "c7963985-2494-4d4a-95d9-076ef3c9dac0", "comment": "Malware payload", "value": "c21db11decdddf6b539dfd719ee18173b4b832985c9bf653ac77e4e9583996d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216426, "uuid": "f239fe54-7652-4a85-99fb-e7980314a6a9", "comment": "Malware payload", "value": "bc12202b10370963df9c93da0e1bbf4049e5ab63", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618216426, "uuid": "45963ecf-16a7-4134-9ea2-ed6d98362389", "comment": "Malware payload", "value": "ca8d4448ba82d2b459d2867560764a95a365cfc5e606226f9fc478426fa6ef45af2eabaa84d4f4ccb410f0f3ca5c6cea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216426, "uuid": "cc1adc81-f905-4b90-b4b7-1df45dc89a9e", "value": "2DC423A607216703172DA9EE8C94E5C94ECC7F3431EEF2D401F6404FFAA6CD5D62A58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216426, "uuid": "7939b2b1-d4e4-4da8-8489-4f711efafc24", "value": "12288:XqWe6UTX7VSRSSBeQNy5kHAwSRpQAZWmdYRkjYI3GRja075:XqWej3lSBnNC1Zd6R832j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618216426, "uuid": "1c528199-8b68-4f63-9e34-8ed4012bef00", "value": 593774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618216426, "uuid": "3c6f8fe7-05e7-4c33-ad71-aca0a9a9f31f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618216426, "uuid": "c97cd5ae-8f80-4901-b776-773edef6f2be", "value": "MT103_Swift-confirmation#4425-28373XXX.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be3f77d-9ba9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618243779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243779, "uuid": "738e5978-57f4-4f21-8c7e-b751cad2c9b8", "comment": "Malware payload (AgentTesla)", "value": "48421b088e267cfe8bcecfd5adfdf477", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243779, "uuid": "36495762-ca3c-441e-b28f-817e3ff6c9c4", "comment": "Malware payload (AgentTesla)", "value": "c27e918d2f4e1abc2ac1277dacf6831a611c214268c1b9773c27d7e3fff2c639", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243779, "uuid": "73acba9a-3f2b-4bbc-88f9-684d49dba65c", "comment": "Malware payload (AgentTesla)", "value": "79f65d9b56de60812e6c8b36db4662e557896e6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243779, "uuid": "be0f46ac-879f-44cd-b1dc-eba263824a7c", "comment": "Malware payload (AgentTesla)", "value": "e77c4cc51789982fe804a6d34a0e93be17d36854b1865dff9b9d778242ed5cba677ff8733761ad8b78cbc9c1106a3cc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243779, "uuid": "ae0b7db3-fa24-4a41-8de9-8b90f16b26d2", "value": "C105022927D48D16CABD1BB954F0A2041375F510AB23E31EBABC207D1EB37D1976B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243779, "uuid": "d0314069-997f-4d18-89ce-a0c166a03fa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243779, "uuid": "9c464188-4dfe-44f9-94c5-351a9d18e696", "value": "24576:aVucGOIPsToBl9V2AIo5CQi9cxDrSGyNWYTs:XcGOVTClT2AIowMrN0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618243779, "uuid": "166eb544-c478-4ed2-9446-977dd4aea46f", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618243779, "uuid": "c19a3e33-f7f3-4350-802a-27a4f39ae781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243779, "uuid": "abfb395d-d15b-4ffb-884e-aa8458cdf0bf", "value": "SecuriteInfo.com.Trojan.PackedNET.646.24912.20534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c335d9-9b77-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618222339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222339, "uuid": "2f1d3db6-1d02-4a54-97ad-d06fd5ee53e6", "comment": "Malware payload (AgentTesla)", "value": "31f58bbbd330f886e422d44e9c21dbf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222339, "uuid": "579e9c4f-489c-4290-8c45-ae19186de1c8", "comment": "Malware payload (AgentTesla)", "value": "c289703ef1a3645d2c1653c0f571a9abdeec2b404df429196c2523b0b17d9c4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222339, "uuid": "a46a521f-3329-46c9-8ba1-b0af45db4b45", "comment": "Malware payload (AgentTesla)", "value": "1795b60a6f387dec4ac7a6c38119efa0138bdff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222339, "uuid": "406dc479-20d7-4b67-a6e5-2c90aed73246", "comment": "Malware payload (AgentTesla)", "value": "5dc1f25a3259cf490fc462527ef528de6aaf6d44f85341cc4fef8d281a513d003909bcae8f2918bb1d61216b81e3440a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222339, "uuid": "ba6c354d-9608-463a-8424-c776c5f402c6", "value": "93E40110A7D5CB82C87A47F59862900317B5F0ED7C23EB5C0E84A5D6352AB0C9EE5EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222339, "uuid": "5dff0abf-dd9a-4f9b-a917-7c24c3d91161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222339, "uuid": "fd16ce1d-344c-48e0-8abc-10dc3f2efc5e", "value": "12288:N67nnN27JO4zaE+ThxgcHzQC3n0eKR7gZxzhpsFifL:5I4zbYgor3nhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222339, "uuid": "e4755964-be0d-45e4-be2f-c007abb78313", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222339, "uuid": "cd9ca2d0-b92c-4ba6-84ef-74a4bbbb7a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222339, "uuid": "2187218e-96cc-4894-a78a-da2adbc3f333", "value": "RQF 100021790.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efef86b6-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207466, "uuid": "e048643b-1921-4152-bafd-ba8c66801fc2", "comment": "Malware payload (AgentTesla)", "value": "859a97d92749cc11903877349d97a98d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207466, "uuid": "e0e29643-2f21-4241-89e4-94d8c1d066d8", "comment": "Malware payload (AgentTesla)", "value": "c3af94a090303a2ed84cbfe4cb2c43694ccb64066285bec8de4c491679ea4f8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207466, "uuid": "69fe15ef-6175-48c3-988d-97e75ea5f89d", "comment": "Malware payload (AgentTesla)", "value": "d5f1e6de2602a7433da004dfad0056a9e97d0164", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207466, "uuid": "c1af27cb-1989-4d06-824c-3d23cc6e57c9", "comment": "Malware payload (AgentTesla)", "value": "a672513b9363737fd912912644a9f10d9a0bd65f09afb9d3b9a5651cbeec0fcdeeaff3ebf7053876fcaa96dcf210f1ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207466, "uuid": "dc97ae18-2769-4aa4-ba44-4ffc8833c03f", "value": "CB355C5AE742D0C4F55E24B2CEA0FBF40517BC6BCE0A6D17164A3E82707BA5B5B3A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207466, "uuid": "7bfb973e-c6fc-4c2f-ac14-69d7bac309a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207466, "uuid": "3d2ed2bc-9758-4ee7-96f5-5352deff50fd", "value": "12288:iKyze7+wAPn+nsrImzn3iuAgwMzL/yi8+lFGK0bxMYEcyxThhltSZVUtPZKJ1:ZQuw+nsr1ySwU/zqErxT/Swx8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207466, "uuid": "0249281e-1586-4437-8f2a-98ea013e087e", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207466, "uuid": "a6ec13cc-e46b-4311-b14b-712928f7c816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207466, "uuid": "7158bee9-de64-4a58-8d5f-b3ea21892378", "value": "Quotation2001100200.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6df7ea-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618230036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230036, "uuid": "e05fa833-beb7-4568-9ede-0380be8da26d", "comment": "Malware payload (AgentTesla)", "value": "4fd9b2fe130283684b83a724e907f9cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230036, "uuid": "cd0ed6fa-a6d0-49bd-8c99-dcbf1e2eb0e8", "comment": "Malware payload (AgentTesla)", "value": "c42183aaf2368c13bddd363af982f2725e599581869f08f9041d6cd0c47cfe41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230036, "uuid": "96e463e3-48b0-4beb-a7ae-bcb3fdd59e4f", "comment": "Malware payload (AgentTesla)", "value": "7b76fc786ae6827a016008d8f673f965382df74f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230036, "uuid": "de05389b-bcde-41f0-80f5-24027872568c", "comment": "Malware payload (AgentTesla)", "value": "91d1d15397c72ffb10aeb88123346918ba7c1905913741efab81c07e2434a6f719e8447c9000ca734a1a3ef97f1e038a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230036, "uuid": "5e95d7a3-c924-4007-a142-90c4570533f5", "value": "0D339404B7FD5B56E6BA97F0693110108BF638AE3572E75D0CC260DA2162F809B61F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230036, "uuid": "287ae94d-287c-431e-84f4-fa23af8c7cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230036, "uuid": "0e4bdb21-f92c-4a07-b82d-b97ea5e7914e", "value": "768:967uC4xLTVJ/9kayxYuvqjCoe9aNz08WNc2:ayLPLuCj2cNz0vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230036, "uuid": "9e55011c-bb18-4e9e-be45-8aa6ac79bcaf", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230036, "uuid": "79c80a0b-c2a5-4b21-a86d-89f702b34ff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230036, "uuid": "e2f7a7e2-3121-4804-bb86-a1234125e58c", "value": "Payment Confirmation WRT547879808054962 -copy- PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8c9173-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618208727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208727, "uuid": "c1737f75-8d16-430b-ba17-09b206844a68", "comment": "Malware payload (SnakeKeylogger)", "value": "c5e406e602325a957434f20a13b756df", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208727, "uuid": "a527fb59-6898-47a6-9b3f-64f284c6816d", "comment": "Malware payload (SnakeKeylogger)", "value": "c5c649ed9bcc33c0f773e0cdca3ef25f1699435a0f69a845cbf1b0d61da797aa", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208727, "uuid": "94e53a17-34fa-4de3-a6bb-41c0c729a48f", "comment": "Malware payload (SnakeKeylogger)", "value": "4b5030e4f26e61a45228ec9ea1258937623e5349", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208727, "uuid": "71b70fea-0233-4d61-8318-64829b32aecb", "comment": "Malware payload (SnakeKeylogger)", "value": "9e89e09096bf0341a97ec6d37b225b78d2a5ad28726d9405658a76abd37fa6365c2afc2b47316d928848097dd989d28b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208727, "uuid": "d47e2f8d-81ef-4e3a-a915-670de51dc231", "value": "F6C4236AE49ADCC4DAC4AA957C3FE0A48CAE36406193583004DF162151787FFF9B4D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208727, "uuid": "2227f994-5e37-42f1-985b-44ebd6c1e8c1", "value": "12288:nKT2vLLvsIIn3/hqgFjeIFkAt2g6bmv0MZbczT7WBOo6aEl83J:nKCDw3nPP9k+2xKRAMjsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208727, "uuid": "68d175a0-53dd-4ff7-b926-8cf4916f3c48", "value": 580271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208727, "uuid": "14422121-a464-441d-bd31-8aba95eb8556", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208727, "uuid": "95d8f533-9eff-486e-a1c9-9601bd04b9ca", "value": "PAYMENT RECEIPT.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147aa823-9bae-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1618245753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245753, "uuid": "ebec82d7-b50d-4c60-af6f-f3d8a1e8b750", "comment": "Malware payload (AZORult)", "value": "0f62ad64933edb9e9a62124f8f965d8c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245753, "uuid": "cb144ebc-0f5d-4399-9cc7-b6f7cb00be5c", "comment": "Malware payload (AZORult)", "value": "c6971c3516ab280c7c6985ccc94062547116fcd3a7593fc84704030169c16e59", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245753, "uuid": "bf63e1b3-5805-42e0-8062-a021b7de291a", "comment": "Malware payload (AZORult)", "value": "56f858b120126d45e384da71cc198a4f8f87870f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618245753, "uuid": "24789ba9-572c-4c11-8560-68a5c4a8f9e8", "comment": "Malware payload (AZORult)", "value": "e18308a91b93b8b542956a0b6227d60ff4f26af6c84dd50afe844b283d9d342aa64d2bde0dfdbdc80b605a369b133e26", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245753, "uuid": "98f88caf-f308-4eb3-a29a-5d4a8ae9700e", "value": "9E7435C6F9482DCECC7D0DF365F2B3C53CA1ADA2275152D227867299933E291BE4C152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245753, "uuid": "60c2ec3b-7cc1-4ff1-81f6-cda233d82568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245753, "uuid": "07a5f3c3-98dd-4f28-91de-96b4fc3fa746", "value": "6144:MuajV0soFB7EjP4sVsyBV3Z9pXXrScKNzoybha6X:MrpL0B7mPwyV33xXrREdhaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618245753, "uuid": "86cadf38-75ca-4d70-af18-0d31f8f3b5f1", "value": 365560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618245753, "uuid": "0dd9c914-189b-4ea4-8f6d-f2e182100e5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618245753, "uuid": "74a0fa17-0183-410e-9ba8-43bf20c813c4", "value": "invoice.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1718035-9bb1-11eb-abe1-42010a9c0039", "comment": "Malware payload (Qealler)", "timestamp": 1618247412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247412, "uuid": "f61c9089-f066-4aae-9285-7fc326249a13", "comment": "Malware payload (Qealler)", "value": "a9c77d8c90730be4c19acd41ee1963cf", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247412, "uuid": "5f825fce-e032-4282-ba8b-1ef8cc9c0181", "comment": "Malware payload (Qealler)", "value": "c751bed36cbd7e495c47612540ecd077cdac7f8ed9612c7a7b046f3216b31a35", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247412, "uuid": "b06b34db-acd0-4ba3-97a6-73714a53d495", "comment": "Malware payload (Qealler)", "value": "0c159a712c7f82ac4e16b2b315b9e9104f0a454f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247412, "uuid": "847db0ee-aeb9-4a8e-b574-006979229cf5", "comment": "Malware payload (Qealler)", "value": "9db3014b5f535e5c0f964145d2fcf3adbcd19877fbd3d7af39a4008e0c80287c442931b9a884f4784026169e9a5107b6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "qealler", "colour": "#22D507", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247412, "uuid": "c7715b96-b5c2-4344-b2fe-3ce118e9f6ec", "value": "62947D1E7DD99139FC13DDF50A81C117EC2AEFCD820EA0170B6455DB4E2884A4BB6DEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247412, "uuid": "cd8dfe8b-cc8f-4cc4-8b77-beb579d87e21", "value": "12288:gUad8di2C+SUeOJvsMRYd9EI7qiS+ZDRX:8cCbUzlslfNW6ZDRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618247412, "uuid": "ea8dc791-102c-4448-88ad-62c1bec478b2", "value": 408304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618247412, "uuid": "47784fba-2117-4391-a9ef-1e3a44984892", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247412, "uuid": "9494e376-4f37-4e6d-bc45-7bdddc336ede", "value": "a9c77d8c90730be4c19acd41ee1963cf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d98901-9b8b-11eb-abe1-42010a9c0039", "comment": "Malware payload (NetWire)", "timestamp": 1618230961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230961, "uuid": "101e35dd-c1ae-4d96-8988-ea025129e57d", "comment": "Malware payload (NetWire)", "value": "685c4a8465d76048c6aa5118b56f5951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230961, "uuid": "59890327-b4fa-46a0-841a-f9b8e17aeaf7", "comment": "Malware payload (NetWire)", "value": "c9b8ec8ccbe3b0ab195d0c472e3f8d6b6a00dc66eb8ab0bff71eb44ad4abd39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230961, "uuid": "08c80ec9-29d5-47cf-8089-5e38b2eed5b9", "comment": "Malware payload (NetWire)", "value": "d954fbb609b07cca612438e2e808b523aeb75cc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230961, "uuid": "b5648f4c-cfc7-4201-ae9a-d3a91e47b6b9", "comment": "Malware payload (NetWire)", "value": "a3a4be27eae8b34055369a1fb6f6b1aa81e21e9ab86539f1e294b709b6d8455450fbd2406bff1c5ec7f7c98e5d7a5a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230961, "uuid": "893348fc-e7c5-4483-8490-38daca69dbb7", "value": "90649D1E62E470A3D0762F70D571B7E04339B8645EC665CE9F802A3D2DB17C5E8B2AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230961, "uuid": "cc4d8ad2-1226-4490-a52c-b138a36598a9", "value": "7e13866414f4ebd95471c7c78ee916de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230961, "uuid": "4edcc579-2e88-4598-af5a-d6e330cf16f7", "value": "3072:1HnjG68ArDryinkLel3EpvAtzVt3YyESmDWViKVOD7VVbD043XJO56op7V+DSDDQ:1HjG6vTkIiAft3YyESmDKe7VVbgg5mcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230961, "uuid": "aa0e4030-d616-4a1a-bbbf-d0913ae6dc64", "value": 320544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230961, "uuid": "b28f46d9-ff71-49df-a1a6-288da9914d52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230961, "uuid": "d7109b64-b4c7-49f4-b2ad-185d2420fca0", "value": "685c4a8465d76048c6aa5118b56f5951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40a0003-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618233619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233619, "uuid": "e845f1ef-00d4-44fe-9c79-65449f0c6f18", "comment": "Malware payload (AgentTesla)", "value": "7c315e5221144ebe207421fcf5578985", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233619, "uuid": "6550e424-e8cc-4e88-898b-e2fae1290269", "comment": "Malware payload (AgentTesla)", "value": "c9cf74378c0ab6240ef866be3673dd54a46b36ccf58a7c9036344f96fb812aee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233619, "uuid": "55e9fc70-71e1-4b03-aa5d-dc20451b1eeb", "comment": "Malware payload (AgentTesla)", "value": "2d337a4c65ef709607da501c87f3127e61356e2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233619, "uuid": "1d9591a5-0634-43ab-9356-7fbe9b7dcf7f", "comment": "Malware payload (AgentTesla)", "value": "a16f1252ce679cbfd9917a1e18b6e0f2768d1546d06754ce516aa05da997ad3780b8fd8a83e2fa867e4fcc3e54149860", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233619, "uuid": "c265530a-0cb2-490c-bcfb-d584b16d9280", "value": "34E4E0701664C997D3BC5B7448A2E33807747E666E62E70F29A830AD7F73B994C1B206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233619, "uuid": "491a4f93-d00f-448d-b657-7fc81b95b542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233619, "uuid": "9597f74b-4b5a-43a0-8452-cd50449cd518", "value": "12288:i4enOh6dI9C8l7y0aTrhdgepi7xMU76P1wPGL45eYKcDQIBdHKsMjvLeh:zGE7ylrvgeFU7QSuE5ebcBdqnvLeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233619, "uuid": "82f04a82-0888-4de6-afea-33d228a0f7a7", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233619, "uuid": "0dcae87e-4479-4bf2-b467-062c1081df89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233619, "uuid": "1f367acb-9737-4192-a8b4-025759bad87e", "value": "Swift_Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44c838e-9b50-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618205756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205756, "uuid": "8da3b0ce-f37c-4e88-b846-54e7105b01c2", "comment": "Malware payload (Loki)", "value": "db61b967d568390cad71b43c920827e2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205756, "uuid": "dab1b84c-8723-448c-9eb4-0bc1709da0d3", "comment": "Malware payload (Loki)", "value": "cb46c6fa59b0c6326867113e572605dd0aaebbe0b5630866e4df63115d9bd189", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205756, "uuid": "398257f9-ae64-4b1d-8954-647029107a86", "comment": "Malware payload (Loki)", "value": "2b9153e90049ed9def06ac40f3eb6d883fd5fe18", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618205756, "uuid": "cb2c90d1-3a3a-4fe1-9621-0ea554ef9ebf", "comment": "Malware payload (Loki)", "value": "3e036c573b889a8a4c12b65469c9f2b8f8bca3a8784fcdfa019a92aa65431e4c81ebdf0f74a3696a5ecdca5f44d6c3e3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205756, "uuid": "b48500ff-8ac0-494c-9046-3c51964f69d3", "value": "12C53367B2F24B12D33C843ADD5D8A9611BE9D549E82E446336CBBB874334367392B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205756, "uuid": "767d58e8-9e48-4da9-b457-e2d9024c42ef", "value": "49152:p8vwCgSXfO+7Cu8FPYEfdffZ8mNpG/t4QNyzHnjtai:UwMfOdu8FPXJfZ8mNkRSHnjQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618205756, "uuid": "2cade137-48d3-4601-af0e-878c6657d399", "value": 2624512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618205756, "uuid": "9551d160-a9ca-4821-8f04-4060fd39f9b5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618205756, "uuid": "f04cacaa-f62c-44e6-a08b-c1b8ccafc1bd", "value": "Purchase Order SC_695853.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b205b7-9b75-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618221544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221544, "uuid": "d0934b08-d93d-43cd-a075-81ae51d5b04a", "comment": "Malware payload (AgentTesla)", "value": "50598e1be2814542b36c970fe347507b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221544, "uuid": "94132c11-2a4e-4daf-b6db-86c50f0186a2", "comment": "Malware payload (AgentTesla)", "value": "cb48759d215dc73e53fef3d1dd125d53e8de8036efd9ee78c0688572c6e268b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221544, "uuid": "8aab6b3f-0a0f-4352-b8b7-b55cd2525fb2", "comment": "Malware payload (AgentTesla)", "value": "eac8dc4b78763a2255602d7b5b74817baae4b39a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221544, "uuid": "9fcde78c-e1a4-4afb-a61f-ae79f56b3f50", "comment": "Malware payload (AgentTesla)", "value": "8bb416c82d4fcf58d23090f7587a2ca79f8ef34918a1c233bafb363c58bf9364be0078729c2a0bc57eaab064bb97861c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221544, "uuid": "029bf39d-7f38-48e3-b962-d78f3025658e", "value": "E8C4234EF61F1AFC6920588B6B7991DA9D0D2E77705224474D49C038ECDB32BB8E64F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221544, "uuid": "2d9f3687-8171-45bc-bbd6-3b2b6005a647", "value": "12288:XPIk9W4GdJ+VhOdVsVgYNv+tgpqi/GDS9yuqYao:XjW4GdUVhOdWgYNv+mYp9Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221544, "uuid": "9c79dd11-80f7-4827-a2fb-f49ccd39242b", "value": 592874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221544, "uuid": "fae3dfab-fd1b-4b09-9cbc-cee0c30ef54d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221544, "uuid": "1a5daade-f45b-4cb3-ab91-942dcd03dcf8", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239da317-9b7a-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1618223445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223445, "uuid": "9c159c88-7c47-4df0-9506-500ae8580eea", "comment": "Malware payload (GuLoader)", "value": "4a4501e0665974a9aee852ea13e6e7f6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223445, "uuid": "c91711a8-3f9e-4a35-92a1-46e9833c86f7", "comment": "Malware payload (GuLoader)", "value": "cb4b104a48fd8927dd979c9f7381707470432540161a2be6e1eabcee470020b8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223445, "uuid": "39165150-f2f0-45d1-9f77-0009d576b1e3", "comment": "Malware payload (GuLoader)", "value": "200399b39a95fa717ccd64e51c7b5515e4b1a3a7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618223445, "uuid": "895f5c18-27ef-45d6-9579-93efcd16e9cc", "comment": "Malware payload (GuLoader)", "value": "3b7af3c684083df51f75414fff88eb2f515b05ff781963a5ddf352c3d36d032f03ed4730a89d7e79041920fb50795211", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223445, "uuid": "3cccdb21-45b4-4f26-a88c-ed770d76d639", "value": "7383C4A2767CF43DDC5188FF3BF5136904647C31E785C40EE689252A34B5A46BE2AB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223445, "uuid": "fe43ef47-755c-44d3-a6e5-2ae969f0f3a4", "value": "4ba170b6a3de0ed01456bc01eac94f5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223445, "uuid": "120918d2-cd17-451c-8b79-6e1fb25478ef", "value": "1536:6vUULwK+YaTMDDeDTw4F6qPRE08raVX5siZQz9:vULbaTMDiDTVZjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618223445, "uuid": "61f8787c-1db9-433c-ac94-7f55bab8b55a", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618223445, "uuid": "a3e50187-21a7-4797-b259-a030b1fd4107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618223445, "uuid": "fd247538-0072-4832-ac56-9f1f6ad4c500", "value": "faktura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fa0349-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618253158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253158, "uuid": "5108cb51-c563-4bd7-bee3-1d16976aeff6", "comment": "Malware payload (RaccoonStealer)", "value": "9c2efd14b822f1ccced8aff5c59a4ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253158, "uuid": "00eba19e-e273-45c1-bde5-99d20b281f54", "comment": "Malware payload (RaccoonStealer)", "value": "cd04debc8b6f0e97e3f7aa9f7e52cf0da18613937fd1d01dcb606d37ac4efcbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253158, "uuid": "8b6ae7e8-1ee6-4ab7-a0b6-6e78f0b4a8b0", "comment": "Malware payload (RaccoonStealer)", "value": "e4422b2756d3953eef5304bffdbfd6ce20de9d94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253158, "uuid": "313813fd-1f3f-4bb5-ad49-5a7c94b8ee90", "comment": "Malware payload (RaccoonStealer)", "value": "c778df1e50fdc97c16cc8e6786709ab1194de1ddb95067dd807f370b265945d1e0753814f4105d48693f0ad3bcc58e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253158, "uuid": "349b82ce-06ee-4267-8c13-b4705a3de7a2", "value": "E9C4F11073D0C137D45724768515CBB58EBB7831597A6A8FBFC80FBD6F262E0A22634A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253158, "uuid": "7f71877a-6aea-461d-aaf9-69ff54d647b2", "value": "0c37c8b94c85a48d396c7faa26b193b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253158, "uuid": "86edf292-44cf-4d20-8b92-4c1bdea97ed0", "value": "12288:YobGqGZ6FWZTmiSrF7jEwhbD0RBXcZ2bB2QYvKPD:YgC6kZTDY7jzhSB4vKPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253158, "uuid": "a4681c8d-5651-4b8e-a651-735f09172cc7", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253158, "uuid": "dd94cd32-f81c-46e0-b534-dc8e804c85be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253158, "uuid": "0763e68e-ab5e-456b-8eea-91c5f4817bcf", "value": "9c2efd14b822f1ccced8aff5c59a4ac4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc12770-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618230035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230035, "uuid": "5d950265-b924-4697-b780-791c7e6a76ac", "comment": "Malware payload (AgentTesla)", "value": "f324cd29dc6e81a4f46bb2278d32b16a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230035, "uuid": "758cab41-dd2f-462f-b509-b72cc47133b7", "comment": "Malware payload (AgentTesla)", "value": "cdc3533116963e84b2dcba2eaaa97d227f89c98272be61053901dbbb93fe370b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230035, "uuid": "15373034-3a49-44a0-977b-9c4f280cddd3", "comment": "Malware payload (AgentTesla)", "value": "84ab49692f55e16e5bcd9af9d96205c26c7d5edc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230035, "uuid": "d1be0f52-6266-4b95-8401-ef1c9d7ff024", "comment": "Malware payload (AgentTesla)", "value": "7ded729568404296ef5c1ba10c5669c918e8935d35221818073807a119597e86f57b94922c5caf5acbf17dfc9fe348d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230035, "uuid": "a910c612-a039-4e29-96b6-902d78fdc23d", "value": "9BC5335BE3820716C06C94BCC1A2B97B113ACDF96B44AF457BADB1257C760BF6680339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230035, "uuid": "6f94f54d-0602-4e0f-a574-0e12a8707b8b", "value": "49152:jU9okOLHn7CcShve+pjeMsaprGrcJueCv4s2z6Q7ViF/:6dOLHOcENpj9pGgJLvs2WQG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230035, "uuid": "82b7dbd5-c8b5-4423-840b-1335393b9922", "value": 2601984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230035, "uuid": "fecb5c7d-8960-463d-a40b-7c9ecb7585d4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230035, "uuid": "55cc43d7-ece5-4e96-8d3c-e6276db19b75", "value": "Proformas No.4883 4884..xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac220737-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230116, "uuid": "de3dcb1d-58a9-41a9-9963-41090d614990", "comment": "Malware payload", "value": "c1682c419779bb71ab4cf200ab691697", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230116, "uuid": "77e739ac-a16d-42ae-8540-72a7bb271c8f", "comment": "Malware payload", "value": "cddeec41a9455d3e649dde018090c5ceacce9790e119c60b1ac1ae80d3abd4ae", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230116, "uuid": "73fabbec-bfdf-4e1e-b427-0602d9ae957e", "comment": "Malware payload", "value": "7f14fc473f66c1577d9edd26217e7554a50e2c5f", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230116, "uuid": "17e85eed-4826-4a85-8530-8f223fe808cd", "comment": "Malware payload", "value": "833a7ffa0a044c77e78cb6daa71f666ea3199db0c02bf0ed26ee36eff96c71b8dd80613ec3895afe8f8df5d63c7dbe31", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230116, "uuid": "0472172d-e11e-49f6-87a9-7727aad6a858", "value": "F8913FC99ABB4350C732C1511F384B4791ACF0AA76728899F90CCD580FECDB961A776E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230116, "uuid": "c0093f2c-92b7-43bf-b6ee-88c6d5e08d27", "value": "48:rERLiCYFjrEpUNaXTf4QX1tZlXSGtD0MuhhKxRC/FolA:IRLYFjrP8hbZeGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230116, "uuid": "e5f22a97-fefc-4e90-9ef5-68ac639109e9", "value": 4218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230116, "uuid": "8d7cc827-ada2-4863-8af9-b5591fbb790d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230116, "uuid": "c6292335-9dc7-40f0-8c4b-53c66b7de6cd", "value": "ZR71.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb76363-9b79-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618222975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222975, "uuid": "c7b55900-de38-40c6-9d7e-1402a0064884", "comment": "Malware payload", "value": "3fb3556c7555699ef762c903348e96a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222975, "uuid": "216737cf-4ae0-447f-8be1-841fc2bf46f4", "comment": "Malware payload", "value": "ce480bb25934c0a635e84d76b2d823a0e9ad20fe568016b62ccfd6a7bed4d9f9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222975, "uuid": "8a51b83b-1a38-4c05-95ce-20e1488b05c2", "comment": "Malware payload", "value": "4af3bd115e9f38a7e419e74ec70fb0143dc6c12a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618222975, "uuid": "7c991b54-9e31-477f-a6f8-50185e7fd9f6", "comment": "Malware payload", "value": "58eee8242f27e3e3bf9e660c97e28e02fa55ea6d3b522f7938d41d469a3c266a9391bafd5e40be2397b60b54c5e27c57", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222975, "uuid": "9033e117-2f26-45e1-bb48-1cf99fdab7c3", "value": "34029FD398A5491FD531C1A29FF41F8830C4EFFC09E3B7B80B158815A90A9EDAEA3601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222975, "uuid": "d0ae9aa0-9336-4397-af6c-b8e9334e5b73", "value": "192:CyDW7+V+Xq+1WPBWYA/gF4x/cLPh1aHh7vHK++xJbQm9mbyd9j:hOX70PXA/+EcPaRHKdbQ9e9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618222975, "uuid": "0db373e5-b762-432e-8544-05cebcdc315e", "value": 8864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618222975, "uuid": "cd4674f5-1460-44e0-a954-b92634ea2b0f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618222975, "uuid": "b71f0b26-3a5a-4ce4-8d56-3535ef3a1ee4", "value": "undeliveredmailreturnedtosender.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44c117a-9b70-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618219419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219419, "uuid": "e9687dba-5a5f-4d0c-9273-aa7648c80c93", "comment": "Malware payload (Formbook)", "value": "c8aa551fd4cc3b5d6e87ea3f025fa6f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219419, "uuid": "7b5881c6-fa6c-48c6-9b56-2382e743b2ca", "comment": "Malware payload (Formbook)", "value": "d22df2dfcfccf5964421ffbbceee8193dc4b6cb6663ea2a3c9687ca57d6779a5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219419, "uuid": "695c0a0b-757b-42cc-a617-f60efd687b9e", "comment": "Malware payload (Formbook)", "value": "3285390c80ccb179471f31cb4552db8802de518c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219419, "uuid": "570f0f8c-9b7c-4062-a254-d4c2a8923e22", "comment": "Malware payload (Formbook)", "value": "0ea90f4fc3370779b9b90c798d515a881a7282b554e0591fa2630305b4f5d7538faedf344335c7de2e0da096b2bed50a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219419, "uuid": "c7e6a51b-6f43-406d-b79e-ae2471dc92e3", "value": "56B523C2AD84FB11E7F96071D52B033598218C6A360C44CD3F2A7AAE6AF77E155F8325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219419, "uuid": "a2804191-c699-4aa4-8999-df0436855949", "value": "49152:wVVV5zlhInzv53nKjtllZ7uYOg0BkIakbTOWkaBfId3wQjHJ/wJ3p:wx7azvGt7JuBekbCWkKfMZdk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219419, "uuid": "e37cf429-babf-4c59-a776-5c67eef63b4d", "value": 2370560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219419, "uuid": "64ab8385-38db-41b6-ac35-2783fecb42d4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219419, "uuid": "eb0a17a7-eb1d-4be4-9b50-dd9dcc71e62e", "value": "Bank Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc49b530-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618225043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225043, "uuid": "d4a313c5-1b56-4448-b97f-885362570926", "comment": "Malware payload", "value": "756569e9a29b1b351d2f1ae0fd09669d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225043, "uuid": "a129a6d1-6b9b-4a97-bac0-7cd12e4c9075", "comment": "Malware payload", "value": "d2ecf791e2da89d5f37020d21644d7a6894f24f2f7972841945cd555cd89f974", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225043, "uuid": "a57d7509-1ee9-45c5-b474-7080b5b71050", "comment": "Malware payload", "value": "246dd078f0b8159214732c2ad1783e51c3f38c73", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225043, "uuid": "e0b78937-11ac-47d3-baff-7ef5a620db80", "comment": "Malware payload", "value": "b01b334967b5a45ede4b0b45535ab21d2ee67988056a1c8cead01902fbd0f212255ddf98ef00b1c1011a10d5b5171801", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225043, "uuid": "9bb48094-51f9-4a1d-aa6f-1086e1417c55", "value": "3CE369D4FCA19830F89A01F7EA5B795F2E6D6D912F833226FE50D3469642E44FB02127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225043, "uuid": "0bdf4624-49d2-4cab-a25b-f8989dd3041b", "value": "b863a0170e8607b535791c6f08481ac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225043, "uuid": "aded85fd-d3cc-434c-af0b-948f2fc2ef07", "value": "3072:kaH9deQsVlaReZhphqrlT7MG9DqDseBguVdu4+rqv8kzY5Bed/rX:k+de+ReLQlpJqBBguF+rKLtdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225043, "uuid": "efb567c0-d7f1-4800-b445-bf6a8c44c886", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225043, "uuid": "dbbf67a3-d565-4374-ab39-3af43ae5c103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225043, "uuid": "f46567df-1d4e-447f-ac42-64ebf105f915", "value": "SecuriteInfo.com.Trojan.MulDrop16.36169.23522.27812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd5d8f0-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618208694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208694, "uuid": "fb5dd9d0-3007-44c3-8a5b-042802cc68a2", "comment": "Malware payload", "value": "175d5fb2a77a4ea92200fc10b37071d5", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208694, "uuid": "b36e9cc9-d29e-4930-8406-78da4e2c4ffc", "comment": "Malware payload", "value": "d351e6436247da7b9b874b9ab0f367070e903cf5121c70fb4a858e3e6ec9fae3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208694, "uuid": "3facbfa1-010a-4282-82fb-2a35d8f06f6a", "comment": "Malware payload", "value": "add3cc2fa2d0d0c9313194ae2be04708734caa5a", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208694, "uuid": "dd7976cc-1f87-4d98-8e43-7d472e384679", "comment": "Malware payload", "value": "0bf075206aba0a7cce538de9784c9ec5b395da06d055fecab57c6c524b381f881f221b3296c36c742d7ac973d8d72c42", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208694, "uuid": "e324703e-8573-4752-a33a-eea00e92d8e1", "value": "2022CF2710341C8EFE9569312C8CFC7DE359958844C8DC39A7D09FA82F86AA3934FB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208694, "uuid": "5e482564-5f1b-4809-a317-cf0c6917b920", "value": "192:x0Ay5Eb6uSqqDcZNcX80TfeaVoHw3ygeRRwcZ3XzeKbICv:xpyaSqKX8u2giweZ6uv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208694, "uuid": "bda06496-a3c3-4e28-b8fc-88391b9ca0e6", "value": 10631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208694, "uuid": "1323869e-7545-480e-bd50-e3884bfd5855", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208694, "uuid": "7ac390c6-fc1c-4902-871d-b2807b5806ec", "value": "COMMERCIAL INVOICE N\u00c2\u00ba 0001792E21 PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2663d4a2-9bd6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618262963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262963, "uuid": "ed05971d-092a-485b-888c-d31c5c628f3e", "comment": "Malware payload (AgentTesla)", "value": "1f5ea03653d7423055d934fd53a45604", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262963, "uuid": "8cb3a0b1-5168-4fdd-9917-3b8bfdcb6fdf", "comment": "Malware payload (AgentTesla)", "value": "d365f8cceb528c0186512734a4accdab29c1bdf25725aaa32ec8fc22dbe38823", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262963, "uuid": "7a98e08d-786b-471c-929e-96cafe32434b", "comment": "Malware payload (AgentTesla)", "value": "5ef90aa597e4a20d46e1e019450639313c82a300", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262963, "uuid": "417805b0-1de6-44cb-a0bf-9ded9201218a", "comment": "Malware payload (AgentTesla)", "value": "7b2d08c0b40dedd020b8de758296c7f6d01158cb3d86677c6fa351ba9e24e79906aa1a3269e2519aa38c9238b3538c9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262963, "uuid": "d2e59c6b-0fc5-4b97-890b-7c2b3c4d8f2a", "value": "A4F42202D358CF25E52CABF8B435482017F2EB9AEB16DB4E3F91A1EF95A37144340653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262963, "uuid": "dbf27350-4346-4f53-8ea7-7d0cf018f804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262963, "uuid": "f0cb8d64-ff3c-4f6b-9752-317c67526ab2", "value": "12288:Cd8EolKiyI6V+xy80CnKkdUwkumh0/lSiTSwT+5ELEXM5mQxFQ1bigKL:Cd8NKJRgxy80CKbwkclSak5EL75mQx0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618262963, "uuid": "783897ac-5ae2-414b-9879-67b656e1f115", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618262963, "uuid": "b7f491fe-612e-40fb-92e3-5d603c2ffd6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262963, "uuid": "1db40a12-9e38-43b4-bda1-93621bce9b57", "value": "NEW_PURCHASE_ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ef6b8c-9bb9-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618250557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250557, "uuid": "9eab8124-33cc-414f-8454-373d18b036b5", "comment": "Malware payload (Formbook)", "value": "d3df8002e83a73dd908e6799169a8bc5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250557, "uuid": "cc93211c-f835-45ce-943c-d5d19764c73b", "comment": "Malware payload (Formbook)", "value": "d4d22706033b31cb83ad489480e3ab88ad44e700560d42139995af8a1d45abc3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250557, "uuid": "c705d082-bee0-4867-bbd3-ca0737be68df", "comment": "Malware payload (Formbook)", "value": "65ab4bec12c2e1944b36fd9e3a4e1ad61f2f3819", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618250557, "uuid": "507392ea-030d-4062-bb24-a6b5635ede2b", "comment": "Malware payload (Formbook)", "value": "4a2d025331c6c422c14f64013ecc2ab5684ad5f125a1b3f9b174e40652e14cf0018c6eb56d1fd02b1b49737f221d92bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250557, "uuid": "9c4ba4ce-7958-44ca-9137-826ee08238f5", "value": "D565121133E88749E0BE9B741C31954813F1F506EB32D60E7E91699D1E72B828737BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250557, "uuid": "cd54b5cc-988f-415e-b2f6-f0b7f12c7f8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250557, "uuid": "e2145e6a-bc44-458a-8764-4a2879090f67", "value": "24576:QXZgUYZFL2bSz7BN33/ksC0eWGLBgpkFhHdCpdaKMXGqZUyW7Mz02x:y2RSbShN33stWGy69NKMZrHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618250557, "uuid": "2873ec32-5f62-4a6b-8bc0-29a69ad09286", "value": 1427968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618250557, "uuid": "6a32aa15-cea9-4dd2-9a4e-f41bee1f7208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618250557, "uuid": "d45ebf47-4eab-465d-bd52-8157a7156e77", "value": "bank payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c386508f-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207821, "uuid": "a7e77c02-8bba-412a-a7f2-009f784f6a43", "comment": "Malware payload (Formbook)", "value": "3a437eb8ab179f49cf49ddc73302e16f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207821, "uuid": "fa92283e-2a46-4461-a05e-ed6f1fbfcbe9", "comment": "Malware payload (Formbook)", "value": "d61c257964f480d31cc2bcae54324ded99d48f86c4cf06acd966538df97e2da0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207821, "uuid": "a76baaa7-124f-4e48-b032-d5f3016b52bb", "comment": "Malware payload (Formbook)", "value": "34fca2cedad8bfb043322c966f2f9f8f3c7b7886", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207821, "uuid": "abc47b81-a8e8-4fcf-947a-56655cd3567d", "comment": "Malware payload (Formbook)", "value": "a5a7340d458b1e01c38824d5f7f720ef0b064efe593069828404dd66cbe4666fee59f4cdc68acb9669274298dc107f07", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207821, "uuid": "dc8ba84f-13be-4505-86f4-99f759d39023", "value": "B0F4334BC121DD9D4E7B90FA9AF6420370E4B2133151E63DA9E9697F8873B242E5DC32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207821, "uuid": "841596ac-6b6e-44c1-9788-a8de0ad4a0e1", "value": "12288:kFF405e5d0g2VO44Sdrf6r6OxeB/l+jtEQey+SPx8rjkeDzKtmD7FQdsRtZ9JpFO:4W0e5LuOSrAkeRrfbJ8rjkYeqpJtLJpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207821, "uuid": "01049019-8c22-4848-8897-b0eb63231481", "value": 742902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207821, "uuid": "ecc76948-bc79-4c48-a0ab-0524c98530fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207821, "uuid": "648a3114-6a58-4c3f-9c5a-9b1add70a45d", "value": "Portfolio.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2ec183-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618225041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225041, "uuid": "bfa746a2-542f-47d7-a1ed-7b891bdbc207", "comment": "Malware payload", "value": "29389832e538957dc769cf709f80144a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225041, "uuid": "05431783-db95-44dc-8f80-783f854f58df", "comment": "Malware payload", "value": "d6d2e00343a3cad48cc2f4799ce87d27acc3ce154aed286c07f226de2e9c4035", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225041, "uuid": "fc1783b5-eb3f-40b3-9c4a-daba5fa18930", "comment": "Malware payload", "value": "72f5ca06d840acbc9b49e4096e341c0dbaac891e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225041, "uuid": "f062e0f3-e132-418b-8f3f-73dd8a412302", "comment": "Malware payload", "value": "a1e5f045244da62463a4785572821de62b9b432ed4eebfb561fec6efa6aac7f932ec06062791b7a150d8515e073abceb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225041, "uuid": "acefe07a-3b4f-4747-bc4a-96a7efc92e00", "value": "21169FB3077D26B0C09099FB4B5F2184B441FDE922CEB4B6BA4A7C588375F5D428AD63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225041, "uuid": "e641a9d2-4dd2-4719-b2c1-7c5a461e4daa", "value": "3a057d8e2436bad9e0ae8c20a8d4d334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225041, "uuid": "f097650d-d0d8-4413-8607-a2a4fb84dc96", "value": "98304:EoT9sIWSFT79YBDTzRHjEREGL1d2YuVNR:RCIW6790vlHjEREGLK3bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225041, "uuid": "7d2e155c-d227-4eeb-aa71-765ba2d1101a", "value": 4255416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225041, "uuid": "cebe71eb-b34c-4d5e-8007-c554032ab1e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225041, "uuid": "ab6e7150-1859-41e8-a1cf-690801931b53", "value": "SecuriteInfo.com.Trojan.Siggen12.33370.30028.25368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63a7815-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618230214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230214, "uuid": "bde1b495-3a20-4725-b864-e31002ab8b40", "comment": "Malware payload (Formbook)", "value": "c7c27e1859f1593aedb1eebf0a15175e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230214, "uuid": "7b4a4c7a-d25a-416e-a1ec-331014de6113", "comment": "Malware payload (Formbook)", "value": "d7e71646c9427067e810e1b278beb6ad1f07e6b0c5003d9be2611178e4f5470c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230214, "uuid": "10013cac-46f6-4221-a0c2-4096546a0eb1", "comment": "Malware payload (Formbook)", "value": "deb5544c037a7757462afab46ae2ca14a8f7f945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230214, "uuid": "ec0aee95-172d-4cf0-85ed-e297460c488f", "comment": "Malware payload (Formbook)", "value": "720e6725f71913347b6835dc9817fbfc0b5c384a66d231cdf2f97e7f2a232c85c45c381c18e92d3fdce78871d4b2920a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230214, "uuid": "0339564f-0c89-466f-98ad-067454f2ed8a", "value": "C5F4BF56B960A3A8D7D84872EA1BE3720E255C9F590211632BF8BE373FFD427C915630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230214, "uuid": "7c1541b9-881e-45ca-9f05-4941edfef5e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230214, "uuid": "256fe35d-8573-466e-9822-52a36c118b17", "value": "12288:JLwe/ZRRUxLGX9eW++HhtUnNJ2WD9cgMuwS2T8Xo2i10OlYKit:q0HRYLov+Yh+NzxFWgXh5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230214, "uuid": "030cdc59-1b53-4a1d-bde5-57a5e8a295ab", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230214, "uuid": "b6431802-0d82-4b07-a2da-d3335b02425a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230214, "uuid": "82933bac-4bd2-4b3a-9e80-37ed4f2c581a", "value": "Require your Sales Ledger from 01-April-2020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8691faac-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618209437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209437, "uuid": "af6539d9-596c-4eb6-88b0-2be99ce87b3f", "comment": "Malware payload (Formbook)", "value": "76462533a7cb016f3bd2b06a794762ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209437, "uuid": "95dc6d28-295c-4fce-8d68-20a6344a7851", "comment": "Malware payload (Formbook)", "value": "d80f61a18e120cee699b859e4d84e518e5102357fcad156a000d439590750162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209437, "uuid": "d823b33f-17fe-43d3-80b9-fd9c8f736d75", "comment": "Malware payload (Formbook)", "value": "039228fcbb6e924e18e3bd36e89aebb93fbb2c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209437, "uuid": "65e8f6ef-8d79-4c74-8443-f7dc584623df", "comment": "Malware payload (Formbook)", "value": "c302986f126f7c410380f7c9eea18da0226d314d220023856779a9a439e5a4d936af86e2a61b19efe4303a2b03fc316e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209437, "uuid": "dbdedead-feca-40f5-8291-d59e340c1a27", "value": "2014124275E0EEB7D507817D5AA2A305CAB2E3411155D7830F918F7B6378FC2E12F28A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209437, "uuid": "6f46969a-d5d0-48de-899f-621403f16946", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209437, "uuid": "d4e04383-49aa-4c05-b26e-645d2ea0c086", "value": "6144:HdMLko79VsuLISYYC/Y/CQdCo6vvUR0pMbTipPn:ek+sxSYg/JddlqibTipPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209437, "uuid": "420cee48-fa02-4627-9705-e471546b9d12", "value": 206612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209437, "uuid": "275cdbf6-10b2-4e2f-892b-c0f457874adb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209437, "uuid": "187461db-7a8c-4a36-8bfa-db14f8fa1032", "value": "76462533a7cb016f3bd2b06a794762ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a14ac3a-9b60-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618212396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212396, "uuid": "312929d0-2ba9-47f0-81b3-0c73c5bad033", "comment": "Malware payload (AgentTesla)", "value": "a775f5baaf9d1c905ffe5752d9de4dd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212396, "uuid": "400dc373-8a47-4190-a7a0-def5d1a103bd", "comment": "Malware payload (AgentTesla)", "value": "d8974c809b3968ef46bd09d9933699a8a7cf0b6d0084a0d3b79f6ba1c0633c60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212396, "uuid": "c919322d-ea4e-4152-a442-881183701832", "comment": "Malware payload (AgentTesla)", "value": "dc43740877aef953ca4bcb8405094a4c08e5f511", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618212396, "uuid": "a8e5bff5-3b79-43e5-b85a-db8eb2e4eb89", "comment": "Malware payload (AgentTesla)", "value": "b3159f9270bcef1403ac48a5897afb1becbedaee20e6f9b5729f0f7b555c6f630d1288466a3f3c9622c7554ed48cd566", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212396, "uuid": "60e1ab42-89cc-4c6b-a2a4-d56f077bd11d", "value": "7E155BADB24072DECC67CF3699641C24EB617876573BD20F901721ACAA6F497CF250E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212396, "uuid": "c9fea2b5-fe76-4d39-bb95-fbd59dd1805c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212396, "uuid": "2e1d4a49-54d2-4bff-807d-a34fe999fecc", "value": "12288:odhucRmFXYYE+rIOdHHYaIGo8SPv10WtAMMCs6MT+TASKtEJPl+SN9Pn8N4qdqyI:odh5RmrUOdHHNIG6Pv1TtBMC+irJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618212396, "uuid": "2687dd32-18db-4a45-b47a-e5e3ba4847bc", "value": 929792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618212396, "uuid": "e437d4d6-a5b5-48e3-814d-8a245c8b7e4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618212396, "uuid": "1ed26b1b-cac8-41ed-952c-1b62c991176a", "value": "Dubai REGA 2021UAE.exe123", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020893e5-9b71-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618219523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219523, "uuid": "600c6783-8aa7-4e06-8a67-020d41353792", "comment": "Malware payload (AsyncRAT)", "value": "846a2f2e473133f1f37a08a5a96e62a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219523, "uuid": "1a401854-5f61-402d-8a3d-0befa830cc99", "comment": "Malware payload (AsyncRAT)", "value": "d89b709a7048d214c4dfba4b9c3acc5a372c2f6cb0bdb72feb4f1f82ef114586", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219523, "uuid": "346ffacf-618b-45bb-b1c8-b963c43c8c17", "comment": "Malware payload (AsyncRAT)", "value": "c175b040fdbfb440e0f6638b91f65d27b674de50", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219523, "uuid": "79238ff0-8d26-4a7d-ba56-292b85e2cd6e", "comment": "Malware payload (AsyncRAT)", "value": "6fe72d040554bce61d82f2031455979a06b98ba95527470bcf8a833c175deaca244246e03b17790d2afced60ddf2ae99", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219523, "uuid": "3cf4cfc7-1f0c-4ada-a3c8-c7c759140715", "value": "A3B2A22CC640343DF6D34F7ED8CBA7D220DD2708AA3946CB26485F1F7C6A19519E86E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219523, "uuid": "fb12a29d-1992-45ad-be8f-f5557af885da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219523, "uuid": "e36ecd7e-4420-4a33-bd07-c624edfb50f0", "value": "192:1qB//JLLuLdLVIF9Af6behLz5cchRIPiW69J7uWyeHW4:kd/dLuLdLV49ASbcL6chRIaxeWyeHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219523, "uuid": "a72fe21a-8541-42e4-a6ea-04568ea2ed3d", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219523, "uuid": "396be0b5-160d-4753-ba9c-be94984ffed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219523, "uuid": "ffb6e94b-7b7a-4922-b1fc-43079b1295f8", "value": "Rechung-2021.12.04.2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef3c2a0-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (Glupteba)", "timestamp": 1618209398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209398, "uuid": "6a3f99cc-c53c-47e1-b887-06bab0b96d21", "comment": "Malware payload (Glupteba)", "value": "73eb70ca5994df6e2766bb5b799f04ec", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209398, "uuid": "816d7d6c-cad1-4cb3-a544-923bd2cb8d5c", "comment": "Malware payload (Glupteba)", "value": "d9852b60eb015a9b4bd4f114321b8d7efd7a47b85d32ad21755e671c5bab5f2c", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209398, "uuid": "49d6fcc3-69e3-4e57-a6a5-86f01540cba9", "comment": "Malware payload (Glupteba)", "value": "dbccf45a2dd780ab31a13f2136f82c4f3a17906e", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209398, "uuid": "61ff0a5b-8632-4e1a-a229-05f42f31295f", "comment": "Malware payload (Glupteba)", "value": "35521f6dd8a66d16a2a20b11e0499dd6213ec368bcfb3871efe40a189de4fd5dc919960b423376ae3f32fd1a5e6c7a48", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209398, "uuid": "7515953d-f008-4b06-bed7-cbc7d0cc7747", "value": "F7063306A71DEF6BE321C4FD7D3BDA8BE466546E016E0B1522B51605213FEA9FB1800F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209398, "uuid": "2e277127-e992-4d75-aa1b-6444fc97d7ec", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209398, "uuid": "80261025-8f47-4452-9600-302b0be46083", "value": "49152:OQDY27iKqkXNjrRMF0TiBlOagRMs0ogXUaBqhreSM0Z14Dk6I5ZdzREmquDI0A+V:OqqkXsF0TcOlzgXUdK0YDbI5ZdzRy6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209398, "uuid": "95b10b47-3928-49e6-82fc-c182ddc0bf8b", "value": 3901952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209398, "uuid": "0d03af89-b7aa-469e-a414-27a8657e7169", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209398, "uuid": "aed8be40-37dc-4688-9406-165afcea1140", "value": "setupapp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e1ac71-9b97-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235855, "uuid": "070bf14c-eb80-44c4-ac15-983211d79355", "comment": "Malware payload (AgentTesla)", "value": "23ae09753196145fb3160673bd8fd552", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235855, "uuid": "3a8168ff-9c4e-46c6-bf43-cd9e30b992cf", "comment": "Malware payload (AgentTesla)", "value": "dd47f2e22d691a3a810a3cb353139ae3f3a9232ab6285c0c9193c755f4e87638", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235855, "uuid": "74695a67-e56c-4469-97d1-41cece59c0b5", "comment": "Malware payload (AgentTesla)", "value": "81e0a1ab7dde44110562b9d8139e758e922d54da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235855, "uuid": "0fdf5ac8-e145-4e8e-a5cf-00238711d674", "comment": "Malware payload (AgentTesla)", "value": "360f5f3df6ea966f427d0171f1bb8fff95190e050a8502b491d54f67297e08bc46f4e612622d0face0ee5df09d315fed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235855, "uuid": "6cebef34-53a0-41d5-8e21-ff657e9476a3", "value": "0FD4F11173C5C792C93A07F65432940683B5F1DE7833EFA90E44A1DA252AB4C8DE9EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235855, "uuid": "adcc3835-063a-4c1b-95d9-525ea98f6d91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235855, "uuid": "9ea5e75d-b03c-45a2-be6b-8c7129d4a1fe", "value": "12288:7BbXSE1IlJmZu4dXSzZJKzYT0uGES1y96KS9/PDu7gSwSkm:7dSE4JmHkJKLuGES1wZS9H7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235855, "uuid": "37cba984-c529-4158-92db-cdacea4ae6ea", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235855, "uuid": "102cefef-d8cb-4871-8fbb-c2ff2e06295a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235855, "uuid": "08185636-0e31-437d-9360-b1720003eaba", "value": "Files & Specification.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c64fdc-9b75-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618221383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221383, "uuid": "9378e906-326b-4a10-b454-63d56aad1ca8", "comment": "Malware payload (AgentTesla)", "value": "55e52a723b573e62ea5aaa6b42cfeb67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221383, "uuid": "e4501d8a-5b50-48d8-99ad-64f662dd74ea", "comment": "Malware payload (AgentTesla)", "value": "dd4a4bf62d98e6386e5dee5ea0af5f2dab2cef4a14dc7c55b54949f44b6232ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221383, "uuid": "78f980e9-3842-4851-8b7c-a1d848f1a0b6", "comment": "Malware payload (AgentTesla)", "value": "a64c9ac689b2fe57d9bb87754b56992836223df6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618221383, "uuid": "0badf0d0-cb99-460f-9be6-4150ee192481", "comment": "Malware payload (AgentTesla)", "value": "ffde13de094f723e8784f4ce68259eea43eeb89e8ad8c3035b9985a6400c279f72e8fdc816ead99e751a827cc84a28e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221383, "uuid": "ff194691-0c6a-466d-ae44-406bf3bb7464", "value": "F8C423B320E244152646DDF50DA4F8FA1B0D17074E8F1EAAEBE9BC30A1C290DF6457E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221383, "uuid": "6e0c629c-d539-426a-9af1-038bae585776", "value": "12288:YJ3v3vrly4LMg/hH6v4oCKl/rZdwFFWlfus1BVWsxYH4:YJ37//JHVlK5D0Wlfu6YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618221383, "uuid": "c2e7d635-8e54-4485-8040-da4526501a48", "value": 590074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618221383, "uuid": "340ec7ea-7545-47a9-8cc8-db182cb3243f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618221383, "uuid": "1368b5c6-155e-4bd2-80b9-c4bb4e9fc3c4", "value": "RFQ.xls.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76414c35-9b5a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618209839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209839, "uuid": "c9a6df18-8678-439c-90c4-3b64fb569b7b", "comment": "Malware payload (Formbook)", "value": "396071cf13f858e6677a6655a2d173bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209839, "uuid": "bc67b2be-f53c-4b6c-998a-5842ff830c0c", "comment": "Malware payload (Formbook)", "value": "dd987f07d4e8f3d29758757aea5ff5fee6fca9927d79e18f429b513e42491a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209839, "uuid": "a2120c35-ac2f-4d2c-8267-6bd35b2d5c72", "comment": "Malware payload (Formbook)", "value": "5dbad9d82fcf0d3bb83479afec8ea61441443263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209839, "uuid": "b02f15e5-9116-45c8-9141-ca25d9840d07", "comment": "Malware payload (Formbook)", "value": "87923deb82e5116f9c4f464ea061a3013e55a144d8cac5071f6099af1ed5387738bdf0fdd11f289cf6f6f330bb8ef476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209839, "uuid": "89da3431-72d3-42fb-a1bb-c98154620ad0", "value": "92056BAD325076DFC867CD32D9682C64FBA0B476430BD207A06701ADAE5D99BCF251F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209839, "uuid": "e9a2e63d-65fc-4a8c-be9b-eb982c7225dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209839, "uuid": "8b2e6341-43f2-460f-855b-48b0de6c7c09", "value": "12288:57n6WrZCWUV4Q3tJJ7eUMHaEKWAJuuXnvYH427ED7GcaSlUwSALuitlCFcozLgHj:576Wrox4QdbeUM8Wn+cEXHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209839, "uuid": "69edcd46-7a02-4fec-8baa-6d131c182fcf", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209839, "uuid": "44adbecc-9acc-4c32-bebb-fb7bc8188ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209839, "uuid": "999142e4-aab0-4c2e-9cc9-e0d322ce35a1", "value": "396071cf13f858e6677a6655a2d173bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b11afd0-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1618230034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230034, "uuid": "b1edc32e-fa1d-49d8-ae12-b10d2448c5a5", "comment": "Malware payload (Vjw0rm)", "value": "015f5153e12c7c2af015276690188d1c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230034, "uuid": "987dbfb1-19eb-4226-af54-dae3ccfab9ea", "comment": "Malware payload (Vjw0rm)", "value": "de9b4dcb5d1d41d031f4e66730d9dd51f4b447d66d736c6219bb5e5d02d27f2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230034, "uuid": "093208fb-47f3-44d5-8b9c-3f26b4e35ed9", "comment": "Malware payload (Vjw0rm)", "value": "c2a1a42b90ff4235898d92b68a4b3217a0321d4c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230034, "uuid": "40940031-a603-4664-b6e5-83963beb416d", "comment": "Malware payload (Vjw0rm)", "value": "bc897f22be7e8ff2b91570f857d3fcf495c08477fcc491e5ffb94da7707c31f649ed1d9faceeb090a8164384638eb6af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230034, "uuid": "060b70b3-6374-494e-b13e-ecb013bc56ec", "value": "1081209D284BC63C43D23B8A802DD148CDF548B47E68D2B1148CDAC5360E979C7B69BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230034, "uuid": "6b34d112-a9a5-45a3-a7b0-7262b3c3d713", "value": "96:SABNo5Dbk2c24ZRMHXE6/BI4+Ys+fJKDdQqR7bJyKUFaOS4UK:zSE2c24ZRMlBIrYs+fJYfRfCNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230034, "uuid": "b544ba0e-a9e1-44cc-b8ee-e3f19f2ccc54", "value": 3881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230034, "uuid": "35646787-9abe-4d44-984b-cec84cf22320", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230034, "uuid": "b3132eb8-3205-4a47-a6bc-6ae1d0e56460", "value": "Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0713dd56-9bc7-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618256468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256468, "uuid": "e6464382-0a57-4ba8-bb13-1c461be4f654", "comment": "Malware payload (AgentTesla)", "value": "bbdefa1ca9d9687df0628e7c1ac4df92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256468, "uuid": "c9ce4f1d-6960-4962-b189-c8e0cf6caf54", "comment": "Malware payload (AgentTesla)", "value": "df44cd96fc150bf5fe37a7eb55c98f30edbe8899d2b7ed86f42741b99405a67b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256468, "uuid": "366ce135-dfc5-41fc-8295-b47dc6471957", "comment": "Malware payload (AgentTesla)", "value": "e1310229afa6a38e3686b22b7effd9c662193aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618256468, "uuid": "4e8eebf9-af5f-4406-99b2-de6da3bef81c", "comment": "Malware payload (AgentTesla)", "value": "1d5f6794dcc6f36edfc1f0db177217f6446b221b81bba4cb4dd91d627012c15ba719e2c19a83fb0166aa2c45c2cbfe78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256468, "uuid": "658dd1b3-8b9b-47dc-9fab-44ce5c892cd6", "value": "0CE4F1206796CB82D97A03F69432900783B9F1DD7C23EF9D4D8491D6212AB4CADE5ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256468, "uuid": "af722270-f7ab-4d62-a321-753e41d056e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256468, "uuid": "01cb8110-bee8-4654-bc9c-0f7e1677ec4f", "value": "12288:+VTW/NfQ248AvV/XFyofrl5z/a2hIHakxo/nU:4CNYr8AvGYrP/a5ak6/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618256468, "uuid": "d1e455bc-4cc1-4d2e-8e2f-641459131645", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618256468, "uuid": "45cdcc29-cb97-4d72-acbe-32311d335750", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618256468, "uuid": "95ed73a5-9bfb-4d2e-b671-b8f9ba3f778e", "value": "20211204098764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d790687f-9b96-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618235772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235772, "uuid": "03a58f9b-bebf-4727-9e06-a15c60d1c5e7", "comment": "Malware payload (AgentTesla)", "value": "eefb8526609899c81433d17951fbf434", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235772, "uuid": "a697af57-e482-4ed0-a571-72a0e1505c93", "comment": "Malware payload (AgentTesla)", "value": "dfc4dd5529b8864c44fe9f5ac811f2002f2098d7ccaeb4b1ee59a81e778e5dc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235772, "uuid": "146dd4be-122a-4e43-a4f1-7b66a7ba3a6f", "comment": "Malware payload (AgentTesla)", "value": "db0063c86dcc9b8b1676f5d24ad2fa7d31ec6a80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235772, "uuid": "cb72625b-3efd-4c5c-8f69-a60d74b62b8a", "comment": "Malware payload (AgentTesla)", "value": "4bb78234c030721911c59bb9d4b94789d8c36f9bd11830b69ad6494e5de980cfd6888a9a5a465b89bff40bbd8813e96b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235772, "uuid": "a9a7e34a-b5bd-431a-974a-6f8f607a40b8", "value": "76050104226887A2D5DDF738EDB0D7400FA3BF25D614EE0FBEE5709948E3B4B9A41652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235772, "uuid": "f0d77753-7f77-439a-aa95-ab0f79cfd62e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235772, "uuid": "0a501416-b1d1-4824-b449-e76d6a973e26", "value": "12288:zX0EZ9lzTfbt4e4ZSRhd/MbeERbf7/RaMbwqv2vBaYiYK:Ic9lzLbtLhRhtMHDlaOOrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235772, "uuid": "2ce199b5-564e-4bdc-8c33-520f00719ba6", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235772, "uuid": "48d1f167-7826-43fa-ab13-f45fcd662367", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235772, "uuid": "a940ddda-6184-48f8-a9f3-9e5cc92d4acf", "value": "WE59574858444.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93399bf4-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618209458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209458, "uuid": "b1a7ce2b-8cf0-4931-a7f3-1fd88fa92ed4", "comment": "Malware payload (NanoCore)", "value": "a3cbeb3e732b11954572b3ee6755242c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209458, "uuid": "97f8ff40-7fab-4880-b097-9b01a1764022", "comment": "Malware payload (NanoCore)", "value": "e006460ad1e34ddbbc28430c2d529a7ee491893c7ae8b6902b2d8d8c56620510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209458, "uuid": "b225b951-a1f4-474b-bec1-025814f48945", "comment": "Malware payload (NanoCore)", "value": "ebb41b49de8f1b09ea20dabffcfd85b93b68d7f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209458, "uuid": "2baf1657-cbe3-412b-8e7b-f4339ede16ba", "comment": "Malware payload (NanoCore)", "value": "fc199225061d51fbe9ed8fb7e1c623c3499e13aff07ae3942c5ae5a9848cecdb6a65a539914a9712338e4cc435b1eea2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209458, "uuid": "1092204b-56a2-492b-96f7-582dca4bc11b", "value": "D6051245BA889B64D46C67782524C23013F8FC56EB27E35A3EC87DAF3E777424702962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209458, "uuid": "44cf119f-95cf-4f0d-b51f-f55d93ab6170", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209458, "uuid": "0fdfa308-87b6-428f-862b-326d8aa5ce22", "value": "12288:fqPhNb1Cpc0vs3YpRTYmuCBWhfCfyxmbKzYwafnJMKrXe3tw2luRVZzQKaq:iPhxcpHUIpRTY0c1uyUeU3nJMKoCaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209458, "uuid": "e5460719-f1ce-4f44-a0de-b547977f58de", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209458, "uuid": "bb41c5a3-86bb-4753-aed5-ba92b4e05b85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209458, "uuid": "66d7c10b-8516-404f-8e7b-bf76e57cd69a", "value": "a3cbeb3e732b11954572b3ee6755242c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d393680-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230037, "uuid": "f3620aaa-9030-4d3a-b055-7f10989cb052", "comment": "Malware payload", "value": "9fd454a20e5e06910559ef8d60dfd131", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230037, "uuid": "cea19133-9e17-4a74-b0cc-4b60fd21fe66", "comment": "Malware payload", "value": "e00e2ca502fa1ee803a4258fbbca0247aa281983e045d583ce10e41af51ab318", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230037, "uuid": "45d9faaa-c435-4560-82a5-8d18d24598f7", "comment": "Malware payload", "value": "b21c207ceb2aaa8aaf74fa803cf3ce54aeb132b8", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230037, "uuid": "d56490f6-f421-4956-a92e-3f02e5a1e958", "comment": "Malware payload", "value": "01513d000e5441e0103452336bf2e35d442b23a56096941dd41117fd4289270df3ac4f002eb953b53434712094cfa46a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230037, "uuid": "dd520971-7824-4ee7-8153-c6e0bb1ad673", "value": "4484230B72986F53ECCAB57912E35914B890EF95C36D45C35010B25FEAF0F9E18E2A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230037, "uuid": "8a6db587-67de-43aa-896a-fac496996cfa", "value": "6144:vxcflf8e6vClDbWK5/+NkHtsb9EiGOKvFEKbmbgQk9SMW65PUVj7N3W5XFJB:vveqClDPYmt89EiV9bAl5PUr3kXXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230037, "uuid": "d68b2a32-105c-44f4-9fe6-5bb369220303", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230037, "uuid": "d8875da4-4606-49e7-994a-1c3bab14875e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230037, "uuid": "27c792f8-5f16-4cb9-8aed-1f44c3599b11", "value": "Order List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7425f33-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1618207908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207908, "uuid": "5c91b43b-f048-42eb-b114-2324eab84c00", "comment": "Malware payload (SnakeKeylogger)", "value": "b464e291bd67c72538d34b86b36f9129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207908, "uuid": "d6a33704-748c-48dd-884f-fb15bd33de13", "comment": "Malware payload (SnakeKeylogger)", "value": "e0248326f084027647dd66c8a53bac87d334dc3e3667fea90643627e9c4a92a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207908, "uuid": "941d1c7b-57c0-49aa-9f60-5ba176de65a6", "comment": "Malware payload (SnakeKeylogger)", "value": "4408743f7102ee8c149b65e8e22fe132175416de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207908, "uuid": "ba897920-d3c9-419a-bdb9-5c15f26543c3", "comment": "Malware payload (SnakeKeylogger)", "value": "0c0a69be239b31cc64c1390cd672f4165889772da7cdce832f918b105bf82773b9e92e65ffd468ffdae9a345d3915f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207908, "uuid": "11007c14-7c3c-42a6-9707-0d78bbc9395b", "value": "86E48C726B704649CB240AB4542248031676ACF96833E6FAC9FCB0D9363775FBCA1D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207908, "uuid": "ed600c0e-5f94-4f27-aa1e-21464cdfade2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207908, "uuid": "ed19a31e-e98a-48ac-9ed1-7b22ce8bb97f", "value": "12288:eFJbDBJXrU6fzJAd6Xy7NS0KH7FPI4qWtGpLY0mYwv:eTjbBri6i7Nc1I4popE0m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207908, "uuid": "b714f112-4399-48f0-8f13-2692712ea26a", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207908, "uuid": "eae9c1ab-1641-4465-9122-827483fd2f33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207908, "uuid": "bdca058c-76d5-4c39-925f-511472938593", "value": "JSTCG21040600210 xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d0d0af-9b7d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618225037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225037, "uuid": "1ddc039c-0256-472f-a78d-3b24f7d9093d", "comment": "Malware payload", "value": "9490e3167b7b328ce4ebbd3ed0830dcf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225037, "uuid": "5f8c014a-a78f-4851-811a-595c2560c5fe", "comment": "Malware payload", "value": "e0d665ce6c533babcda80694cb2537da54f807ae9ed5fa519b4522e672e240be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225037, "uuid": "90c85548-0a3b-43b7-b925-dc25078156e7", "comment": "Malware payload", "value": "dcb81124be9ec2e1ce78b1d7838d59dda6334fa4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618225037, "uuid": "d2dd598b-d5ee-4ddf-8735-65cbb5ce2957", "comment": "Malware payload", "value": "84b2303d6fc42930edafcb46be62049ff4ca8170a14c82bc223e9aa5175e448f4cc3f616c17d2dab3631521b261adddb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225037, "uuid": "ff9e1c22-95dd-4dc8-962f-852d0d0a7044", "value": "2FD3029EFD6A0A12FC45067489E7C4CC9EFBA9712D11302FEFB9A1AA10D0DD5E41913B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225037, "uuid": "17d29aec-5673-4e00-a137-7309c55728b3", "value": "b863a0170e8607b535791c6f08481ac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225037, "uuid": "1f189baf-3246-4257-9ff2-40742a518ef8", "value": "3072:V7EMQsVlaReZhphqrlT7MG9DqDseBguVdu4+rqv8kzY5Bed/rXz:mM+ReLQlpJqBBguF+rKLtdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618225037, "uuid": "3dadab1d-0f96-4580-b941-4bc467d2e7a3", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618225037, "uuid": "ce8d1278-f2e6-493b-901c-83bcb6302448", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618225037, "uuid": "a7441662-3264-4e60-bbf5-3b8faa4b2e1c", "value": "SecuriteInfo.com.Trojan.Packed.24465.10372.5532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b21518b-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618209364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209364, "uuid": "92bcb4cb-cc4a-43ee-b88d-8f5420f14667", "comment": "Malware payload (RedLineStealer)", "value": "680db8071c092a79396fa2a44e710d70", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209364, "uuid": "bd9721bf-9200-4559-be8c-789a0ed8aea7", "comment": "Malware payload (RedLineStealer)", "value": "e221a9a50a4c2492f5fbd710cddc97c63ea9247f6e6c0ba1893e12a9ca608395", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209364, "uuid": "4a392da8-b2ac-441f-be77-ee73f8593ccc", "comment": "Malware payload (RedLineStealer)", "value": "4f16d9dae64d87dcb25a9a4521930e055df4042e", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209364, "uuid": "7f10cdb8-2236-4f36-8f96-0cd14d594709", "comment": "Malware payload (RedLineStealer)", "value": "d6df218a8db3564fb602bb1e055862fea8ce40896ddcc6cd5c32e1798950aa8992a0bfa0688df2f6f9a752f832804914", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209364, "uuid": "5411afb4-8042-433a-8a90-4602df4f3e49", "value": "1C75BF533AC19990E199053EC07ECC488375AF66956BE32B7D9432EDB0E33167D298CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209364, "uuid": "e423e770-a48c-48fa-915e-4934da15ec10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209364, "uuid": "51e95c24-6a27-4fd6-8715-c2076e91e980", "value": "24576:X/UIh8FwHD5jlU1n4X6tlS5Xgq2dYhw6iw+zHKfXIOmcw:c5amn4Elcwq4G9gHKfXIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209364, "uuid": "5658452d-5f0c-4587-9cb0-e8595edf0ae6", "value": 1694208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209364, "uuid": "183cd2a0-e908-4bf3-8ec2-6a2d204ecd3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209364, "uuid": "1cc0be8f-f1b4-4496-bae5-1342e6336476", "value": "vmeo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2226c5d6-9b9f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1618239334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239334, "uuid": "cc262909-35fd-43be-8f06-909e839a7179", "comment": "Malware payload (Dridex)", "value": "1d16e4c28b5b028608fd50c19368cb5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239334, "uuid": "ce8c94c1-ecc1-4df0-b8ff-105454314809", "comment": "Malware payload (Dridex)", "value": "e3a711b39c8ea5767f4614db604149f00e15961e67290b72b5a4ffb568e5038c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239334, "uuid": "2461b781-f107-466a-9b97-1b640291907d", "comment": "Malware payload (Dridex)", "value": "f8301d4ab3663ad962eef64179ac8275e200c576", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618239334, "uuid": "4e0383be-23af-4909-a0fd-abbb830806ef", "comment": "Malware payload (Dridex)", "value": "70bd48abce799ed22b500f4ee7a7871df3758c459da8b04fe21e1ece60b95f8ee22b657f5830a121b0e54fb112b76f16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239334, "uuid": "46add2ce-9cf3-4e27-b805-4e4d1b71aa76", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239334, "uuid": "902962b9-e44b-46d8-ad6e-02685f22645e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239334, "uuid": "375385dd-28a7-4e22-8d09-24f2f8152e62", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618239334, "uuid": "ae86474b-31f1-4450-9d0a-8581fe629309", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618239334, "uuid": "6e3d2b64-cc4f-4243-9b1b-406a882fddde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618239334, "uuid": "1abffddf-0bc3-4f96-b48b-94c77ac4579a", "value": "k2D3OsKTbtot58S.php.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573bd405-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618214512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214512, "uuid": "5947976b-24d2-47af-beb6-a9decbbb0558", "comment": "Malware payload (RaccoonStealer)", "value": "6f3dbe0a78e953e41cf84618d95579c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214512, "uuid": "18aa51a6-75d3-4501-a5af-63f98ee29827", "comment": "Malware payload (RaccoonStealer)", "value": "e4e480b258663b2d168c836922136e292348d3f977e97e003ef06388a7693891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214512, "uuid": "7d313941-2a12-4f0e-af35-7e66441de0b2", "comment": "Malware payload (RaccoonStealer)", "value": "89858d13f39a36f181eeee872f4226622533af45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214512, "uuid": "658df938-021e-4f80-9d17-61e4512a265e", "comment": "Malware payload (RaccoonStealer)", "value": "45d196c62e887401dba659bd1aa4a85f6659b535dda8fc87c360bf371de85763382a31e205226f872ff5a057de607bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214512, "uuid": "e1023a4d-f559-48df-afb0-f3589a54fcf8", "value": "9FC4F02073D0C033D45224798529CBB14EBF78715AAAA98FBBC40FBD2F256D1B72574A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214512, "uuid": "ba23a80b-78f2-4028-8985-12046a6f3c37", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214512, "uuid": "961e3cf8-8b70-4f6b-bd58-fad2b1b7e987", "value": "12288:uQEdDqokeYkljARbl77eZRpNMwOp85o+HfPjtzK0k3SdUEZyJ5WtD5:uXowjARx7SRpNnN5pzKAULmtD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214512, "uuid": "5284ae0e-e22c-4f1f-a499-e33d01ce1abd", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214512, "uuid": "27d74bb5-3399-4653-bd8a-34b1fed7fb4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214512, "uuid": "b792f05b-9e65-47d7-9dd5-680369fcc3f6", "value": "6f3dbe0a78e953e41cf84618d95579c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be7400e-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618209419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209419, "uuid": "02cfee95-9d5d-41e9-99fd-64d79732a935", "comment": "Malware payload (RaccoonStealer)", "value": "356dc1680475998c7c23e199f2c2e9ca", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209419, "uuid": "13bbfddd-e6d5-4cbf-b6f0-7cb6456f2a6e", "comment": "Malware payload (RaccoonStealer)", "value": "e5990480cda6207bf008957ae5a3fa3debe6303fd19c3babc3f2223bf769479c", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209419, "uuid": "8f6d5bd1-8c43-49bb-a1d5-8c7145be0fab", "comment": "Malware payload (RaccoonStealer)", "value": "8eadece945d635093c04a9d871ea0ead59d8e89f", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209419, "uuid": "0b5152c3-729d-494a-a837-6771af447f37", "comment": "Malware payload (RaccoonStealer)", "value": "2272e7faddc6a11fb434321eda92d6052942cc072c19e049a3a23f5ec139c602fb12f4534c571cfb52d4dd7c60d2350e", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209419, "uuid": "2dcb2a29-a22b-41f7-92cf-c8888bede548", "value": "B482F643BE928B62C52545781872DAF580BEB535AF2503DFF7D04E2A021D5E1AC36D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209419, "uuid": "71609e17-f147-4bac-b8f6-550247b8c9eb", "value": "68c97f4638ec4d8784dccbf5cd2aa30e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209419, "uuid": "dc370d2d-b7b0-4f6d-99e5-c011623939d6", "value": "384:XbRIvCAcTljSxyW79lxqZQC7ZHLh2jSVe0J7OseTe:3jSxykxqhZHLZVnJ7OxTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209419, "uuid": "4a4fa42e-0ba3-4ad4-9fb8-63bc375c593c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209419, "uuid": "6d6dab75-5037-4488-ad3b-6491f8c1c0e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209419, "uuid": "3a0b65cd-7a6d-4ee7-8641-bd82bc6710c9", "value": "C++ Dropper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c389e9-9ba2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618240891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240891, "uuid": "858072f0-2f6d-4f7a-a447-a82b29d459be", "comment": "Malware payload", "value": "9c0c4088ed9e09f13987d95c8ade10b0", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240891, "uuid": "b0a4c2ae-fce0-46aa-8014-6e9dcc91af6c", "comment": "Malware payload", "value": "e623be9f64c0384a8b8f486d8e64c9bfddb3e05e449769bd7f46914bc85d98cd", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240891, "uuid": "4869514c-8187-4b57-8aff-d04505f58ea6", "comment": "Malware payload", "value": "1ca6fc601c70047921f8fbbbdbaf0afe59d98068", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618240891, "uuid": "3accd30b-e90c-40d6-8626-15b2bf6c93fc", "comment": "Malware payload", "value": "960966e2f36cdb98817ad69053845d7ee7e43aff98a5bbbac0cce23e4948bf7dad9d2db3680eea48b0ebfd57d9949710", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240891, "uuid": "612fff6b-8d4f-4bac-accc-8db86346816a", "value": "15B4231E016C7C1CE7F4BBE9145E1E72EE2D9FD794C82EE537A07F6A0A9420B6087125", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240891, "uuid": "2bc66915-29b5-4015-8257-946added65a6", "value": "12288:b98NXstUq9sQwBYqjK1t+FhQGfEixgUfnwp5+/IQBSMFr2ypZGOPQq9VrW7EK:b98NXstkBYqjct+FhQeE1UAWIyr5N4qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618240891, "uuid": "ffb1bf6f-da79-4228-9097-c7ef1e516869", "value": 496244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618240891, "uuid": "c363b61b-8706-4433-97b9-37add0cf7f69", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618240891, "uuid": "52ef6945-1520-449a-a058-e40e0d8dee7d", "value": "PO#53466 pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04505e17-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1618209219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209219, "uuid": "4777ba9a-119b-49e5-8fa9-2e54293ba8be", "comment": "Malware payload (RaccoonStealer)", "value": "70c6c4125e8c4e1ca0d1fa6abe3f890f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209219, "uuid": "ffb09fc1-bfc9-4344-bf24-b9ce608f0b06", "comment": "Malware payload (RaccoonStealer)", "value": "e6cf3cf17eb15ab6ada0573d591ad7687f5da45d560c55fb4f681bc92053f740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209219, "uuid": "0374fb33-c82b-4a26-94e6-58d6dc091883", "comment": "Malware payload (RaccoonStealer)", "value": "41a38168203dd4bb082217979b4e1ad7343db40c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209219, "uuid": "d91225ba-9ca3-434d-8a16-6b8db5d8fc9f", "comment": "Malware payload (RaccoonStealer)", "value": "de624083e309ea478f6e3c41db44ecd94ae68d2c0a2f2a254871dd3a7becbbcf39382cbadb51dab51e7f46183bd9731f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209219, "uuid": "72667217-91e7-45c9-9c86-cbd03666a8e9", "value": "75C4E10177E0C033D45324B69525C7B15EBB74316ABA5A8FBBC80BBC2F296D0A71674E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209219, "uuid": "25bf4d84-15de-4a5e-b58e-8649c491fa12", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209219, "uuid": "00f766d0-2133-4dee-a46c-d5b6d9b0ee5a", "value": "12288:+aEdDpokeYkljkf+ZQPuwLm45hPUd1SzbwKfm79mJAD:+1LwjvPZEsdFAmBZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209219, "uuid": "43130d6d-58e2-4a4c-82e1-718d80baafeb", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209219, "uuid": "cbed0b2b-3117-4cbe-a875-70d410c54a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209219, "uuid": "1461893b-7639-4b3d-93e3-3162568046f2", "value": "70c6c4125e8c4e1ca0d1fa6abe3f890f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e693ecb1-9b90-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618233221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233221, "uuid": "945ff465-535a-4a6c-bf66-80aff026604a", "comment": "Malware payload (NanoCore)", "value": "771a2a04aba7c18f85199e19b9538cf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233221, "uuid": "5a6e31a0-c0f2-4842-9787-adbfd6c43183", "comment": "Malware payload (NanoCore)", "value": "e6d31a2413f5827a340b8ee4d409d6af8e5a0f124e78a69a50ca1c722092812f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233221, "uuid": "22a708c5-c085-4076-86a5-92d5b5aff982", "comment": "Malware payload (NanoCore)", "value": "54f3b0d78f13d1dd887c04132f771921ace65bfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233221, "uuid": "17647b16-9d69-4c3e-aa49-93a3f632d267", "comment": "Malware payload (NanoCore)", "value": "427b5924fc1e01690978cd9bef781f77aa44c7603efdc2afec9207420e9388e9d7cf9817a7be028351b2b976034a1bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233221, "uuid": "95462526-9897-4dae-96c4-b42adbbd6770", "value": "94056BAD7250B2DFC867CD32D9681D64FBA07476430BD207A06702EDAA5D99BCF241F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233221, "uuid": "c04e9507-0483-4377-9c28-48b8e2e34b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233221, "uuid": "8ec95fa4-8398-4228-a065-002665800cd5", "value": "12288:RrNN3clxyZhjofK4R8A9G5rASsj3aXMFSTVdX+oLVtvFgXVuqzF2pefEdGRO2rSv:pMlmoS4XUFsj3VFw33vFSVuoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233221, "uuid": "e484bd6e-49c4-4c40-83d4-4b70b4095743", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233221, "uuid": "1b5759f6-fada-48fd-af13-350bca840ef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233221, "uuid": "08161b20-0f81-4fe8-8cca-7df5a53fd712", "value": "QUOTATION_ORDER.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dab88ea-9b71-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618219730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219730, "uuid": "355042be-2a0a-47c7-8d96-052cc35bc76b", "comment": "Malware payload (Loki)", "value": "8ee49b2d10ddc1512e7de9f6b5c64f0b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219730, "uuid": "b58191fd-9962-447d-97eb-89740532fdec", "comment": "Malware payload (Loki)", "value": "e7043a6aec88d432cd6d818145239f51ce92a1691f40a6d2d007af330a666b41", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219730, "uuid": "852d94fe-71bf-48bf-9e06-7c4af8944632", "comment": "Malware payload (Loki)", "value": "23adba4bdab012d25b1472ec0cade20c576544ea", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618219730, "uuid": "6773530e-4aba-4135-8ccf-2b7a1dea4ce7", "comment": "Malware payload (Loki)", "value": "5ffd8fb0601a3c584c9174ce5994d82e56e90ca67db0dddc5cb5cb76d021caa7594c281a16b242eb19503efd1d7d4f10", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219730, "uuid": "4a88bd17-0938-475c-9f8a-405eb063b43d", "value": "19240200A7D69CB7D6D34A3108B3A766DBF35210257812473BAC5F3A77136439A2B38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219730, "uuid": "b8d3b049-913e-4011-bf12-2d3853504b8a", "value": "3072:DyewmN4skJ65Aa2spBfL/sm+Rax0qW20tE2TiZIQey097:Dd9AalH+E0z+2TOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618219730, "uuid": "f3becb00-9150-43bf-9582-0ac3beda2678", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618219730, "uuid": "20d5bbc7-f0f4-4065-bcbb-598f25b59a42", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618219730, "uuid": "3e954a27-d0e3-4ff9-83ca-cee86c812a55", "value": "Anmodning om tilbud 12-04-2021\u00b7pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805272a6-9ba9-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618243786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243786, "uuid": "c5ca034b-133a-4f1f-a6b1-9cd2ccd05718", "comment": "Malware payload (AgentTesla)", "value": "7fc3ac56d088174fea421835de994916", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243786, "uuid": "8e4fcc17-00e2-4498-9316-0e8db46c71df", "comment": "Malware payload (AgentTesla)", "value": "e7af50f39e9b7a334638249d8f1b50ea19abb6dbfd8196461a489cd6e23e2291", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243786, "uuid": "85a2d5c0-2d5a-427d-8e75-9f7f49485b07", "comment": "Malware payload (AgentTesla)", "value": "fa74fc4e7cfb5d49aa4ee93af1747f8a650f5d30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618243786, "uuid": "66aff854-5c19-492d-9d22-c6f4d35fa9cc", "comment": "Malware payload (AgentTesla)", "value": "49a8746f5241743d9db2bca07757daf351667b06ad14bf5f90aac5bde39dc717a8dc4b00c57b98b9f07d393d1954cfef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243786, "uuid": "ca8f5bf5-1f7e-4416-81dc-1fe5583b9faa", "value": "3A0501282794CD57D9BC5FB9A8B1920413B1B110BB33E31ABAB9207C5F737D14A6B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243786, "uuid": "03f5e5d7-5044-47e4-87e7-cc476c49fd1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243786, "uuid": "7a7593eb-ae10-4f1d-a6d3-8ad372221455", "value": "24576:zq8CKLFviVzTaHfMEp9Efn+BrbXUxsEEulWYTM:BLEW/Mi6n+VUxDfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618243786, "uuid": "95b018f8-be37-4da1-908b-6cb8e038bd1b", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618243786, "uuid": "2290dd54-ea4e-4aab-82c0-e6b72cac06a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618243786, "uuid": "e63cd352-9541-464d-b95a-1e2f8f2aa64c", "value": "SecuriteInfo.com.Trojan.PackedNET.646.24565.26953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cff3d2a-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618209367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209367, "uuid": "0bf34cc0-f2b5-4711-8e69-5f7e97d0f63c", "comment": "Malware payload (NanoCore)", "value": "ee9441f85d018a87729276eea46bf51e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209367, "uuid": "99cec1fc-35a5-4bfa-9c55-200c8f0aa683", "comment": "Malware payload (NanoCore)", "value": "e7f54cadf8756bba15b8e5afbcf005c42a83494e91f460b046549c58db2ce9af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209367, "uuid": "71a85cc6-7c45-488d-80e3-5bfbb539f7cc", "comment": "Malware payload (NanoCore)", "value": "39ac1d077fd01d0d77ac41cd016849d86e3be383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209367, "uuid": "e6db6272-95cb-4e80-9fc7-cfe8f6fb3ba9", "comment": "Malware payload (NanoCore)", "value": "adc92aacd3b9b0442608976968417820485f157aabd76c5c54a1c38bc572adb842fc83c344d4e0e6e71eb93740637fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "nVpn", "colour": "#950AC1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209367, "uuid": "f8a454c8-d292-4900-8569-48638d32db14", "value": "ED056AAD325076DFC867CD36CA681C64EBA0B476430BD207A06701EDAE5D89BDF241F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209367, "uuid": "bcd8f54f-d684-4284-b392-e5e081fa18ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209367, "uuid": "64e2aecd-c882-400a-b85e-223a875d88e0", "value": "24576:0IlGqB4X8QkYwpzEE96ok2WEcCXUlcIrGl:0PqBO9kYwpjQ59EcNvrGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209367, "uuid": "4175f15b-2356-491f-b5cd-596ca5aacc87", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209367, "uuid": "08491591-e08e-49ac-b535-f47752275959", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209367, "uuid": "e0b9af95-5c1b-4a0a-9549-1003a80ae0d8", "value": "ee9441f85d018a87729276eea46bf51e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7029bb4-9bbe-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618252978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252978, "uuid": "0e5edacb-569e-41b9-99a5-65797041452b", "comment": "Malware payload (Formbook)", "value": "6a6f860db6a64c09af20eea7444fe628", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252978, "uuid": "68739bfa-1ea6-4519-8af8-1530ecdd681d", "comment": "Malware payload (Formbook)", "value": "e849c7a7302e028b74f1f8d4c4bf715db8fde7fdb80747a4b791d7a3fde9d5e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252978, "uuid": "437bcb85-70b8-4f4a-bcb0-c08ba3c09d9e", "comment": "Malware payload (Formbook)", "value": "8397d5364b79ef2660150b0b5970bddf401fee4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618252978, "uuid": "79503dea-423a-4a7c-a035-ffb9e4ceabb0", "comment": "Malware payload (Formbook)", "value": "7c98b59d56997628d32eef415963f5125c7646953addbe94e601e678e7ddb967e6c4248d51909784ae89ccd986e43c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252978, "uuid": "9c90d3c4-ebce-4d0f-a77a-17977034f6de", "value": "85F4E12133E88B59F4BF9B351970918403F2F946DB31D61E7D945A8D0D72B818A33BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252978, "uuid": "5a6b9b9b-468e-4237-9928-473e9d1c97c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252978, "uuid": "2f445439-7308-4fcc-8062-c209f7f13acc", "value": "12288:9QFfb+o8oZTiAy6ybHZ+IrxhK3rcmNb6N8+ne3vUu3iXpJezWrKYTYefBYxQK:sj+0iTrHbsh+e3vUuEJecTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618252978, "uuid": "abb96721-6187-4d4e-82f3-463fbd84b13e", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618252978, "uuid": "51cb1623-2b0d-466d-85ed-c1c44a48ba02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618252978, "uuid": "989bca73-7367-4ee4-a92d-2c29fdcd9de3", "value": "6a6f860db6a64c09af20eea7444fe628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eac570e-9b91-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618233368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233368, "uuid": "5add21eb-f62d-4678-a4a4-a7546a252140", "comment": "Malware payload (AgentTesla)", "value": "1c84862e5b015bcecf6a194d17172dcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233368, "uuid": "62805310-d918-4685-a83c-602e6d4de131", "comment": "Malware payload (AgentTesla)", "value": "ea29689e038f2a801066054f8ae2e3e3884127e8ac897f5467055250ce2b42f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233368, "uuid": "0759e0e3-aeb9-4948-9ea9-b3297005455e", "comment": "Malware payload (AgentTesla)", "value": "a3e0a0bda2cdef94089a6012bd025113f9fbead9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618233368, "uuid": "7fbe204b-5579-4c84-b75a-509f95eaccc1", "comment": "Malware payload (AgentTesla)", "value": "7a99c57c7c7eec5be5d1e7752274e8c75ead22ee3022fced4b889763e6ffbf81659517c7f401200acd182879173a2cec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233368, "uuid": "f7baf4a6-0bf1-491d-9c1a-b21c8c664d44", "value": "B1158C987604F4CEC4578D33C9545CF09620ADEAD31BE203A0573D99B93D68FDEA68E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233368, "uuid": "6ffb15f8-3615-4d4f-b351-11ec3190c187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233368, "uuid": "3c84e2ce-c19f-423d-a9f4-9fbc7af773bc", "value": "12288:g/m/1Vjriddyflf5T716samRCChXNNAdUbuTSYScJ/cfCTpc7kg5M7Cdb/G/uxFB:AaSyB5T716rmRCQB6T5/hT5kb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618233368, "uuid": "790886c2-a690-4529-b064-ba33eba873b9", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618233368, "uuid": "c65da3e9-d944-4525-94a0-0d1fc9bb4a25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618233368, "uuid": "023f6827-ae3b-4fcb-80a6-e2e32a132256", "value": "BILL-OOO566876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab144d1-9b73-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618220745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220745, "uuid": "e39b996c-7fc7-4c96-a771-c76ac10d6644", "comment": "Malware payload (AgentTesla)", "value": "28a579de97c245a7c1099ef443673445", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220745, "uuid": "e4dc1306-601b-4536-8e51-d1b86ad398a9", "comment": "Malware payload (AgentTesla)", "value": "eaba7e439e5f617a99995729c93bd62ba8d4f72f3ce430bd631ec4aaae891ce9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220745, "uuid": "51d3bf6a-67a0-4f22-84ca-c4dfd5b90151", "comment": "Malware payload (AgentTesla)", "value": "83dab8935ae560147276817647dc772bcfc037bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220745, "uuid": "6658c1ae-a015-417b-bc8a-4484c6b7f77b", "comment": "Malware payload (AgentTesla)", "value": "c156b61ce58dbf552294b907917282d6a4e45c3c78056aef6bbf4eb72b989425d644b919858331433eadb2defa66b436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220745, "uuid": "2b4f1db4-b661-4931-b59a-1fbfa9447904", "value": "F9D43348FE4B40E73058B36EC974F4A721918C45516E8B44C077B9E33BAB136A2A3F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220745, "uuid": "82bba9e0-678d-4a32-acb9-b8ce394f2a36", "value": "12288:7FlxJ3m2mJnx3cksJkpZZyO6qOd4rJwcrbM0xaiD4vtFoLrXdOhmD8mI6zyG70qe:Lx4hJxhsJkpZM7d4VwcrAA6FoLImhLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220745, "uuid": "4cd5a9c2-b07c-4798-a9f3-79b5ecd6b057", "value": 607717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220745, "uuid": "8796d942-8c63-4d43-adbd-90e0368631c4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220745, "uuid": "516322ef-bba6-45cd-816f-5a7d9ba83448", "value": "VSL DETAILS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9e12c7-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207461, "uuid": "dc164ae8-9de4-4b99-b429-936d819f1d9f", "comment": "Malware payload", "value": "18c80dc791d89f52eb821df318e5e45c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207461, "uuid": "90bb20e3-14c4-49a8-89a2-afc373564a1d", "comment": "Malware payload", "value": "eaedb38abc152a7f08d32fab92fa0c2cf42c516cf794f81ed9d872c697afe34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207461, "uuid": "e694208d-dc0a-4c1c-b5c8-6996b3118269", "comment": "Malware payload", "value": "b17f4b864e1d11d0018eb87d44f9319b09aef326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207461, "uuid": "fd71df98-f67d-4a93-93aa-3684e6e51ba1", "comment": "Malware payload", "value": "878db4f7fb148d77f1662cc6adfb610500eda8032ed960099685fe6bb366de210ed9f5d2a5f98e321253efcababc553b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207461, "uuid": "984d9064-0df3-400d-bfce-3f851a21db98", "value": "B2944B27EE4076C6EB0541F1212E5B83575A6439B0266253FB8DEF4AFB301CAD2E435B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207461, "uuid": "6545c54f-7f43-4a58-ab42-101b5e7f154f", "value": "f1784cf1396ed485a2bfe94e25f5f54b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207461, "uuid": "0227e38c-0192-480c-a5cd-823e264b97da", "value": "6144:lJZ8NroWEcFXEIiG25r8hbAQYMU+gsS8ePYD+SXEwoAv7mrG:AHjZ256bAQYMU+gsS8ePW+SXEwoWmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207461, "uuid": "07467c81-6ee6-4bdc-8eff-271c9b65464d", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207461, "uuid": "f6bc5a6b-0e2c-45f7-a955-3624030c6f01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207461, "uuid": "1839544e-a078-46e6-a1b8-44cbb045c52d", "value": "Profesor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71699f53-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208113, "uuid": "13639240-b7f1-47f3-bec6-322f1809e6fd", "comment": "Malware payload (Formbook)", "value": "427efd38d55faf552a418815a86c74cb", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208113, "uuid": "b2080b70-a883-48e6-b14c-4a01bb673cba", "comment": "Malware payload (Formbook)", "value": "eca5a46b96f446d1180e0c1d007fa6877643a1ef88f8a95ab64dce9bc94f6206", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208113, "uuid": "1c11594b-8064-4b49-a6be-7f68c7b8bf5e", "comment": "Malware payload (Formbook)", "value": "67f77b79cbdff12aeba332346b9d4182e28e3841", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208113, "uuid": "fe81cd5a-8e48-4feb-88e0-11b5d5d67800", "comment": "Malware payload (Formbook)", "value": "55b3d8eff1bd520ee700d6ced1de47b11f158143aaa887da2fb8d6ce2aef72257aa0022398fb9abe3e60ce5830ed8920", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208113, "uuid": "0a96b647-5b82-4bc1-8388-b887764879b0", "value": "7B3422F93FA25B2276C62D2065EC4DC3B3B84BE9F1059B4D8EA331391D7A1D91217A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208113, "uuid": "772a4610-ca2f-4395-a6b7-7e0c5f1b617b", "value": "6144:dMsG6/1YV1EMjatAkwFv6oNRoWpqeq1Jc4FDfYu:dMsG6/m1EuaO7v6oNyWpqDNQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208113, "uuid": "504757b6-c0aa-4508-b47e-134f07040b77", "value": 232345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208113, "uuid": "a8db7b5f-73b9-4f5d-8063-fa493b16ed82", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208113, "uuid": "b5c7010f-30ad-4afb-998a-888987d9389d", "value": "\ub300\ub3d9\ud14c\ud06c\uc708 \uacac\uc801 \uc694\uccad.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d8ace5-9baf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618246262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246262, "uuid": "2ae82c95-09ca-41ff-8e8e-7cd8847822ff", "comment": "Malware payload (AgentTesla)", "value": "fa6fb1e12559f088fa14a7762d91e682", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246262, "uuid": "b34a07ed-a3ef-4580-b02f-bdcde4f200e9", "comment": "Malware payload (AgentTesla)", "value": "edcb91258edc5deacd80a38b737db1b9d3bce985be94322e80d5d606f38aa67f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246262, "uuid": "9e6a3964-231a-48e3-8260-87f93f1877e7", "comment": "Malware payload (AgentTesla)", "value": "64ac3930d770f24eb895cbe711bdde7648a6ea39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618246262, "uuid": "959a855b-3358-480a-8d9f-ba63defd6054", "comment": "Malware payload (AgentTesla)", "value": "3ddb25b81aee4754288b30a4e0dbdb5b5a626a304c8057483966c1aa25412aef6364796333bf1d42724031d42566731c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246262, "uuid": "3933cb66-b12c-499b-8290-d4c4d59054c4", "value": "6915E03533D89B14E4BE5B369870548043FAFD4AAB32C62E7DE0289D4E72FA14671B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246262, "uuid": "872ccb6f-1562-4242-bb50-933759bfa613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246262, "uuid": "6bfeba93-a55b-482f-9f12-29dd555b5944", "value": "24576:NNSpmkJvFzACfqIxMHmNgvxKpXZXKxUNcdJEU:bovFzACZLN0xKpXZ4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618246262, "uuid": "e8dbfe32-7719-4a98-939d-23e4276ec841", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618246262, "uuid": "bf16c54f-2460-493e-87c9-828b5b339a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618246262, "uuid": "15da9424-85f8-46a0-b928-880fea55b3ed", "value": "COMPANY PROFILE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38d42d0-9ba5-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618242154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242154, "uuid": "d32e5b8f-c5f9-4ba3-9047-3c89e8d02946", "comment": "Malware payload (AgentTesla)", "value": "24286e9255188982a9943d1d0f9f40c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242154, "uuid": "f6987ea0-a71b-44a2-9b96-e709b7b663de", "comment": "Malware payload (AgentTesla)", "value": "edcd24fcf6a97cd49ed271fef1698226c4904c6536bd4b34c1f6487f91ef8dd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242154, "uuid": "0dcdcf2f-0843-4b7a-b108-07233b8b5db7", "comment": "Malware payload (AgentTesla)", "value": "648bc76af265f309b13045393939a4f77f4f251b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618242154, "uuid": "7122f5cc-3973-4cb2-9294-b99c63770ffe", "comment": "Malware payload (AgentTesla)", "value": "cc1a5aea15a3b7f584dab8de4fcc918256c6f2918ecec1bf3c41c5a7faf07e3054779934280602830d801695708c8527", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242154, "uuid": "34722a2e-c36e-40ea-a743-763f5fe67972", "value": "C2E433DF62FD0F0788AD6502F36915AEF9DC2F151B0E9561C2FC873A387045B8A89E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242154, "uuid": "ad5a83c5-8fdc-4995-83b0-5b7c7295f963", "value": "12288:NSzTJM7o18AVEx59RsInFDI8iNeVQJeXX+UyVwc6wF3vpsi3sEn2M+QMsBsvyGJf:NS5+OEPoyFMWiIuUyVQwBvpiE2nsgyG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618242154, "uuid": "7cacd523-ec8e-4a82-a3b1-74f62e6b729c", "value": 715830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618242154, "uuid": "f82e74fa-37b7-42aa-8214-ba2ed6c02659", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618242154, "uuid": "e5e4b848-efeb-41b6-9160-ac395a83f77e", "value": "Arrival Notice - S21012801940.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac58a3a-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618209552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209552, "uuid": "7be4cd10-0cda-47ee-a404-7fcb4aa77a92", "comment": "Malware payload (AgentTesla)", "value": "43d18319605497bb7f10804070f31c42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209552, "uuid": "bea9ce15-890f-488d-b104-e22caadc80c9", "comment": "Malware payload (AgentTesla)", "value": "edcfc4bb2855541fb8aafe5cb37ffe77337c90e319548544642631f898d74bb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209552, "uuid": "e06ec33d-7fde-4d6a-8b01-8aedb1b641df", "comment": "Malware payload (AgentTesla)", "value": "56e6301ac115d5fcc3bea7369f962d1ad02e7fe6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209552, "uuid": "a8e25e09-1ff4-4a91-ae2c-893a1a9058d5", "comment": "Malware payload (AgentTesla)", "value": "dcb1469e2f53121dd2f480d2a4c6cc9db836f96bc0cf2341165fb18ed970a8f5d2fd63440f5167d9b12ac7cca8b898b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209552, "uuid": "ae9f8dfb-2984-4425-830c-abcdba5a39eb", "value": "59538116B757C9A3E1596A358EE2D6CF3330BC22BD81970F318A331E2E379509D42B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209552, "uuid": "d004ee45-85c0-4205-8d9a-060678c106b7", "value": "192:7BKzolzjiDkQ95TEzLTAcjydISgXruCvjAnl5C0Ij4RaHR05wrpQu:tvIDkQLELAcwIpXrLvjAls0I3xuw1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209552, "uuid": "db1f4f69-39e5-4638-afd2-e32e67e89918", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209552, "uuid": "84811ffb-f7f8-407e-8281-e18d143db333", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209552, "uuid": "c173622c-feb5-4220-801c-3d5b8868dd67", "value": "RFQ P39948220 Inquiry.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70efc2c-9b89-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618230215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230215, "uuid": "744408d6-fd3e-4980-ae5e-5d12b858245c", "comment": "Malware payload", "value": "6ddad50fddd088c1aab34c5fa31e6171", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230215, "uuid": "c15275c6-f987-4deb-9a6a-48cc6224cb4f", "comment": "Malware payload", "value": "ee95a7c797bdbab20972a47a864dc69b6ccd053bef00e6ac9e9d49b501f39601", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230215, "uuid": "d3bf028f-7570-40c6-8278-689e516b7f98", "comment": "Malware payload", "value": "4f416aabd77661341484af3fdf1c9c5860ef7923", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618230215, "uuid": "5eb9735c-ac1b-48d4-a7e0-55b2e19eb871", "comment": "Malware payload", "value": "6dbb2d0f81410e4312ada0c4769f7fab4c06e88dc449f247bb1a2e1c90ac9a284b47a00274eae5370e673378212a67ff", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230215, "uuid": "8b7d1c2e-e2e9-4ae4-9b4c-134d1644b110", "value": "D34302C1EFD21C15A420A121B690976C65F7E3593F0C30F99FA0D122C53BD62F65AE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230215, "uuid": "647a03c2-4b8c-4914-b8a6-5cb82d565103", "value": "1536:zvwsGhhonzpyP3JsFl/yK8s532lh5Qyb60l5sPUnaxY:7LAGnE3JTU4lh5QgHScaxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618230215, "uuid": "84b75346-2658-4494-87f9-9555f20ebc87", "value": 56881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618230215, "uuid": "210375f0-30df-4295-8ced-5c82a3bc84ca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618230215, "uuid": "ab2743d0-b383-411b-8714-fe3f52e92d09", "value": "updt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7461b61e-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1618214561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214561, "uuid": "1207a4b7-adf4-49a9-9293-d6464c2136cd", "comment": "Malware payload (RedLineStealer)", "value": "bfca5d2ddd8840dc1f6c49309bbe1924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214561, "uuid": "ef649cec-54e9-4eb2-8339-b310bc7a162e", "comment": "Malware payload (RedLineStealer)", "value": "ef1bc7566ce113d6af42b9eecc63f0b69b3eeebcc2896d63bf948be6c295dc3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214561, "uuid": "4e6a255a-3c85-4fb5-aaa3-d9b3e6b08997", "comment": "Malware payload (RedLineStealer)", "value": "b0f0462dfa8fd68617a7e458f9f24586177b3ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214561, "uuid": "9558363c-710c-4ed2-a9bb-b7d2bdad84d8", "comment": "Malware payload (RedLineStealer)", "value": "e882e2ae589b8cb6796af4e7622274a2b9db8941f3fd812dd5476d705986e7aa76fd06d70bf878a5734639487c343020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214561, "uuid": "a2754900-ae96-4d2d-8a67-00d4e619292e", "value": "A935A0E5F300FD92DF9BDE706FB46326C07B5D56384166522EC8F2689621D1BF18860B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214561, "uuid": "953a20ce-e7da-46a2-8bae-982ddf6eb5a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214561, "uuid": "36849087-99ca-4266-8a40-3fdcb41e833a", "value": "24576:1Oio4e8+h7g9NrNINlRnsFa3SXZ+87xrg:u4igMOa38Zbl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214561, "uuid": "e4accf28-96c4-4e1e-9388-c3c04d6803f4", "value": 1117992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214561, "uuid": "cd9e5d25-954f-484e-b407-80f66e97627b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214561, "uuid": "e30649c7-ffb5-41f3-a1a7-7ccadea70107", "value": "bfca5d2ddd8840dc1f6c49309bbe1924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed9b34b-9b41-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618199063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618199063, "uuid": "b825396a-815f-415f-893f-8372e210d649", "comment": "Malware payload (AgentTesla)", "value": "1e77937581e64117a7dcbf1f7fe43e1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618199063, "uuid": "50798244-58e6-4296-8f3b-988dff219046", "comment": "Malware payload (AgentTesla)", "value": "ef3d7fe0f5b68e9ba953bc39f85476c70ec8486ee54fd2d05cd6e23daf0a1004", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618199063, "uuid": "7ca8b407-48b5-4604-90d4-995060ccf3a4", "comment": "Malware payload (AgentTesla)", "value": "9a0c2940f55c8fb01327bb12acbe56f6b4e7a390", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618199063, "uuid": "7d34a0e6-afac-4d14-8938-d8c08af56867", "comment": "Malware payload (AgentTesla)", "value": "93d38e2348a66d266898ba235fcfdca07366f050f0a3202b3804178fd7d7616362a763c39a8d6d61f88e7e99cb13d26b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618199063, "uuid": "e5247194-4203-46f8-8e77-3fb602da063d", "value": "EDA423E47BF18B57C2DF9FB1827A2625BA41FC980766804270863CEF45763B9D0A51A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618199063, "uuid": "7d83a158-e69a-44a1-a18a-4af6f4a37e4b", "value": "12288:CbEOZ6MJnfecTXoJcLGvbqfFpi27k70vvveH:Ch73FCvGf227Y0vvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618199063, "uuid": "9f63d79b-2da2-4bf7-89d1-ca27f820b835", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618199063, "uuid": "e1fd4f8c-602e-4334-9882-c694379313a7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618199063, "uuid": "6471f563-e5e3-46b1-bf77-eade3679bc00", "value": "2021-Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7601c478-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618214563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214563, "uuid": "9f3b7f84-d16e-4030-95fe-1d5560cf4d4f", "comment": "Malware payload (Formbook)", "value": "52322f04ee7e74ed0dee03b54dbb2b14", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214563, "uuid": "7ca0004a-c0cf-4f7d-8fc9-100c928d56fc", "comment": "Malware payload (Formbook)", "value": "ef885d515b4d6e1bcbd650edf17a089b6c7d5f36fcadfe65491cea49f0f53b91", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214563, "uuid": "3b6abda3-f2ec-45ad-97cb-e40fb21e53a5", "comment": "Malware payload (Formbook)", "value": "8689cd483e8cc3ff397004f993c567161c4d3c41", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214563, "uuid": "f9572967-f1cb-417c-8592-de28dd89ba01", "comment": "Malware payload (Formbook)", "value": "94bd259ea8d72e0b824737ab0cffe91739978041d7a9a60e6044a7533f7c06673984682c98b434d8fdc99a276bff7516", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214563, "uuid": "b200caab-671c-47a3-91ea-237ab94ec082", "value": "98F4234D5368AB39F9BC67BD6434682007F5B10BD76BE7087CC8A0EE4D077418B91A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214563, "uuid": "c47d56dd-a3c7-45e8-ad0f-ebdb632e7975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214563, "uuid": "55c6981f-f3f8-4af2-987a-13ce6087c6b0", "value": "12288:dZ1swNjGqhG/8ZgxJXHeCFfNVTrXYXd1s1ts7DjgoBqerIeAl5kHbtbLwat91qRv:dFLG/8wX+GvYXd1s1ts7Djg0rIrkpbLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214563, "uuid": "f58a8e9a-e957-4294-8ec4-b992dfda9b86", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214563, "uuid": "08cde0dc-e8e6-4fd5-a844-f74e4b4c15a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214563, "uuid": "8ea23f6f-e412-4699-abee-01782df5432f", "value": "YNzE2QUkvaTK7kd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b76b9c-9b9b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618237674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237674, "uuid": "967b8f25-8136-432e-9ce6-c9bc81628cbc", "comment": "Malware payload (AgentTesla)", "value": "52042babd9b87044a45cf632939ce73e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237674, "uuid": "99035748-2399-4bc2-8f28-50f4d40e3b50", "comment": "Malware payload (AgentTesla)", "value": "f0ed031702c17f0538f8470b1a1699c26e6ed1a59eafc6a3bfebded103b4464b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237674, "uuid": "8bdf3f53-7b5f-4e86-a3bd-fc2790850fef", "comment": "Malware payload (AgentTesla)", "value": "cae9015d4241ffd965372c9f47da76ee7431101b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618237674, "uuid": "c9a3c4a9-402b-455a-87b6-1eb7f2049bba", "comment": "Malware payload (AgentTesla)", "value": "9dcf0c3a1fc69b8d300ecf6cd15b100ebca2b711095d9206ec115902c4a01105e37ec1c238ccef992a30fd5db2df6297", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237674, "uuid": "d067bad1-4a4f-4193-85d1-7dd99a6cfe53", "value": "C8F42370C8CE48CD926F0D66BB697DA65C06218335B235953AC20BEDF77A8165F3326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237674, "uuid": "ebc937f3-359c-47cf-a517-bb83fb22cd12", "value": "12288:v2QzHbBdvVU/X3U7zX9iTVC5enIjc1TQZPGplNY8OPWkjGrzch52SKiu53zdu:Rz7B8YgVCoYcsPWkjmzcbKiu5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618237674, "uuid": "23b7e47c-d510-4813-8834-b7d399cc0bf2", "value": 755612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618237674, "uuid": "ff0f271b-9881-4c35-94fa-8e1358c4d79e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618237674, "uuid": "f984c723-ec1d-42d1-9c9b-374c7b9b82fa", "value": "COMPANY PROFILE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882e8e9f-9b5c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618210728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210728, "uuid": "69d73611-7efd-4ea6-86c2-583342ee9b1d", "comment": "Malware payload", "value": "9fca129bb8570ade0faf4286a5073f07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210728, "uuid": "8d605bbb-1ec2-4ec8-92c7-61d463298b67", "comment": "Malware payload", "value": "f1a18f68fa00c941c4cbb7ca269ba1c0d8eb0bf6b801149f867f674ed26abfd4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210728, "uuid": "a7e57f81-c800-498e-958c-096c8fca5c3c", "comment": "Malware payload", "value": "ceb89de630769522ea745113546d0ab2d203e315", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618210728, "uuid": "7565ea38-81ad-4ff1-9462-13870dbeb1b2", "comment": "Malware payload", "value": "a08debe73c7a19ab13ce8de93c0a96a53297cf5ca3cf84db66bff8b6ea881707e8be01c9a72df5cede02fb7b5540456b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210728, "uuid": "db4e8011-55af-4fe2-af97-b793ae91149b", "value": "92846C15347B401728A3DA712DEC597AC98B64E7903CB6360044E32BBB5DF70DE4B7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210728, "uuid": "8f50aab1-54b5-4d10-9a6e-ba8124cff2b3", "value": "3072:730q+DuXrYZib21Fchirmv2pOY75TxTckBqQB:7EqYHFchirmv2pOO5xT5BqQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618210728, "uuid": "c62c81e9-b669-4971-ae42-ffeacaf4448d", "value": 382754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618210728, "uuid": "184bdce4-4b95-4590-a0e7-9457558edf4d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618210728, "uuid": "0defff83-0aa6-4ae1-95ee-c9036f5f0981", "value": "PaymentCopy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ffd6b45-9b49-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618202420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618202420, "uuid": "c3369182-e659-4a7d-87b5-1a596e101563", "comment": "Malware payload (Loki)", "value": "ae5171d247300b60deee82a19ba722a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618202420, "uuid": "db2a6dad-c788-45f7-ac5b-ca00b1687274", "comment": "Malware payload (Loki)", "value": "f1bbcf7510257ce1ad2b9fccd54ae58da63f94e63645ab0003bd99d5541bd6d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618202420, "uuid": "135808a1-0321-4aad-89d0-47fd69badf35", "comment": "Malware payload (Loki)", "value": "880d992dbb6daf11d23386e31faf147251dd8284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618202420, "uuid": "50ab4430-1294-497e-a8c2-4d42cc098572", "comment": "Malware payload (Loki)", "value": "2ffbc7201db7c26f518ea0a80be853defe018503314378c2e4598fc73bc70ad2d3777c0e9f8dfb236699accd723d8f90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618202420, "uuid": "faed2be1-b4b6-4340-acc3-2f48c5fbb192", "value": "2815BEAD3560789FC857C976C9A81C70AA617C76131B964390E33EACB93D98BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618202420, "uuid": "6b0ec5b9-35b3-42a1-9c82-58cfafa94c56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618202420, "uuid": "e5e8d911-c14f-4d9a-bdde-362ac5f4c9f7", "value": "24576:nLjviW401PL76ouEylrLfkFtYd80SxGwtAf:3xz52FfkodYG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618202420, "uuid": "303c8860-5180-40f3-bae3-4a716d316c20", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618202420, "uuid": "1ea5182f-d834-4d9e-ace9-4c746b298871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618202420, "uuid": "180e640f-e3c2-4e8a-9969-6da1b2bfa220", "value": "List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d977e9-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207901, "uuid": "f1a6fb06-1b91-4d1d-9cd6-480231212e83", "comment": "Malware payload (Formbook)", "value": "0b932082fc1d4dcc94f35ea02c387663", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207901, "uuid": "389af652-b89e-4d1b-80a7-57bff65a98b1", "comment": "Malware payload (Formbook)", "value": "f1e85b9f7b1c2a6ce9da528dbfe2c66f0a0f513f39411dbf7bb7d4d917e1ba99", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207901, "uuid": "a028d18c-029e-4f49-90de-2d53bb9fa735", "comment": "Malware payload (Formbook)", "value": "2905ae070e38f93b707e3b7ddc04ee77547aa462", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207901, "uuid": "9b0e6098-53b9-4635-ba40-52a790b1b1ab", "comment": "Malware payload (Formbook)", "value": "8af6fd631ae0cf9e66179d7e79431bcf16f32d5e0a07e7fa12de610e643bfcaa66c19cecd189f829f3af10b60d57a8ea", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207901, "uuid": "7b7d5466-1077-4292-a6b3-d700cafb7030", "value": "A045D02633C51BA5E03CDB3592F4159813F1A60BE722E71E7D8D12DC8F12E8A5623B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207901, "uuid": "4ac2c4cb-6ff5-4637-9c7a-d5ebda357998", "value": "6144:F+WMzqqB3/NB3QJXPp5owioG2lHBRsuUYdN+fDCjTqTpWxV3C+7Gwh11jNrrh5:sTzqqB3PQhPp5owLG2lTmYfGTubbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207901, "uuid": "59f24fe1-361b-4bfe-97ae-17418011d068", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207901, "uuid": "ae23aef3-cf56-4810-b8a8-c0105d8dfd15", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207901, "uuid": "80d2f771-39ff-4b90-8af1-3a4234f72a48", "value": "RFQ \uacac\uc801\uc694\uccad_\ud574\uc131190918.docs.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea55b3d7-9b3b-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618196720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196720, "uuid": "8169345f-3bec-424c-ada8-2f5015050444", "comment": "Malware payload (NanoCore)", "value": "0984d8481d809d2715214d220d5f3224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196720, "uuid": "74c8491a-a04c-4e24-b783-91ac0c832961", "comment": "Malware payload (NanoCore)", "value": "f2597b91433ba86188dd0e53cf04d2c43d97f5231bc3077df18e75447f15c77c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196720, "uuid": "917435c6-6066-479b-8438-8688fb7af9d8", "comment": "Malware payload (NanoCore)", "value": "be4bfdae28308590b04709935794109a77d5ecee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618196720, "uuid": "9e859fd3-b4b4-4052-ac3b-b1a7993aaecd", "comment": "Malware payload (NanoCore)", "value": "2959f8088203432619f479c445f5db9487cc2025d16b7bd6a173e1639d5091c14d5ec4d9cbb17d5a7b8bc46429f0c09d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196720, "uuid": "93ed6df7-08cc-4b92-85bf-7710e2115339", "value": "FD251202FBC248B2C4732A325A297711693C7E202F35DB5FA3D5586EDE764816624FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196720, "uuid": "f43ecbc1-c6b0-45e4-bc18-7a637947d8e0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196720, "uuid": "b8c1221b-9273-46c7-8915-c9cba80f09f5", "value": "24576:BAOcZpJdk843dd0aChdB45NNgo0UBXUUHhh:bIr4tWapHP0Uy2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618196720, "uuid": "d5960e0b-cad3-45f3-bb15-dc9f25103087", "value": 1020808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618196720, "uuid": "cb9412f5-ac4e-4eaf-b4c6-4779973bd2a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618196720, "uuid": "0ab47475-b7d0-4cf8-b338-9326ef623484", "value": "SWIFTS.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd07127e-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618207408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207408, "uuid": "b6c34fe4-9814-483b-81e3-f47291786a3d", "comment": "Malware payload (AsyncRAT)", "value": "123d159654268fbb7e96f7c320bebf2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207408, "uuid": "4469df5e-816e-41d4-817a-aaa61b21bc48", "comment": "Malware payload (AsyncRAT)", "value": "f260a0bf7b7758ea935f6877d5e972b0c86139c0d9fd57bd988f575528e5e28e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207408, "uuid": "15242bf5-5cbe-4bd7-bb6e-ec68fd6da980", "comment": "Malware payload (AsyncRAT)", "value": "44ef75862fe15245ecac0e954fdef9d4763ce6e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207408, "uuid": "f9ecb223-9049-4ff7-a5aa-b374342f11ad", "comment": "Malware payload (AsyncRAT)", "value": "5a4fc2ffa2af2ad0631f0e6ed38dc2ad2e24280d47a4f6c5e5cf677b6150d6c36de7ede58ab304eec8bbf75d6d301bd1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207408, "uuid": "b93fa582-68f2-4ddf-b2c7-766ee8aa53e8", "value": "39017D39A73405E37460FE9616D118A8DE6AA9E703DD62240270D43698FC2E66D82093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207408, "uuid": "d87089d6-e598-4e1d-9940-0bed076942ce", "value": "12:recChhjUQZTBDvBHodSOBLynPFhyRnzTcg3TMjVoa+lNmY/OIsGOPP:icCXUQb1HdO0niVzl3TEh6NmTIUPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207408, "uuid": "77f02ae9-79b2-433e-a83d-9652772e3dd3", "value": 711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207408, "uuid": "6cc76bc7-09a1-4fd5-824c-103280a1d9d7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207408, "uuid": "54cd8996-fbf3-4e4a-860f-5d081e4b130a", "value": "Statement-ID13698020970.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421ac93e-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618214476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214476, "uuid": "ba7ad648-80a6-4377-8cff-a1295142b0df", "comment": "Malware payload", "value": "b7bf7f53b5255c5f4ea7d17e71cf53e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214476, "uuid": "a2c044f5-8965-41fc-9073-7b90205d1f0d", "comment": "Malware payload", "value": "f27364f301d24e7259772110bbb29bae3ac7956a0fcbbbf22742d16aa296ff24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214476, "uuid": "cf4360cb-2992-4e20-afe0-291def445292", "comment": "Malware payload", "value": "697bc4461ae62cd20a77e042785b0179f0a73c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214476, "uuid": "9f9cbab9-f504-4ccb-8a4e-56ce218fea18", "comment": "Malware payload", "value": "2719de4166f7184d101c3744e52af8b98190916cf95d5a779d94321b420a3b3093a57eae5cfd94cfd42345fc65acd468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214476, "uuid": "c66a4527-75b2-4951-80f0-10a545229baa", "value": "92524B42ABC4D13BFC7D073D6CF2872423B0BE556921DB6D49A5747C6E2234946C2BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214476, "uuid": "d84c479b-c5bb-4e6f-bb59-9bcdc0241e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214476, "uuid": "450169d9-c1fc-4635-8568-c3337b961f61", "value": "384:m8E4/W8KhrEuVKYqGYuFrMri7C35XsXoXcRK7J:m8E4/VKKuKdGYuFh7CJcYMR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214476, "uuid": "b77e4fac-5f77-4ea4-8d38-aaf39040d001", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214476, "uuid": "70f3e7ce-02c1-4c8b-a934-48745ad6e4f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214476, "uuid": "da0a5ba0-9118-4af0-ad1a-65a55f350707", "value": "b7bf7f53b5255c5f4ea7d17e71cf53e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bad912a-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618207164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207164, "uuid": "451ebed1-7b50-4005-a3f9-73c36b1526f1", "comment": "Malware payload (Formbook)", "value": "2973a3161310e3244ba9e56b0562a645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207164, "uuid": "98e32427-eaa6-4df4-a382-0f8e36f36281", "comment": "Malware payload (Formbook)", "value": "f29b8badc75280d2613bae54d42df463a97aec3fdb26e4c5a746f03e403ada61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207164, "uuid": "fce37e13-632e-4a15-9879-87686ee27b6c", "comment": "Malware payload (Formbook)", "value": "3fbbbb5c0af76ab01a0fc6101d0c343a22ebb0b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207164, "uuid": "5c02928f-796f-46a6-aaf4-e71cd93f75e6", "comment": "Malware payload (Formbook)", "value": "89fe59e0764a15925c2fbeec5394aaf386132e7546c71baf8232645c3ff75bd356ef42a69f88a51b8696dfe6ec415443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207164, "uuid": "f0a27e80-6d93-4ed8-a8cf-8a4772020adf", "value": "EAB4A8D1F1908CDAED6B09F1BD2BA5302497BE9C54A4410C569EBB1B76F3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207164, "uuid": "a620329a-eb06-4829-ba00-1db8b0bdfb04", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207164, "uuid": "16262fd0-1ac8-46b1-b1cf-863300bebd8c", "value": "6144:1dWoMy7GHKp+MFop+5u7iwCQ3cwpMaq/P4nOaYWk:WetpfG+crCQMwpbGqxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207164, "uuid": "7a666c72-780f-46ae-8043-50cbaff6bf5d", "value": 524004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207164, "uuid": "2dce89b2-bef4-4343-9570-c32bf098ea9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207164, "uuid": "99082400-5ae3-4e9d-b717-fe678cc3d9f9", "value": "inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf96685f-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208701, "uuid": "eee5772f-a014-4d04-a14d-c246e6d61c68", "comment": "Malware payload (Formbook)", "value": "cd20bbd3e19a80fa77317cd2c42facdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208701, "uuid": "4620a973-27a8-4393-9898-0831877595a4", "comment": "Malware payload (Formbook)", "value": "f2a1b48f82208d3d1bf4e613fd7c6a16f63c96ebb2c31ed502ec67cb6768b2f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208701, "uuid": "b8b4addd-91df-4c97-8fc2-2cd0fa931b8c", "comment": "Malware payload (Formbook)", "value": "41f9e2ee597df731ccd379c7e2a393fbafdbf6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208701, "uuid": "9c57740f-2d56-461b-9b00-4294f1fa7dee", "comment": "Malware payload (Formbook)", "value": "c7bd4f400919d43868b894051b7fdc6f5225f853963fc3f9ad1467d1d06d596cbedcc65e353f766b78a02b2b03bafd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208701, "uuid": "557cc5a0-0460-4980-9106-63c860f28380", "value": "CBF4AE21B2D19437D12E4639ED2797EC982AFE10FE64D94A67F80C0C5F383517E6A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208701, "uuid": "c791d677-fc7a-4b55-92e5-341c80b6614b", "value": "23399c21b0aa604a8aa13da9702198d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208701, "uuid": "9459445e-c40f-47b7-9847-ae58bd155fcb", "value": "12288:XjsnTVNRUWpHKTXa8+XBM9gN4W9t7ocLyg0c0fKRmp:XjMmMH8XEgfqFDd0fK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208701, "uuid": "e2cfc0bc-1e5f-43fa-891b-259dc0831fb2", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208701, "uuid": "c8ab6bed-f756-4288-800e-f12005cc1552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208701, "uuid": "53e09526-74c8-4af4-bea1-361db8d2d35d", "value": "12042021493876783,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4e67a4-9b73-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618220585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220585, "uuid": "e198a399-16fb-4e5a-ba43-9e636b179388", "comment": "Malware payload (Loki)", "value": "1a13260f260afe5b51cfbd662bfac40f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220585, "uuid": "23dec44c-102e-44f0-9641-a5e9b3f8575f", "comment": "Malware payload (Loki)", "value": "f2c5b3352fc0a3c6869523bb8b43d1f009c46f52d7cf517861e0c32fb06b1560", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220585, "uuid": "d1256da7-6a25-4555-af3e-54a0ef506832", "comment": "Malware payload (Loki)", "value": "d991ba251c7638dd19fd88e90b26f2bcfde7fa4a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618220585, "uuid": "19a411ec-a8ba-45ad-8fe1-df874c9c595e", "comment": "Malware payload (Loki)", "value": "8d92d6cd758fb34e9dafbf324bf669dce2e6dd51f364981e112c0a3db2d8b368af0c0ef497c731f3934ba16b67bd72e5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220585, "uuid": "44dcd84c-dcdc-46c8-a350-481f1e70ba67", "value": "4554AE0173D0C033C44325B98924C7F59EBEB5711A6AAA8FBBD80FBD5F256D1A32534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220585, "uuid": "2921b83a-ebdd-49c4-ae14-12fa6e6a2251", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220585, "uuid": "4c6569a7-78bc-45b4-8558-f13f71a0db24", "value": "6144:QsYkwgLfrNUzuVjKofUmlTQ4pV3BzPnJ34:RYkVwuVjcoTQ+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618220585, "uuid": "9e3adf73-d420-4db7-8e46-76aa48f0f709", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618220585, "uuid": "d9e338cc-ce1b-4c80-88a4-5d3eb7bf0199", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618220585, "uuid": "5f2c58fc-109a-4bcf-89e6-d7f6f9505f42", "value": "OPEN_2021-04-12_06-58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53142d13-9b95-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618235121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235121, "uuid": "89c3be8c-e816-42a5-b5f1-49ad0a01f553", "comment": "Malware payload (Formbook)", "value": "688a80f956364e2d3937b973c41cfbb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235121, "uuid": "bd84a843-7d59-4c39-b30b-ded160ee8c69", "comment": "Malware payload (Formbook)", "value": "f36d0fe551b2be41e023f6a55d35ffb3ae7a5e021703c4b49235e04e296aceb3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235121, "uuid": "56be322a-cdd4-455f-9da5-5632d00083f5", "comment": "Malware payload (Formbook)", "value": "a64211b8384db8652a90b64038ceedc198a1c35f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618235121, "uuid": "054becfa-3abd-466d-9c3f-cf77c876bfac", "comment": "Malware payload (Formbook)", "value": "b965b0c52b88910417f9087d49f91a9aba6d1b2107908daea6cd1f08f1f7b6f5508a85b3e9e6e5cac7e3d4443457a8d8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235121, "uuid": "47cf5a6a-8010-40a1-b007-06a437eef8bc", "value": "C784CF1133D0C133C05325798516CBB68EBE743566656A8FBFC90FBC6F296D1A72A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235121, "uuid": "2506d880-6619-4b1f-92fe-178bec8cba7a", "value": "1c198acdc88e6433341d82c12cfad0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235121, "uuid": "9e9e6612-ce89-4b08-93d9-566eee6c9e4d", "value": "6144:udyAPECLp4dK/eNvPn7JhCDQ9RTatK5DQtwpEpEywGvUnek:udyAf/eNvP3CDQ9RatCDyw2we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618235121, "uuid": "04ef140c-9435-48dc-b63f-ba6df3290516", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618235121, "uuid": "a04fb4dc-d397-4034-be1a-312cb8811ffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618235121, "uuid": "4955cf8d-cf4f-4a93-952a-13cc94d82870", "value": "SecuriteInfo.com.W32.AIDetect.malware1.17659.21832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2df86a-9b90-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1618232960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232960, "uuid": "5eebcc20-b547-44d4-b06a-3e4f9b4595e6", "comment": "Malware payload (CryptBot)", "value": "5e3189812e802c0fd68ce592cb1e1999", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232960, "uuid": "16ae44d8-b15d-406d-abf6-b44cf0c7cab3", "comment": "Malware payload (CryptBot)", "value": "f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232960, "uuid": "20770689-7ee7-46c5-9e6e-647010ca6e43", "comment": "Malware payload (CryptBot)", "value": "38552111d3001f4998ab85408601873897653360", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618232960, "uuid": "9f7d71ce-b12b-4ad4-95df-57779716780d", "comment": "Malware payload (CryptBot)", "value": "ed782dfc6cd87d371a7fa4de29500e69f6fdf2682f159bd4d11c9c04390e1fc22dfb8d006d4d41508d7a6529de4e8a45", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232960, "uuid": "671be31f-27ec-443f-adea-da25414ab1de", "value": "30F4020132D0C073C05364B6451DCBB14EAEB53156BAAA8F7BE80BBC5F697D1AB2531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232960, "uuid": "1f2dce77-735e-4f56-b2c9-08ee37f331a7", "value": "4cc8b588252cad91c39726b15504331a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232960, "uuid": "9a5505a7-07ea-45ee-a2b7-9cfd8020f1e0", "value": "12288:hDTY0MImKSz4jaZb47XE2DUNLgjgV5cWdoGAM3GDoaCBdBaMDKif2QhR2I:dNMIOz42qDEbBV5RJ26DKO2JI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618232960, "uuid": "8eee0c5a-3ebd-4a1a-990f-ef9514e8a0e1", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618232960, "uuid": "68d6ac35-31c5-4e74-8b26-a15384b52fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618232960, "uuid": "1b7cf039-4713-44dd-92ce-2b9fd3f7d6ce", "value": "SecuriteInfo.com.W32.AIDetect.malware1.24453.7436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f054d2-9b52-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618206376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206376, "uuid": "7981903f-695f-49a4-a1e1-848d38aa7c2e", "comment": "Malware payload (Formbook)", "value": "5ace0603aeeecdb932d105a903adabe6", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206376, "uuid": "f86f158a-61ac-4b10-bbbb-9ee3bfa1d0ec", "comment": "Malware payload (Formbook)", "value": "f4b5cbe828fc942e2a9bd26be396f80dfca78d999fe637005e2b89b8f38d779f", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206376, "uuid": "b835b19d-f384-40c4-bcb2-4254ae2ce3bd", "comment": "Malware payload (Formbook)", "value": "bd0f1cb0226496110546a8a08dec52eecc82bd0c", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618206376, "uuid": "454e8ca8-9b13-4630-bb2a-0df31227f2a0", "comment": "Malware payload (Formbook)", "value": "adb12e7180794c0bea1dd9827f1dfb73cb966a90dad829ae1536ce05a07c1b1f7fdb44425194d8bb636ab947787f7e3b", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206376, "uuid": "e845bb6a-bfa1-474e-9220-efbeeb922128", "value": "A7B423944C428FE81B8D1EE6CB327EB9CBC7182813CD4D28E19C3635D467DDE096AD65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206376, "uuid": "cac8b281-6976-4362-98ec-3ce43534ed11", "value": "12288:4IjY3+81rg6jkKoKJY91e1X7oaDRc5P6iWKf1QXe:4IsO81rg79A1X7otVSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618206376, "uuid": "d876a6ed-6ae9-444c-9312-44ca2385eb95", "value": 513490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618206376, "uuid": "8554530a-d66d-4d88-966e-3fb65c527cb1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618206376, "uuid": "c602201a-0d0c-42ce-a981-54d3c2b8441b", "value": "Account Confirmation.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246a1d00-9bd6-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618262960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262960, "uuid": "367b4a40-7481-42fe-917e-905e148748cb", "comment": "Malware payload (AgentTesla)", "value": "15387202144436529e206f153b4b4b17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262960, "uuid": "0ec55415-46b5-4f29-938d-5c9844b8cee8", "comment": "Malware payload (AgentTesla)", "value": "f4de1de6ecdcccbce91e2a49581cd5c8d56f603ce64abb954672be1879d69de3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262960, "uuid": "f8196ca7-7103-4d5a-9eba-b4fb0679aa9d", "comment": "Malware payload (AgentTesla)", "value": "d806bbff85f676e2227f36794427729f94155496", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618262960, "uuid": "acbe88bc-9b37-44ce-93b4-fc95169e5f48", "comment": "Malware payload (AgentTesla)", "value": "0cd6d6acd1e2f93feb5af492bdf0c5013d4c5209067382c02b46e5cfdeea73f5b89356128a4de5e9e5731ab24e3424f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262960, "uuid": "ce1c6b63-9d87-4015-a584-77def8cb5b37", "value": "5FE42381C3678E25DB00B9F8F44F9C1DA993D3C5BD588ACD7B33829BE1BA11611518D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262960, "uuid": "524373e6-4940-4a24-a1c3-5bdc1a255425", "value": "12288:A8kW1KayIUVoZywS6nwwdswkuuhATBSYtS2TWZEvEjMRmQdFQ1Dizi:A8zKhL+ZywS6wZwkEBScWZEvFRmQd0Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618262960, "uuid": "7a9643b9-a0dc-4df7-b614-0a91aa51f2fa", "value": 711494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618262960, "uuid": "19ae2fab-14e0-4366-b929-d00d99457461", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618262960, "uuid": "4f3e4d93-46fa-4db2-93e1-22a8926ec6e7", "value": "NEW_PURCHASE_ORDER.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b6a135-9bac-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618244871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244871, "uuid": "1ce6c2f4-1848-425a-a624-612a9c3cb8e4", "comment": "Malware payload (AgentTesla)", "value": "481bdddcf99b3937bc2c3da969f3d5ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244871, "uuid": "0cc7e895-4687-45d4-aed6-a3d313d8bead", "comment": "Malware payload (AgentTesla)", "value": "f504b54dd812075b7a4966d0d5a2246c161b62f9290e71dbb4e2b96bf2cb477b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244871, "uuid": "a1386b83-2476-4a8c-95b7-a1384d0a2adf", "comment": "Malware payload (AgentTesla)", "value": "f1b6c7628b924b83b269e01ffa4770014d795391", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618244871, "uuid": "701cece4-77cb-4dd2-a506-db782ee30f24", "comment": "Malware payload (AgentTesla)", "value": "51ed3de4cb641f30f02c9c56b053ca47fd9d4ba9f40fdadae3b7a0d9ea9809f5147d12a946b07a16ba9a6ebcb267f8ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244871, "uuid": "eaba48d3-70f4-488a-90ed-556193587282", "value": "93D423BEFFB369CF10267F85019D95678BA12608B1343B429C7365AB435B2CAA011D7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244871, "uuid": "c075bfe9-12fb-4b06-9c70-5412d877f518", "value": "12288:cfPP0d3HPQwnZb6CRYXEHL2d0BqetH3bja1AbUtEjzN30N1T:o3KHownROEr2d0B193UtgzNEvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618244871, "uuid": "2924da06-0322-4efd-823a-d241e7b1b6f6", "value": 627570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618244871, "uuid": "6b661c84-3013-4fe9-bce8-88b9ceae3d4e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618244871, "uuid": "6db66f04-a0a9-47ee-a206-09e5093a2fe4", "value": "PROJECT SPECIFICATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25051a65-9b57-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1618208415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208415, "uuid": "f6d060bd-2e06-4e72-ad07-62f6b835358a", "comment": "Malware payload (NanoCore)", "value": "60c423711d537751bc90e037100aff0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208415, "uuid": "88c78598-d97d-4b3a-adc3-ff0f3d73c19b", "comment": "Malware payload (NanoCore)", "value": "f57a18111a889d227696128ef7486897b7c35f2f81db4c6c930263786bbc2852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208415, "uuid": "faf6d2b4-916b-4061-849b-5e529c38f810", "comment": "Malware payload (NanoCore)", "value": "ed0afa5c41f18c5c61866f2e097acbd091190037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208415, "uuid": "a8b065f6-0234-4b12-8678-1196b1a6de0e", "comment": "Malware payload (NanoCore)", "value": "41925c520071244c09c6d5c8a945b274c1f28c69fba90214ef006634ac2bd19191fac336e97d8e177ed6e542c593453a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208415, "uuid": "17862e6b-1cac-4cf4-9a79-2ba8ae4cedeb", "value": "D1E4DF102EA905C9D5ED3AF01821818107BDAD123BE6F71CEFB435A95A72633DE60B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208415, "uuid": "f554ad88-ba2d-49a3-babc-0985460af815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208415, "uuid": "a65e8385-9585-4071-89b4-562d44e18959", "value": "12288:PA1VAO6pPeZvyhDaFOrfY79pi2A0BvCEiMjVQkz0YKdOqLD0yqYlU:PIAO6pPmYaMQ4QCUjVQkI8w07uU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208415, "uuid": "228e722c-dc99-4a29-a293-810d2830f73e", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208415, "uuid": "e59ebac1-c6d6-47df-9a8d-91821a3df1b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208415, "uuid": "503733eb-6e63-4680-bc45-a246df9bf0ed", "value": "60c423711d537751bc90e037100aff0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7d50cd-9bb2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618247540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247540, "uuid": "382913dd-0e66-4a64-b686-4811ba4e98e7", "comment": "Malware payload", "value": "6c31bd9a699b8cfbe17bdcd6d83bd427", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247540, "uuid": "13b5a464-d821-480a-8e9a-6e1ac9515113", "comment": "Malware payload", "value": "f57fcd2b9424dafe82133f9a4646b7b53ddb55676bc50070ed0668f5da9d5c68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247540, "uuid": "a31727e0-60dc-4108-ba9b-151090796e8b", "comment": "Malware payload", "value": "2c803606b88254b5f209de7f66364ee5c81c1414", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618247540, "uuid": "97ffe998-6a73-436b-8a9b-5b0eec3be7bf", "comment": "Malware payload", "value": "2d822126aa0dbc40ccfabbde769739e9557cd9fdf360338cfe896f03828e47b07f071aa03a42a4f5a31d37374467a2ab", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247540, "uuid": "d5cda94f-f2c0-4922-a94f-5cc762e089c3", "value": "1F04123CD0264D59C2E5843BCC588146AC2A2063BDFC65BE76987994EE237F31F2B744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247540, "uuid": "838dc1a4-6757-497c-acba-aa6ba6093a34", "value": "3072:vXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDG5:PE5SDvbXAyHbVt15wTQDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618247540, "uuid": "716ed490-2f52-4aef-b868-8aa794b16ca5", "value": 174329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618247540, "uuid": "217df323-f229-406c-b52d-2462c7be8fe1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618247540, "uuid": "7ee0e0fe-b913-43c7-b4a1-073f388d1f0b", "value": "Complaint_186157059_04122021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4272f302-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207175, "uuid": "9d2471b5-dce7-43b4-8d14-96cf7635ab03", "comment": "Malware payload (AgentTesla)", "value": "e067efaf888eacf15d74ac662aa9cd8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207175, "uuid": "6eb8e99f-67fa-43cb-953d-896be4a0574e", "comment": "Malware payload (AgentTesla)", "value": "f6017ed11ff6c9a3830b3cd6a81ae2ea96dc51c3603129e1edca63eec57dae3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207175, "uuid": "2af331d6-797b-41db-96a7-f95bd79b1d2b", "comment": "Malware payload (AgentTesla)", "value": "61af23300239f7b1ca61392879fa1698bbcf14fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207175, "uuid": "7fa948c4-41c4-4a8e-b880-74058280b956", "comment": "Malware payload (AgentTesla)", "value": "0b6ef1b2b76b3a8048859c6fe33a1efd446c0eed46302c87d14ee75df6ce87be734c2f40ca6615bc9f9ad72a83d39f60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207175, "uuid": "a352ebd7-7cdc-428f-88a2-fb007f9c00f7", "value": "8E8423385FD270177E4E50E587B35E9033A7AC2CF98265109E254FA6998F84061FEB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207175, "uuid": "c225bbc4-9434-410a-a252-b83686bd3f4d", "value": "6144:oewYTltoB4iaSo2BfcDRnN8+gZC9leJSN0omn6D/xjiU3cZ1HxJinaIffl9AM7eR:WYBjrWxRXZ+luSKQI1H2na4lVeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207175, "uuid": "c85a4cd7-97f2-483f-8b44-e3c2c5870c2f", "value": 401102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207175, "uuid": "7fe3c68d-29a0-4e19-9fa3-6e1a22bb52a8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207175, "uuid": "e772ef17-0dbf-474d-a56a-fa39d75ae287", "value": "APRILQUOTATIONQQO2103060_Hangzhou_Zhongniu_Import_Export_Co.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32029c7-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Heodo)", "timestamp": 1618214693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214693, "uuid": "cad0e6b7-0a58-496c-b53e-4f5437f06f46", "comment": "Malware payload (Heodo)", "value": "7b8cec428653a5a825830748cd6426a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214693, "uuid": "5c6bda2c-61e7-44d3-9411-f54c00dba932", "comment": "Malware payload (Heodo)", "value": "f60284a15a48a371bae8ac4adc43cddfdb79e6150ce03f620d0cce8aec441159", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214693, "uuid": "016c9bad-4a44-4b92-9b95-3f69840ae75b", "comment": "Malware payload (Heodo)", "value": "21cfd322a5f629a242a53511ea7f3a305dee209c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214693, "uuid": "0f1dc78d-82a2-4792-805a-7b40c0a84fca", "comment": "Malware payload (Heodo)", "value": "8216007d468a1fe35001086507b0ff2c9bbcd7d8c0cefeaedd9c579e7974878614fe46340ea8b5a19583862989527a0c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214693, "uuid": "8b9e8d68-f275-43f5-bcc6-4593f74c34c0", "value": "8BC4F11173E0C033C55724718526CBB45EBBB47119AAAA8FBBC80EBD5F297D1A31634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214693, "uuid": "bc170bb9-dd87-4966-bb1a-82aab8aca96c", "value": "6abcd353ab9736efc91a9e17dd2f8b32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214693, "uuid": "bfef5896-8910-4fa2-9c68-b649d365df15", "value": "12288:NoEdDUokeYkljLEuTwVvSrLTQ3IAkzounyvWGNQaUTlvEhtCgD:NfqwjLEuToKxoTWGNQhZCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214693, "uuid": "f5470239-b09d-4bf1-9ff1-a723fa0e74ae", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214693, "uuid": "ccb5e972-a83d-4aa8-b6b3-45d52d46abbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214693, "uuid": "b767ec16-9c26-4d36-979a-09c4d8a90c5d", "value": "SecuriteInfo.com.W32.AIDetect.malware1.7728.31390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba436b97-9b62-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618213389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213389, "uuid": "7c319c8c-36d8-477a-9c05-9c64a4779b01", "comment": "Malware payload (AgentTesla)", "value": "13ee91bb32b8af90f1a168cb75a6110a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213389, "uuid": "d69edb1b-20a0-4766-8413-99ef88e47967", "comment": "Malware payload (AgentTesla)", "value": "f6a8163b680a0e66e368319d353a9b6f5bd83ecdabc2299e51b1881fe688f204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213389, "uuid": "afc04b96-8d48-415f-b41b-5c85f625e9a9", "comment": "Malware payload (AgentTesla)", "value": "5a5b86b1c6934acd760f38a873030a6ef3a5ccaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618213389, "uuid": "f66a77c9-b5ac-45bb-bf6a-b44828de30ec", "comment": "Malware payload (AgentTesla)", "value": "bacc025cb81d4d2e5c479262f1b2f3548ff7d5a5fb82d0f0d0c81c561dfefb709efac7a4c5cc77fc82fb7bfbf00d83cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213389, "uuid": "a91e094b-d593-482a-8e3c-9a5490b15f5a", "value": "5ED4BFBC76047DD6266F576FDE96ACDD03A627239ACBA4CC8064B7C305A3375EE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213389, "uuid": "34e34183-2c5f-464c-8981-dcd92e58da01", "value": "12288:Af3InLfYKqsquL9r71d9NYwN83GHKvg+wv3PZze4+C+2ahcT2qBVoK3tO0K:s3InBqhsNYcHX+wv3xze3C+lhSdXoK3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618213389, "uuid": "ff4411b4-5517-4894-bd7c-77948e8ec2b6", "value": 599581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618213389, "uuid": "aa286495-264e-47ee-be5f-09f02e996b82", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618213389, "uuid": "0c27941c-d058-49a6-9466-a078ccf30e7c", "value": "01_Enquiry Form.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c4dfb-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618253308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253308, "uuid": "dd29a1b8-0b5f-44f2-abbe-844732197af2", "comment": "Malware payload (AgentTesla)", "value": "daa83e1f048e5f995f50efe34b9d538b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253308, "uuid": "779ee9c0-c43b-4613-9ed3-c234531bf20b", "comment": "Malware payload (AgentTesla)", "value": "f6b40a9f7994dce755f76caea85e0d283cfa671d7b508729d6a70a4fe092b830", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253308, "uuid": "9aec54e7-fb83-4181-b786-877bbca1001c", "comment": "Malware payload (AgentTesla)", "value": "198b2dd1a98af7b5490c5eaf4fbbfacc2d084330", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253308, "uuid": "a71b79d0-bfe3-4b86-ac2f-beedd81f53b0", "comment": "Malware payload (AgentTesla)", "value": "23b1d925f5c44e72beb6ad37462470fca5f7e039924191ababf8dc2293ada3574539a0ef3a535e8f9cd12bf887836c5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253308, "uuid": "e1109a5b-4b04-4faa-9a4c-d74fc5330c21", "value": "9D05F02562D4881EC4BD1B7558A1170C03B1BC146623E6D9B8EB307A2E7F7DBCB2635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253308, "uuid": "a4b305ab-ffe9-4d9b-9bce-ca335db2fbc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253308, "uuid": "c0bc1b54-bd79-43d5-a12a-b1f404ae60d9", "value": "24576:HUOUAaiKP4fpOTGQIqwG7GLMH2GSmMHvKomWZv:0OUAaiKPa0GQIq7H2OMHSBWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253308, "uuid": "96417715-0b5e-455c-9cd8-decc87a6f996", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253308, "uuid": "5cec0523-f1fc-4496-8390-0b605fe78e07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253308, "uuid": "652c1a4a-757d-455d-855a-3af4e03cf44f", "value": "daa83e1f048e5f995f50efe34b9d538b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a70e516-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1618208048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208048, "uuid": "6f7d06c6-ef7e-469f-b906-64f1c5da6111", "comment": "Malware payload (AveMariaRAT)", "value": "81dd489e42f29b03815d2533e8e89b94", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208048, "uuid": "7bdf7c43-1162-426a-8a51-8ab7570839c6", "comment": "Malware payload (AveMariaRAT)", "value": "f72c86685e49999377ce344c9fa547abb9c7fa979f68bbc0e9a7bfe28aee309d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208048, "uuid": "a7c68aeb-a80b-48bc-b8bd-f39b598d253f", "comment": "Malware payload (AveMariaRAT)", "value": "a379c3031448a4ecc9e42816912f5328cd8ca467", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208048, "uuid": "ee23c00f-a4df-4e72-aae9-a414f9013224", "comment": "Malware payload (AveMariaRAT)", "value": "5e06cd9fc8f95f59ed41ba847a923027637d419b5f8a350d7920803b58b4d9b666dee1c7def45ad1c42c7500c98c24f3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208048, "uuid": "9ca7ea91-776f-42cd-8c98-ddae0071aa94", "value": "A4E442E453DB87ACC21265482884F6851EB2F55A30F50D60B37E84B8DF48EF67F88697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208048, "uuid": "a363c334-40ac-4f31-ae4a-64ed7a2f0ba8", "value": "6144:csKIoEpE4v7KDKkv0SHU85kPcYqZ8PRhOuVcVpSFp1aYdzFDWRDAUwI:csVgSFpndzFKRsUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208048, "uuid": "a69b56ad-a743-4988-9887-10e89729fe25", "value": 713276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208048, "uuid": "a68b1671-83dc-46c9-8305-6be5157d5404", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208048, "uuid": "43733049-64c8-4fab-94bc-ac8658a8cf74", "value": "Pago.20120412.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72836682-9be8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618270822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270822, "uuid": "19af5621-2e78-4e31-bb25-dc68230213f2", "comment": "Malware payload", "value": "843d260163d0143c4feef0fa3c54e63e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270822, "uuid": "de6e3832-8977-4e27-ad97-db785224ace5", "comment": "Malware payload", "value": "f81e70dd7eb0fa56a4c392c00f3552857a39b53222f0def135bf57c4cc0ef1d2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270822, "uuid": "0fe4077e-c151-4500-962f-33354f2e318d", "comment": "Malware payload", "value": "5b3df2d725883705d64d86593f8310241922a6e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618270822, "uuid": "9140e1b7-44ce-4773-b074-825d418b50aa", "comment": "Malware payload", "value": "0d3d8cfbe27d9c35a8ef77cb7108f973d8335cab8bdaa8f1879bb97cb71760b80d2bf20ea4c075ba6857880ea21ca76f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618270822, "uuid": "0d6b27e1-bcaf-4544-bb43-12ca762c9c9c", "value": "AE538015B797C963E0595E368EE2D6CA7330BC22BE90830F318A732F2E7B5508D02B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618270822, "uuid": "eab10fee-9e43-4a2d-b87c-db64a94e712f", "value": "192:7BKU64Zm3WDWQdDTEzZoFMNyKsnu9mWaxC3nepnoQEgHGXB7HLHYeI:t26DWQ9EzeMlsjWaw3epn6gWBjMeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618270822, "uuid": "49055632-0ca9-4412-98df-99ee51674b83", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618270822, "uuid": "1ad7fc9b-84fd-4282-8839-1a1b13e10e96", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618270822, "uuid": "43d61d64-f7e6-4539-9be7-f017dff31522", "value": "SecuriteInfo.com.Trojan.GenericKD.46081523.30957.16634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0db8bd9-9b55-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618207817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207817, "uuid": "4117f011-3841-4ee7-8c57-c579f8b94796", "comment": "Malware payload (AgentTesla)", "value": "7a47d273c0460153c900490369bd8a37", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207817, "uuid": "b10457ba-5665-4d28-9cb4-1764aee08da2", "comment": "Malware payload (AgentTesla)", "value": "f86ff55c0c4d0561d1811a3651c0a0c7540d05164ddd93ca027fe5ff6ebce9cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207817, "uuid": "3290b39d-17a5-48de-b877-65ead6682a85", "comment": "Malware payload (AgentTesla)", "value": "b310be2abad4382b78697bb41ba23a4fd3106564", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207817, "uuid": "1750e818-b385-405e-860b-f9801fa4def7", "comment": "Malware payload (AgentTesla)", "value": "d67c0d96314fcce67041dead48981b4721729852c8b2a43ce5c7404a4d5028348426101cff9dc6e77ec57523b598ede4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207817, "uuid": "4385ab29-bc8b-41c4-89ce-071394d92d91", "value": "5AF1BE78061DA1A5EAB779B902A50C8CC28F01219DCA9238C95773F74B9FF6046807D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207817, "uuid": "26143b30-d005-4c96-b1c9-f5819cc5e292", "value": "192:3TJ+CfkC6Eo/DOJfNFC9hTY4ZWKhachkutJi+PBbOGqXY:3TJ+CPC4fvC/T1W4acDPBbOGqXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207817, "uuid": "df751a63-b5e7-4127-8100-ed58664e6c2e", "value": 7832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207817, "uuid": "444a437a-6f1d-4931-ad26-6a4c28ce04c6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207817, "uuid": "070fe8b0-5b3c-46fa-9b5c-a44432fdf893", "value": "Re Confirm\u00ffthe invoice\u00ffthe payment slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d10ec2d-9bc8-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1618257042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257042, "uuid": "fe8d92b6-a4d7-403c-8a2d-5f0b55410f01", "comment": "Malware payload (AsyncRAT)", "value": "0c85bb33181ceceb5a0298a591de2098", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257042, "uuid": "fd2731b5-37ed-408d-804a-f5f675464eb4", "comment": "Malware payload (AsyncRAT)", "value": "f876c33374ffc8f409fd6835923ff9917bb6d8da48e188aff68603870b944a48", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257042, "uuid": "17764bd0-2447-49b9-86fc-b474e817ef5f", "comment": "Malware payload (AsyncRAT)", "value": "7d87d590dc2aa1551c554195e34beec973414fef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618257042, "uuid": "e7590683-944a-4675-8f37-cf160374e963", "comment": "Malware payload (AsyncRAT)", "value": "6b09b61acaf5b5a4635e69e20d0852a6e217eedd92e77a73c8713147532f5bb52c43f017b0254545966ddf1b12dddfcb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257042, "uuid": "d4cf24ff-51a7-4452-83db-6bd4070cf206", "value": "FB232B0037E8812BF2BE4F74A9F26145867AF2637603E54D2CC451DB5613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257042, "uuid": "e0073414-837e-43c4-a8cd-522d5ad873a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257042, "uuid": "08cd46af-d014-4e79-82b7-2a3319ae926b", "value": "768:nuyRNTAoZjRWUJs9bmo2qLA4M3dBfJNLPIBzjbdgM3iuQD53Xoz8CeMul/5oBDZI:nuyRNTAGo2b4eJCB3bKMSRnoO2dKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618257042, "uuid": "77480693-d058-4008-8f27-9db5d635114b", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618257042, "uuid": "e69679e9-4cfd-4a09-9494-203a65703aaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618257042, "uuid": "63eedd33-c15f-42e7-a960-2209d18e5e9d", "value": "0C85BB33181CECEB5A0298A591DE2098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732ed240-9b56-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618208116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208116, "uuid": "08a166db-6a30-481d-b451-f479c45c6334", "comment": "Malware payload (Formbook)", "value": "606a47c2bcca98a66c2643e73462faa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208116, "uuid": "4a93d931-0f0c-43d8-b47e-d043eb2cbc4d", "comment": "Malware payload (Formbook)", "value": "f8c3b9a8f01e022158ef5f9bc6d69287b6b03ce5527f7ac911de25dcdc016569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208116, "uuid": "659d21e2-5f19-4cbd-bd8c-690a8ebc7fde", "comment": "Malware payload (Formbook)", "value": "280a218b56747a98ab0eb41c176dbcf812c83a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618208116, "uuid": "8dbf8ecb-9e82-47a6-bff9-3511f34aad05", "comment": "Malware payload (Formbook)", "value": "46699f71a076f868ca14d273f19b6df587a6621c6bb0d0ee036e1c4d809e7d6d09147cddb69200057dd6918be8e01385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208116, "uuid": "c68acdf2-930f-42dc-b153-25011d4989d9", "value": "F8B4A7D1F1908CDAED5B09F1AD2BA9302497BE9C54A4410C569EBB1B76F3342309FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208116, "uuid": "601413d9-68e2-46b7-b76e-baa285da78af", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208116, "uuid": "0fa21a61-9c99-47f6-a86d-4f760da71d28", "value": "6144:1dWojfdw2Kc01ZBuec4j1xOBUftsK6LeA4i:ZfdoDBI4C8Xli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618208116, "uuid": "bd88765a-9c95-42a2-ab3e-2c13cf7aa5da", "value": 524055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618208116, "uuid": "18569476-3463-475d-9550-e94b834a9867", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618208116, "uuid": "571973c4-2ade-4b92-ba9f-76a61667b9f2", "value": "\ub300\ub3d9\ud14c\ud06c\uc708 \uacac\uc801 \uc694\uccad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589233c7-9bbf-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1618253169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253169, "uuid": "42bea84d-eefb-451c-bfae-2276bf8fe48c", "comment": "Malware payload (AgentTesla)", "value": "e35d38740f019cfec3f5e742ba72c51f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253169, "uuid": "5a15d8f4-83e1-42b3-b8d3-28e03f978d74", "comment": "Malware payload (AgentTesla)", "value": "f998078f6250cc31af23470455bd3fb06013fbd65ba7fc74e48dcec17b76acbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253169, "uuid": "bf063dc8-0c3d-4432-950c-bea17fe0621d", "comment": "Malware payload (AgentTesla)", "value": "5af6a86631e4c76095b6646b1b15c2868e003806", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618253169, "uuid": "b925c6bb-7606-4d72-aa5b-da31473f20f7", "comment": "Malware payload (AgentTesla)", "value": "5bd388184bd3876cde6c99646ba9ecc4a053d57709b0d9454dece2fda250d889a7eadd418a93851938cb7a66496d4225", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253169, "uuid": "6bdc7d47-fcb6-48d7-8ba5-ca4941d8f955", "value": "B5D4E1F13D80207BE997A93412DB1735F2F276A36B71988499911CC8C936FC9BD1EA4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253169, "uuid": "e712147b-1868-4a8d-af0e-4cfb55d24730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253169, "uuid": "e17bb253-bcdb-4028-bd6a-c2838acb1a87", "value": "12288:q0m6K299DKNljMaMcH22v1NNiZGHr4XnwTm:qP6K+mvjw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618253169, "uuid": "5585d49a-8aa5-41b0-8c64-5bc285ca9722", "value": 627488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618253169, "uuid": "9825590e-09dd-4961-9f21-d6e8a6849feb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618253169, "uuid": "fda3829f-3e2d-4ddf-bb11-1ce90e5e922b", "value": "e35d38740f019cfec3f5e742ba72c51f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b90b8a-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1618207320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207320, "uuid": "b16bf0b1-e424-45a3-a14d-6ff9086ec4da", "comment": "Malware payload", "value": "3b8439ca9a7a1807b6b54209d5417c2d", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207320, "uuid": "5761670f-b23f-4cf5-b7a5-931a09272d5c", "comment": "Malware payload", "value": "f9d8a008a8850181bd968149fe94f284ed93646abba9e3e4f06a5b36689f749e", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207320, "uuid": "c62c2006-16d1-4a56-bde6-62a10ae4a44a", "comment": "Malware payload", "value": "4ce70e335b492d1f48bcc378688ef79445fd9fdf", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207320, "uuid": "478ad189-a8a3-4973-be5b-c63c060c072d", "comment": "Malware payload", "value": "1d8aa03d383ac4480ced6277f0ef763e62ce2b55e7f539bf9ffa9dbad3fc1b5a36a5f578476862240e126aa9f3fabf7e", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207320, "uuid": "734c8c59-5e6f-4666-92dd-4c4f9ab6198f", "value": "10C4233B4D41D951D7490BFA0B00B4B3868257EFDBEEE8B345C656BB58AD2441F9CC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207320, "uuid": "5a8ea651-8ba0-462e-88d1-9cfd51703e37", "value": "12288:RSdzt5MWwpRrkYQGZjaevwTmsfRae9N3IJfNkSyNeLt:RYz0WwpebR/HNqFw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207320, "uuid": "9f9656a5-8253-4b41-8598-ff9a280f58eb", "value": 566805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207320, "uuid": "d51c5eb7-8673-4cfc-9cb4-06bfc56d1ace", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207320, "uuid": "7c33d858-004b-458d-919a-b99a591ba431", "value": "PO2593.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331e5903-9b65-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618214451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214451, "uuid": "1ca3ddf4-33a7-4ce2-a5d1-63b6e74f3c39", "comment": "Malware payload (Formbook)", "value": "885e567660a28ec23b692291587ef69f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214451, "uuid": "c17df912-734f-483e-b9a3-843f5c3f6032", "comment": "Malware payload (Formbook)", "value": "fb23a007cf696e3c6b119c61b62824abc56b47a7e2f82337e890acc9024bd88c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214451, "uuid": "844a7ddd-d5f4-4272-ad81-76c190ed520f", "comment": "Malware payload (Formbook)", "value": "9e200dd274b4be5df241719fe72f6403938a8561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618214451, "uuid": "421e3ef9-c175-4b93-a033-d77ed698934d", "comment": "Malware payload (Formbook)", "value": "c5b647d8b7dba7f266b03c8b09f61976c688405828af5eeb5c7c106bf6eb01f8ee2bcc141e286a7ee67f0be751f7b154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214451, "uuid": "ff55e4b0-f0ba-4254-92e2-ee165285f165", "value": "9E1501502610CE47D7A847B049A2E6780BF97EA9AF85C70F3DD870EDBB77B684C15221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214451, "uuid": "4dffe1f4-55ec-4a29-9ed4-bd2df5da0f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214451, "uuid": "6d334346-8a31-46fa-8ecd-62e7f39fbed4", "value": "24576:Z0QVbXphtO83Ns/nzuzW59j+12Fih2TjvLe:7zjM8SvzuzW59j+1IimvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618214451, "uuid": "b980171b-9034-481f-ba05-b3aae8adf297", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618214451, "uuid": "2d255f6c-3e1d-43b4-8afa-d5ad355a2b50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618214451, "uuid": "1b779d02-fa12-424b-a664-2f2173e0a9d1", "value": "885e567660a28ec23b692291587ef69f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7caad04f-9b54-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1618207273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207273, "uuid": "e1e69f04-08f9-46a6-ac94-0f1a05d072c4", "comment": "Malware payload (RemcosRAT)", "value": "b2c76b09ede87ebadba6d70a1c1a8b09", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207273, "uuid": "4beb75d5-7929-408a-a573-d81b16f32777", "comment": "Malware payload (RemcosRAT)", "value": "fcc53f824f3ac227e192c83e41d2acfd372068b2a505f58e8eec12c93f5dda5e", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207273, "uuid": "88d2c12f-d0da-40fc-9d31-2229d26acb03", "comment": "Malware payload (RemcosRAT)", "value": "32aa4462d8f5866852894e380e80eeab15e7d474", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618207273, "uuid": "fc9fe0b1-d4f9-44ad-9da8-e97c08aa30af", "comment": "Malware payload (RemcosRAT)", "value": "f194849864576a7afa5a0d55e53290eb42cf053bfc971790a8af46b89325c553d5ba75fb6030a6ea9284cc7b2b20f0d6", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Outlook", "colour": "#100CAC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207273, "uuid": "9d566cba-3713-429b-a676-fdc1ed153385", "value": "4B93BE61B50191F5EC6D4235C93344864BB53C2F52923AFEA3BDFB2918323874A6BD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207273, "uuid": "f5929641-4bbe-402d-af6f-09a33050c8b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207273, "uuid": "28e55f9b-ae53-453b-a540-b73c10248b21", "value": "1536:1Ehjbi7DiGl6UysCoNcG3TO6gv2I/SX0Bxi2Y:4gZl6UqoN33T4v2CXi2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618207273, "uuid": "66fa8630-2873-4d92-99f3-a769a5345ba5", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618207273, "uuid": "d36ec633-7cab-472a-af51-14acec4635a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618207273, "uuid": "7651e842-13cc-49b8-9d4d-f1f2e68e3137", "value": "Cobro Juridico_0420198202_326828_4985792583130360_300690_8122300886764676459_5190713730838_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0e4469-9b59-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1618209260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209260, "uuid": "cdda67a7-7152-4157-aac6-1bf36a3a6521", "comment": "Malware payload (Loki)", "value": "c0c2bee3ae2d76f711280366dcb3fd7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209260, "uuid": "bdf1c8ed-c281-43c5-bcb6-b966e320cbed", "comment": "Malware payload (Loki)", "value": "fd1f4d39ed915432e6217b187678f93a209dd7fe7c41cb9321f325383f4c453f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209260, "uuid": "717e4754-6658-4355-948e-22de6b3b1295", "comment": "Malware payload (Loki)", "value": "e964bf9c36a0a7b65e2b02368ccc7462385aa219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618209260, "uuid": "6e5966ef-f353-4071-a036-9f4a8e88f10f", "comment": "Malware payload (Loki)", "value": "be47688381496898f744caed3eb8a88634dc3c8367f8b0486ab60f1f542e9bd14fe97c8cf1f0f25a0d21c7ab08e91ba1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209260, "uuid": "86b7e1a2-1aae-47f9-9f92-d7b3d6445608", "value": "C8E3124272C9FC37FB559A330B66A3B9D6F601210521DAAF8F041F3A7B22583931E597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209260, "uuid": "0e21d509-147a-48bb-a06e-2daecb6362d9", "value": "18bc6fa81e19f21156316b1ae696ed6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209260, "uuid": "ed27782a-f614-4f87-a96c-8e12822c6f6b", "value": "3072:HyewmN4skJ6qpmGB4W583qtNkSK+qM4ieQjek+2SxoZPhpRXZzXDwOng+:HdOpmGBTuqPHK+WR5ReRJzpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618209260, "uuid": "513f57e4-0762-4064-be13-8ec2587a152f", "value": 148712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618209260, "uuid": "7f1e9692-633f-4981-8ffc-a37b5540e478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618209260, "uuid": "c1adc1c7-89e4-4ca6-b505-31a1a2ca597b", "value": "c0c2bee3ae2d76f711280366dcb3fd7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c3261f-9bb4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1618248300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248300, "uuid": "e6627ce1-cd69-47fb-936d-ed17086c1799", "comment": "Malware payload (Formbook)", "value": "3fa54b15620159857fe29fa9ee04f79e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248300, "uuid": "da13cac8-5f0c-48ec-aa39-06ee7e212eec", "comment": "Malware payload (Formbook)", "value": "ffe63c6a32d03aa67c5d1c15a58ed6ea0939d5b870cb922aec1466b119c9be52", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248300, "uuid": "e591d5ef-4ff5-49a1-8072-623ce27bc202", "comment": "Malware payload (Formbook)", "value": "b3f57b4bd29e6f1a5a12fcd3826e81e4b12fe682", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1618248300, "uuid": "19a71c2c-4867-4356-9e04-4801a628ab32", "comment": "Malware payload (Formbook)", "value": "d6eeb0e94b83b390966fd067534107745f28a10b4a86e2be605127533ebe878cbb85d857361a7053d11a59f995e0dc04", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248300, "uuid": "349e0b17-9624-4b92-9494-d7d4443c701e", "value": "0DE423D467E101BE4FA7E529A8815FC64ECA3FE77CCAD757038DAD01D122211B5884BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248300, "uuid": "5baa7682-6c9c-42b7-ac0b-2f0b459301cf", "value": "12288:dVbFHen9oJgNMPmSx4BFERiLMf7vxE/KK6RilRQ9/hPXaW5NIbwymEtW:dVF+nAB4BSiLMf92KK6Ribqae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1618248300, "uuid": "7f1ababa-012e-4ae7-b81e-2f6aa88ccd27", "value": 696016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1618248300, "uuid": "4f9a6060-630e-488f-ba35-5c4e8667fc97", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1618248300, "uuid": "7b8d2f81-581a-4808-a222-01461c2f3ed4", "value": "Nuevo orden.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }