{ "Event": { "published": true, "date": "2021-07-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-07", "timestamp": 1625702581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b0d11100-a35a-459b-a92d-fb6690da606a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e45d1c-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625672906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672906, "uuid": "ddaec1e6-f21b-4238-bf4c-22e0695a2698", "comment": "Malware payload (AgentTesla)", "value": "e461234d60e851226d276e1e352dfb54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672906, "uuid": "99a82e9a-7526-4641-9e1e-9bcf85c7c9b9", "comment": "Malware payload (AgentTesla)", "value": "003836808ec9e447cff200b146e6f883e864cf85667e1734a9507244e985bfeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672906, "uuid": "4022953b-863b-4369-b69e-4daef00733b6", "comment": "Malware payload (AgentTesla)", "value": "5f46ca0a8bf35b450d64e6d96aeddffdc31c99ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672906, "uuid": "77077e7a-7a59-48b6-81f2-617581b5d016", "comment": "Malware payload (AgentTesla)", "value": "66c78f667db40c96e6bdfd20f90eace0f6ec7c385d12fce579cef3fc9c54d4f226365df5f60eb0a66e84c01e2aa7ad15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672906, "uuid": "bbe66cbd-baa6-46cd-b5e0-918f08510ba9", "value": "T1C345CF7A20338A52CEAFC7F94731651E4F6DAFFEA14BB6742885717400F0B5E0A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672906, "uuid": "af2c37e9-bc89-4426-9c23-affc1a112b7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672906, "uuid": "93b1f3b9-3d08-40fe-a373-31f434946d88", "value": "24576:7P6P2IVU05sseD5Q45Gtwgj9jYTNBK4T+ZZLu3MS0biYuWOBfWlB:7P6P2c7WGtwkoK4TIc3MVbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672906, "uuid": "913c06f2-4783-424b-9a7d-3cde666a6ee0", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672906, "uuid": "bde415da-cf97-406b-96f0-eece5d5f2009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672906, "uuid": "67347f0f-12c4-4669-b8fb-41ed488cfbf8", "value": "e461234d60e851226d276e1e352dfb54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754d391d-df53-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625683510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683510, "uuid": "6a542278-4a89-4774-94f9-b19743b7777d", "comment": "Malware payload (Loki)", "value": "f2cd90ae3b4307b881aa7512a24ff3d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683510, "uuid": "0d2f65a6-5275-4445-8e15-96eb3f6116ef", "comment": "Malware payload (Loki)", "value": "00dc81db82fd264aa369b855dc21957ad780742f0f62ab3d62408e13a457199d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683510, "uuid": "12c95796-4132-4749-9b7d-42d80eb1c22d", "comment": "Malware payload (Loki)", "value": "4650bd50cfe70504f1002c19c3b1ffd9e050f3cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683510, "uuid": "0da754cf-edd5-4a1f-b630-f8078ac374e7", "comment": "Malware payload (Loki)", "value": "f72b3516173a9745100d1d2b53b8173cbf28d7060221dca5665630cc3b46c5aa288d845d9526c8a1a90134dc0bfa4735", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683510, "uuid": "eb2a7777-91b6-49bb-ae94-48bc36d58069", "value": "T16A741281B675C381C88D127AC65B4BBC123CEE471804E60FE3C53F19553BBAAABD1B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683510, "uuid": "968ccdcb-b032-4693-b450-ae8760d6c098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683510, "uuid": "205e5224-d298-47d9-9f94-f7c027732335", "value": "6144:Je0K0GYxAskhTUuoJ2z4eWO1ZHKV29V3RoubrGZVZJ:QYxAs12zLWO1ZHKs98uPGDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683510, "uuid": "246a3b77-39a4-4408-9026-c7b71a4d24c2", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683510, "uuid": "d35f1520-d7a8-4b01-9f16-0e13dc40666f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683510, "uuid": "699ad2fd-0519-427c-b44d-16518dfeb68e", "value": "f2cd90ae3b4307b881aa7512a24ff3d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d68276-defe-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625647197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647197, "uuid": "c467faec-f3ac-45e3-a74f-4820347261d9", "comment": "Malware payload (GuLoader)", "value": "99a472956a2fdd16c93c10c5ca6a042d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647197, "uuid": "37e974e7-f735-4f96-af5a-4aa7dc86f193", "comment": "Malware payload (GuLoader)", "value": "0111e643db93fd27abab8725f88517e9deb9b7e2a2579084b849a523b22d18e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647197, "uuid": "64c2828a-2dff-4dcd-b894-d2fa410c23d6", "comment": "Malware payload (GuLoader)", "value": "3c2d1f12a687e1387fde44fe6781e710b5f36348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647197, "uuid": "77a828af-29e3-4270-9c9f-b22404b2429a", "comment": "Malware payload (GuLoader)", "value": "289528e5c4c8a49e249a0a32439097fdd86b0f974d5bc2fe4c98826fd181c246461b515280910442907eb9695b549111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647197, "uuid": "c8e0432c-d81f-4b96-a391-01440ad284f9", "value": "6433F15FF7CC1F71DBCB5331A26EDD258A264033513B4B8631B81A7EB9291905A32856", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647197, "uuid": "32e831c7-1d85-48d8-ba71-99b3f7238425", "value": "1f75ee5de8ac0c77c6e43508555114fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647197, "uuid": "1cfd165a-5b44-44ff-91c0-b84d1d754ff3", "value": "768:h6tjmw4xLzFBMSisdGJ7ZwMTTXTnsYzvQNLTX5IiuESpEmmgcppLA9o31Yc4hsrC:h6MFxX3MSrc7ZXTfFvkimmmE9o31R4wC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647197, "uuid": "462d68ff-0de3-4bb0-9521-b5251aeddaef", "value": 54794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647197, "uuid": "7dc3e6b3-7aa4-4e47-83d9-0ca785af17ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647197, "uuid": "f8f83f9a-407b-4cc0-86e2-4300c4a7a16c", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e3cef9-df55-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625684268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684268, "uuid": "4250ffca-ebff-4f66-a0cb-ceb67ac49e30", "comment": "Malware payload (CobaltStrike)", "value": "7de9b4c2973c70b90ec57b8ebaafe360", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684268, "uuid": "306c78a0-a3eb-4c1b-b733-9af05284f1ec", "comment": "Malware payload (CobaltStrike)", "value": "02152aebd38eb7171306a544adb160ce5046dcc910f6dcb5bf04a59dd2bfd8a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684268, "uuid": "d5477457-b9d7-4ff9-8c5a-33100e269f21", "comment": "Malware payload (CobaltStrike)", "value": "db886ca004ec69e655b048df81d5176e0fd771d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684268, "uuid": "517c47be-d0fc-4122-8707-fe993b491343", "comment": "Malware payload (CobaltStrike)", "value": "84b10eddefd2b8d13484875efede902105de6e4e147eeefacff768c3e175160c9d8f643644a600c9118f4da0b0900823", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684268, "uuid": "fdc7b09e-da16-41dd-8ad5-8d2eefcbf973", "value": "T10D741215EF3207F9D8CB183B4A4B907FE2567622AC90C5379ACAA9B61050DEFD475233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684268, "uuid": "7358e3db-0d75-4fa1-a125-b6091e534629", "value": "f09dd27db7b2c002f57b0dee04d67cef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684268, "uuid": "fc20620e-5811-4e7e-9cc3-a6a00358cb58", "value": "6144:FPpBMawV+ebB2QfLkTpNyJUQM+OpolEpxtQPc/rlHYk4xpV/3JDM12zqog/ZI3iY:6awdgQjktNaUl+p6r4pN3ZrzWm3iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625684268, "uuid": "afae1032-f082-4871-9fee-9025d0a09040", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625684268, "uuid": "a2d270fe-f64f-47f9-920f-a30c6da2cb3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684268, "uuid": "b6172a3e-eb73-45eb-ba48-2aae7b1b7510", "value": "7de9b4c2973c70b90ec57b8ebaafe360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5138521c-dee9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625637923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637923, "uuid": "d0ccc82e-5b07-484e-81af-7adc19058288", "comment": "Malware payload (AgentTesla)", "value": "0684f3406d0a71518e0635eff76c1c3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637923, "uuid": "b345a6a4-bca5-4296-9386-dde1aef575d5", "comment": "Malware payload (AgentTesla)", "value": "02a4589e74aad97228050d64d6985f9a0cf93b07c4615a231949fae7d4940814", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637923, "uuid": "a313d774-9a23-4c83-86f2-0c656feba759", "comment": "Malware payload (AgentTesla)", "value": "744bfc69090055a08b5b8cb4fd250b9ecc6539cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637923, "uuid": "dfc9475a-5de7-47a7-8eb8-2b39348dcaf8", "comment": "Malware payload (AgentTesla)", "value": "cfafe4c025bea7bf02d2cfa4cbad0b77ef24b4ed724a22c5e857aeb92f771130a01c64b9db5c7d8b4019888b38709ae2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637923, "uuid": "880af2a9-b6b2-4775-8fb9-fd176f8111ef", "value": "4E45DF7A20338A92DEAFC7F903316A1E4F6DAFFD915BB6741844B47500F4B4D0A6192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637923, "uuid": "21fe4540-827e-4322-ba6f-ef8005abf51d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637923, "uuid": "37faa100-482c-4650-8f97-e95723f9e4df", "value": "24576:fV+HOY5+qiG/DvtQ1MHKx0GlTqiUV4kcDC70biYuWOBfWlB:fVuE3Gba12u0arkcDTbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637923, "uuid": "5d84eafc-90e2-4c5b-8004-d0fb3bac006a", "value": 1256448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637923, "uuid": "6668f00b-3ad6-4c81-b6f7-dc93b8089e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637923, "uuid": "e1efb209-cbae-497e-893c-8be18f7e6f29", "value": "0684f3406d0a71518e0635eff76c1c3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6c4379-df3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625673594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673594, "uuid": "1e699385-00f4-419e-9851-983004eb7ffc", "comment": "Malware payload (Dridex)", "value": "dfc25e0ea7429af7713993ba8b849325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673594, "uuid": "fdfe3f49-93f9-487c-bb91-46b1c767d7a9", "comment": "Malware payload (Dridex)", "value": "03b842f01c0fcffe65528c0cda2b41426a01f1e005da63bdae4ce96aa0469a76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673594, "uuid": "ab5ed8bd-0c90-4db4-b475-f185a59dd004", "comment": "Malware payload (Dridex)", "value": "aa652265c401f2671f976e0f7b5d345abafb7d04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673594, "uuid": "54bfbbde-2072-4b5c-a131-aca81bac8f77", "comment": "Malware payload (Dridex)", "value": "770e3500a380e57e471bf3eca2df3ef193aeeb82d2015f74f909a6fb78d08e7cc10c6308e4372275171a12fce2994e8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673594, "uuid": "eb8edd43-f904-48d6-b0ae-783ba3e31793", "value": "T173440247CA4F73F4C19BA3319151A13F2E20258ABF18E8FBDA651C03CD8D5965A7A7B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673594, "uuid": "66e52a70-8a82-46f7-9919-daf605faff58", "value": "4760b63b249352350fb67b805f5d8b2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673594, "uuid": "3e64219e-558b-4496-9203-675a48629f0a", "value": "3072:DwEYUOZgqLerAZN43UFui/XhLh7keqwxncf8PrS6TZQPacsWZdA+juV05R7v+AlC:cnUOZ3DPSUNXBFkwPEPacFdlW4RS8g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625673594, "uuid": "2039df2b-ce08-4748-be36-6db3de81971b", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625673594, "uuid": "19db1a14-206e-48a6-9dfe-15705cd2463d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673594, "uuid": "bde6c700-3b5e-43b8-a44d-20d766e82dff", "value": "dfc25e0ea7429af7713993ba8b849325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09c8786-decc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625625628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625628, "uuid": "621ef06e-f8cd-4ff2-b1bc-5fbbbe87e073", "comment": "Malware payload (Loki)", "value": "2d61bbb99b28b14e3b2f7e2b2df6db82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625628, "uuid": "c2190cd6-d29e-4c9a-a485-2f70fd210780", "comment": "Malware payload (Loki)", "value": "03bf3837d12349b60810641787e63fe73cc1136022cb97e7ce6575d22cd00f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625628, "uuid": "27078d68-5bb6-4cbf-bb78-36e83fb51cc7", "comment": "Malware payload (Loki)", "value": "73899fb66109226c688caad88b60f5eb914afdd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625628, "uuid": "a58e5ccd-eb73-47a8-a942-fd98d4a5f2e3", "comment": "Malware payload (Loki)", "value": "14039c391c10e5b2aff857ce2432b8507a432d26fe63c53218f3fce3b7d2792ff054b2744b468460262387aa2f8dd721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625628, "uuid": "bf9f9747-41f4-43c8-a6d0-e389f3a7fb0c", "value": "0A35BE7A60338A92DEAFC7F90331652E4F6DAFFE904A76781844B47500F4B4D4B61A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625628, "uuid": "339ed33f-5dfc-41c4-9ce3-439b209342bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625628, "uuid": "d55436cf-a4c7-4e39-8d0f-c19dc31e742c", "value": "24576:tk+HGrlcQSBnn0elMQjXrMNkG7XD80biYuWOBfWlB:tkNyQKnnTCQjriL/biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625628, "uuid": "d90cc890-e961-4bc8-88b0-d3b51816b28f", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625628, "uuid": "42995be7-4785-4740-a7ad-f7e46a135962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625628, "uuid": "2b5c7342-c983-4c68-ac29-4dcdb2aac7bd", "value": "Order #1 shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399da4f8-df4b-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625679974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679974, "uuid": "84d05ca0-0739-40a7-8280-20933a02e19b", "comment": "Malware payload (RemcosRAT)", "value": "c0f4451d23bda8da36cdac4b2b259163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679974, "uuid": "93adbea7-ef06-49ad-af6b-7886ffb4b5e6", "comment": "Malware payload (RemcosRAT)", "value": "051bfc878cbfc9748f59edcb04b8d8cfdc75b566e403236385c51374b7afd393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679974, "uuid": "3d133787-638f-40f9-bcc6-b08cb9be73e8", "comment": "Malware payload (RemcosRAT)", "value": "a57dd7c951328487a93a22c4bde3b6cd17cd6c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679974, "uuid": "61e4d7cc-dccd-4dbc-b7a2-1efe71ba3fd1", "comment": "Malware payload (RemcosRAT)", "value": "4c6dc9f908a2df99166cd1852353a225caad3c215784ba02a6bfe0f4df7eb8e467da42f693c74ff7df4e05e5a55fef42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679974, "uuid": "b7109551-5f53-412e-b32d-8e9c29485a65", "value": "T1F5F48D27E2C25437E52315396E0BD15D6E17BF00693829D92AF57E6C8F3E78238160EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679974, "uuid": "f44fe159-3feb-432e-b5d7-7f0c752dab5f", "value": "76139ff953899a69c3980d2d044e4370", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679974, "uuid": "9eabc584-4e20-4d28-bab4-4b34c65d9a7e", "value": "12288:FqXq5p/SAz8XgXuv4SOkMn1uFW3R1MDEZUQ4NZcxvXTWjSiuPBR5lpbTYwPvF:Fn5dSAz8q2GkM8WqUNtTGSBRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625679974, "uuid": "2c63f48d-bfb3-415a-8589-8a41ade40781", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625679974, "uuid": "3deb8643-f910-4091-b692-8d4b4ac202cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679974, "uuid": "df46d178-a709-45f7-9677-5534b5c36e7c", "value": "IMG_81000342100034520098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d966b0-deee-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625640080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640080, "uuid": "a4d62cf7-4346-4a45-b62f-a9d5ccb974c8", "comment": "Malware payload (SnakeKeylogger)", "value": "cab563f954ff10551d73244e3cc0e4f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640080, "uuid": "9fbcc1b5-e753-46a0-8360-6facfc3b612c", "comment": "Malware payload (SnakeKeylogger)", "value": "05d1cd8ecd12ffc2c26529d25bcb0e0fe82a26e88297abfffb05b66637f24fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640080, "uuid": "9c5cca15-af59-4559-8afc-612ca8747601", "comment": "Malware payload (SnakeKeylogger)", "value": "084eb2b5e84f98a1646737cd43c3ebd936514528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640080, "uuid": "72c4a43b-9a39-4b58-b74d-727b4f26f71b", "comment": "Malware payload (SnakeKeylogger)", "value": "77d8a698d3ac504575f417ffe3bbdeeec41158f88ae941d7691a664d9ecc3d57049621768b6e66cb332b03375911911b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640080, "uuid": "76e07f63-9c54-4eb9-b278-f6f76e08479e", "value": "4D35BE7A20378A92DEAFC7F90730651E4F6DAFFD914BB6780844B47900F4B4D4AA1927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640080, "uuid": "c8e87808-0d62-4e58-954e-43f7b1039f43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640080, "uuid": "004e9a78-9d96-4bc3-bda6-15258531e811", "value": "24576:+9+HIsxnG6aCia30GNWWvMW0biYuWOBfWlB:+98xntNiXoMpbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625640080, "uuid": "ef5f5225-7499-49d2-aa73-e42e00c7a423", "value": 1142272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625640080, "uuid": "dbb8c5aa-30c8-4290-84e0-3a5884063ac9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640080, "uuid": "e3a395a4-bf44-445d-9452-6c6c24f0dc6a", "value": "cab563f954ff10551d73244e3cc0e4f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524e7918-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625637495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637495, "uuid": "07b1b026-a197-45c4-8ce0-d31c8b8353a4", "comment": "Malware payload", "value": "458c0097aab1062b842496188856af77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637495, "uuid": "7248cea9-60a1-4024-9d3b-77e643b63fa1", "comment": "Malware payload", "value": "09d408f193dd6bea7a5d5ae325a7c4dbf215c7e27203e3c371e7de91d8544365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637495, "uuid": "a3ad000a-6b82-4af4-95c6-9b5240fe1f15", "comment": "Malware payload", "value": "5fbfd26c0c419e2cf2bb90e011ffc8b3a0efd832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637495, "uuid": "49c330cc-415a-45bc-8672-d1c8db97e07b", "comment": "Malware payload", "value": "dced458319175902f7f36e88dc98dd2f7084ff1d4309e4f7390024737da8ec578754971c773f65c432bba83c0ed987cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637495, "uuid": "26cba08f-ac92-4770-ba67-bda55bc4c614", "value": "F0D4F0BC26585D56D377C3FEC195F23492B17E090182D60A96E6ACDB3E46BE2F8140CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637495, "uuid": "fca22090-024f-4ca4-a9f4-9693f23e8a13", "value": "12288:+DhW48txbxY6yBwJKM/3elzzqxR9MTLp9eHVoUvntq/umE:zNtxbxY6ymKMGlz8R9MTLDeHP8TE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637495, "uuid": "f703f4e2-6d37-4a67-8393-f0d6e478693a", "value": 620839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637495, "uuid": "b49fd95b-f698-4e69-a970-e53bc2469d57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637495, "uuid": "d26462de-cee5-45c3-a5da-7de80818e102", "value": "458c0097aab1062b842496188856af77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1444bd9-def7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625644205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644205, "uuid": "53b1dcec-80b6-4282-bf78-617ed3bbadac", "comment": "Malware payload (RedLineStealer)", "value": "bb8e07a1ca72e3a4bef0ecfe09459de7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644205, "uuid": "e54f14e7-3dad-49cc-bd49-bf4bc6fa39e7", "comment": "Malware payload (RedLineStealer)", "value": "0c580c106cfd6055e480fb8405575c294729ee0abb0037f5f84e6ae33ad27b69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644205, "uuid": "b85a844d-b272-407e-84c9-505eada4b110", "comment": "Malware payload (RedLineStealer)", "value": "a325cb86c0b6db451b40982daf430c0a2f8490b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644205, "uuid": "dd0ae591-b503-4a97-99ec-1e709e4afa35", "comment": "Malware payload (RedLineStealer)", "value": "8e2000ef6d575aaf4632bcc6b29285b6b9f71c2920b679cf53da50bb18b5b06cfced720c9f2287ebd369e2dde23cc5f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644205, "uuid": "739b98ae-f098-4482-9c00-a55bcb9ffabe", "value": "D3D508E12727929FC08B04BCE5829912931E67E246A159A3FFF8B471BDC3F011E897D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644205, "uuid": "753aea81-0a48-42a9-be4b-eb83a9fd06d5", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644205, "uuid": "b71cd746-bcb6-496a-9bce-352f96291044", "value": "24576:20LOitu3oX6tSEfAlngKDmy/Hk3C6hlLJ298iE7kGEyE7uvYxl+Ltdk8XswB5oWm:XrraolBo//omVcLmWlZ7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625644205, "uuid": "91787c98-304d-4b27-a55b-146986d2a665", "value": 2952872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625644205, "uuid": "150d8182-7142-467b-8327-f4cb55231811", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644205, "uuid": "687d5087-87c6-4c37-8098-faef7deb8787", "value": "bb8e07a1ca72e3a4bef0ecfe09459de7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9142f90c-df1e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625660794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660794, "uuid": "621c36fd-f1ce-45d6-bdf7-e1d613fb2bae", "comment": "Malware payload (SnakeKeylogger)", "value": "13ff5f0e924e766356a6bbecb0979113", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660794, "uuid": "c69ddacf-1c76-41b5-ba2a-55b59ee60a98", "comment": "Malware payload (SnakeKeylogger)", "value": "0c59981f9303e35ffe5ba7e78234ee7ee0b76df49bf99249354053c932ff7d63", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660794, "uuid": "f21b04e2-da2a-478b-97fa-b77a0e23f164", "comment": "Malware payload (SnakeKeylogger)", "value": "ed1fcae8717342c7281b83d162b153470f9e4edd", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660794, "uuid": "27606c2c-f13f-432c-8da0-d418443abb09", "comment": "Malware payload (SnakeKeylogger)", "value": "0feecbfd02058ffb9641beaecf5c4912bc76f8af57cdf27dd038aa31cf44ce5401b3d8bb084a65229aefe3a23983e5d5", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660794, "uuid": "bc6500f5-9b99-47c5-abb2-5b73b8ef7595", "value": "B185AE7D70F28BD2EEABC77D5FB5751C6F6C6EAA90066E741C88716800E0B590A3142F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660794, "uuid": "bd7b0454-5344-4bfb-94fe-9b6172d60f42", "value": "24576:YrOM/Ir8EEl2woqWBr04LZk4EicN5IvIK3i/P5N0biYuWOBfWlB:Sk8EE0hzwdHIAm05+biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660794, "uuid": "22f146f4-4377-45fb-9db0-c4e9305f8493", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660794, "uuid": "20c0d911-7f1e-4d39-b25f-efec52c8aa16", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660794, "uuid": "8452ac08-c903-4bf8-9a2d-e41bc7842e32", "value": "INVITATION TO TENDER NO MAT 021 PJTS 021 FOR THE PROVISION OF SUPPLY Instrument Bulk Material.exe.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be09ec5-df76-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625698581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625698581, "uuid": "5422d63b-1e53-4859-8b77-88d6a608fd0e", "comment": "Malware payload", "value": "c1fe5734a16a3afe728dcafaae42ee67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625698581, "uuid": "b4a96c9e-301c-4bb8-ae7c-819381bacc38", "comment": "Malware payload", "value": "0c86420cccb44fed7aa8b713338e0d4933f7f0d6cf2df7c396749d7a9ed69c9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625698581, "uuid": "2a62233b-a702-4747-a07e-baf3664f96b7", "comment": "Malware payload", "value": "8d0dc60ea470023d2ec46eada35c75250937db7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625698581, "uuid": "51906e0a-f41a-4493-bb48-9b391736dad9", "comment": "Malware payload", "value": "56e08a77e9aa25606a3adc57b4ef0c6f4d29e3fb7f52117b43e3579da67cd204d0258abd0b579bc58ed37e8e70df5540", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625698581, "uuid": "c930a0e3-0e64-4e19-bb6a-29b1c3177738", "value": "T18603F136020139F5E9574CB702969B620A35038B86C11F05AD51EA73A38B9ED2CA7FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625698581, "uuid": "11dcf7a1-3cf5-4d6e-992f-58d062465f4e", "value": "768:0kS9e4MU8YO5llohix0V4NwEUUnZr+8yPiMfP9zP28P9nwJgGlzDpxYsP:1CeD5llB2zpUniPRP9zPpwVrY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625698581, "uuid": "84bf5070-3a98-40ee-a9a3-c36eae683b94", "value": 39220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625698581, "uuid": "4c11c2a0-cb23-4d48-99de-27ff86d06ad7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625698581, "uuid": "f230e75d-42c0-47db-9883-1a2a0723b383", "value": "c1fe5734a16a3afe728dcafaae42ee67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bf1289-df45-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625677303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677303, "uuid": "8ce38ef8-da9b-41c9-a1f6-9907afecc72f", "comment": "Malware payload (AgentTesla)", "value": "b20a05777d6abd6832bc55fec2400633", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677303, "uuid": "4b672ae3-4b8f-43ae-87d2-859a80479964", "comment": "Malware payload (AgentTesla)", "value": "0e940313c23887d1d66238ce33cada5648cf6c6d3aa9170ca6e1adceaa478c8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677303, "uuid": "1da2b0db-ff32-41d2-8a85-9be9a688bb4d", "comment": "Malware payload (AgentTesla)", "value": "1a8465dec98a5f11d94e4f30bdc5189731e132f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677303, "uuid": "1d65144b-7004-484f-bb4f-5f289d14cfae", "comment": "Malware payload (AgentTesla)", "value": "a27d0878f8c309b12f2948ff9ccd3fa42ea2abc7f38d60cb36f851b33df6dc539916087bf7740adec75407f76c40e1eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677303, "uuid": "5e590cda-19b1-4b7e-93fa-94ef83809e06", "value": "T151F44B69E9441667EB3A97304A32C830F13A6CEA35309C9F15CB3D5B367F5422DA632D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677303, "uuid": "07c107af-6b63-48a0-a407-67a9d8957403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677303, "uuid": "6d6edfa1-4a4b-4cf9-877d-950cfb1233fc", "value": "12288:ldb8EKlXgFxY3wBeTXBztNVAGM+H/pQVDFYwT0YDpO0P7r9r/+ppppppppppppp7:QdLKJEpDwFdO01q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625677303, "uuid": "81725811-5ee3-4843-bd1d-f67d288b23e9", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625677303, "uuid": "e0d5d1b1-7780-49e8-a512-666fc20ab9ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677303, "uuid": "fb9b10d5-2fb6-4762-a37e-caea949fb352", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312b3802-deff-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625647318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647318, "uuid": "d75144fd-4984-42df-ab2a-4e79ba6ffaf3", "comment": "Malware payload (Formbook)", "value": "0328cc2dc8a6e61c70e95cf140d4cfd1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647318, "uuid": "a59361e6-9636-4f30-93f1-649fc5aad399", "comment": "Malware payload (Formbook)", "value": "0eaa2945d7f803ad6d316e6ec5018be52dd5a1c9715f9d0a5ebe9ed366342b11", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647318, "uuid": "c490453e-c040-4fd4-aa56-2fb785e71472", "comment": "Malware payload (Formbook)", "value": "b0eb59041598bbbb6f6275d8e75708511f8c6a56", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647318, "uuid": "41750210-3da5-46ac-a968-6f6cf7d557e1", "comment": "Malware payload (Formbook)", "value": "f541bc58b3d05d207e21945521d2bb19132b91795e2c2d6c394c66b0f2416f7df52840d6f142dac316ae3b294f69b60f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647318, "uuid": "3b5c6a42-3a1c-42b8-86a3-528f633894ad", "value": "4F4512A74F4EBB66E02688B000AA4F11E32EAF9D6D093020E58F774D75B4634F75B56C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647318, "uuid": "b56f9115-bcfa-46d9-8bca-9b0b0825d6c0", "value": "24576:s5ZTvbUHnYWh0TafLSNBd16WtGoh6ZPZynZOaKMKc3oJGPvjqzrjYgAlItlq+w:s/UHnb3WV1YomPZqkarH3qGPvji0Ii+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647318, "uuid": "e7c4f143-15ac-4527-933c-bb427992d1e5", "value": 1277042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647318, "uuid": "14509da7-140d-4576-824e-f5b47f3b627f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647318, "uuid": "793f1f47-fc6d-4a2a-9817-a0baf0c211e2", "value": "11.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff6c753-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625662993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662993, "uuid": "3dceaca9-2145-47fb-91af-b4087ae2031a", "comment": "Malware payload (SnakeKeylogger)", "value": "d9956269f25276683e00a3250d4ac118", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662993, "uuid": "b0a8a3ff-4963-49d1-accf-e6abebc106d9", "comment": "Malware payload (SnakeKeylogger)", "value": "0f977aefc3756d9d7dc9ce00f4216012db04a46a13949930f251305e1c88911c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662993, "uuid": "a0db8e7a-0fa3-4a09-844e-9bc95c15ace8", "comment": "Malware payload (SnakeKeylogger)", "value": "482e66c7d732c478cbeeefa2651884495b7820a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662993, "uuid": "e8a3b45e-9049-4ec3-8738-6aa36408c7e8", "comment": "Malware payload (SnakeKeylogger)", "value": "ac4d19849cb61333c6d2323b5a6190fc2d37335ec44d443de7a1602375df144b1ce9a1c81cc86eb2435c02671bafa771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662993, "uuid": "97b083c2-ca3f-43e6-ba82-a0791892e29f", "value": "0645CF7A60338A92CEAFC7F94771161E4F6DAFFEA147B6741884707800F0B5D4A5292B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662993, "uuid": "c66c72a1-488e-49f8-9642-3ecb157fbdf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662993, "uuid": "ee0ba83c-6f08-4392-ade6-74f94c10760d", "value": "24576:OweeEnVVomkkUrhMjEC9eRfEoWMBKJ0biYuWOBfWlB:OwGnbkhMYceR8oWMoKbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662993, "uuid": "ad98b44e-e153-4b5c-9d01-3249d874d590", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662993, "uuid": "128e24eb-cefc-4d1d-8ba0-2d96c69ac3ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662993, "uuid": "60431d0c-c687-4b81-ae18-a629e3b61b2a", "value": "PW1-WO-004 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb902d34-df68-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625692755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625692755, "uuid": "c3d7fa81-cfbb-4da3-a70a-466b0dcfb1a1", "comment": "Malware payload (RemcosRAT)", "value": "923ec143594a13e3a9585e2d86e7e890", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625692755, "uuid": "f4398c11-172d-4531-94d6-91ab2986515a", "comment": "Malware payload (RemcosRAT)", "value": "129b7cf64e3afecabb3a0c27fedc69cbade9c81ce3c0a5da367717bdef49f7c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625692755, "uuid": "e7140c7b-2370-49ed-8e09-3cbecab77f62", "comment": "Malware payload (RemcosRAT)", "value": "9ab99a5a8c0797e44e38bcea1fe7716f337117e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625692755, "uuid": "375b3d98-2c60-495c-a3df-a46137f80ab6", "comment": "Malware payload (RemcosRAT)", "value": "1b41e5f0b8d70ae601326cde73f795327066fe0277d495455c02e0ad041b22f2e2ca32158d4c4494ef808853b814f081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625692755, "uuid": "9e811032-c301-4ae0-9330-24d83061fdf5", "value": "T128D4026D9EE45264D0A65AB12C7AD4508BF3366F4C24C94CF48C761B2F7338942A7E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625692755, "uuid": "dc45fb07-9b42-476f-9385-0bed04f5f5fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625692755, "uuid": "1ce77d9a-ca59-4d1b-9f0e-d7c0eeba2e97", "value": "12288:epFiNPBwfy11LCvi3g/F1+HGP/+crbTSNZYTps2Sk2FG:giP11wi3WpPmcrbTSNZiWky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625692755, "uuid": "fc1bc9bf-b61b-4abf-b774-31037e3adf9c", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625692755, "uuid": "d8ea6d75-8880-4d66-afd5-21e2c471ea91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625692755, "uuid": "00ae2ec8-4eca-42eb-bed2-cb0a963a0dba", "value": "923ec143594a13e3a9585e2d86e7e890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1470b30-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634219, "uuid": "57946a3d-977b-494f-8659-259c5bf1c0f3", "comment": "Malware payload (AgentTesla)", "value": "12f0821def797484f5ac6f71c7df8603", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634219, "uuid": "0b8ea858-93a0-47dc-bacc-79810b322ac0", "comment": "Malware payload (AgentTesla)", "value": "12b8f8db5494b23f78d646a7f0cf283e5785cab44159e93bf248959d242b4172", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634219, "uuid": "aad41d88-90f7-40f0-a992-eb11e13487b1", "comment": "Malware payload (AgentTesla)", "value": "873beeda464af210a7d61fa1caf6bdf9d015876a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634219, "uuid": "6a10eab2-a5b7-435e-9655-bcdffe92d8cb", "comment": "Malware payload (AgentTesla)", "value": "5ae85332017c1eb84e6fed63f1e034a4b5a309d85593807db4c344157b1366f0eb5a58e4e169c888b2da1bf271d313d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634219, "uuid": "68d5ff5f-2e29-4a78-b425-7fc0412d5e0c", "value": "14C42393DB7DB4B483A1E2BEDF626424FA1BBB11D97343570ED4DDD102882D2A45E20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634219, "uuid": "7f106d6b-fb4a-46ad-9388-7b8cbd41af8c", "value": "12288:32ffHfy3yw9B+pgX4boFi+X7naCErWnJUPyioSpM5U44v:AfqyaSYy+rnIWJUP544v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634219, "uuid": "6c22a95b-18e0-44e3-9dcf-40d6097bd443", "value": 547051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634219, "uuid": "51c6aa97-ca58-4f7c-a38b-680c6e661506", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634219, "uuid": "ee5c830d-fcb1-4462-8cf7-cac60541c2b2", "value": "NEW PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e34861-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625662812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662812, "uuid": "d8b6835d-40e2-4dfd-83c6-d6506f1d3ac6", "comment": "Malware payload (Formbook)", "value": "e9a6a6b5879b1ab650f9530d945e2f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662812, "uuid": "520f4be8-04b8-4ae2-baf7-e8e26079a906", "comment": "Malware payload (Formbook)", "value": "14e50f20e1ade011dc7a2bb7dff021e709f5c8b9cd231b443375be8f73dd855d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662812, "uuid": "e5a97739-4c31-4e98-a6b3-9952a6c3730c", "comment": "Malware payload (Formbook)", "value": "55c012fb1a9dee52e24ea7a05e0a257f86acc6fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662812, "uuid": "e128f6b2-f4b5-45f1-b4d0-964777db679e", "comment": "Malware payload (Formbook)", "value": "7277be52b042769cf721498374358236a69a7789b7a2a5b0bdf3235c3d9a9d90628eab5bd11e1ab6f70bbb3d17f81077", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662812, "uuid": "025316ef-75d2-4c61-87e0-621b911f3d33", "value": "9A45BF7A20338A92DEAFC7F90731661E4F5DAFFD904BB6781844B47900F4B4D4A61A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662812, "uuid": "2daa0670-5cb9-49e2-aa2b-5ad8ec83cfde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662812, "uuid": "62f96723-5aa0-449c-9d0d-98abfcf83d65", "value": "24576:DO+HQGFoRX01kyIq/EMAzoZC7BLnTfj5Jz0biYuWOBfWlB:DOKIk1kI/3C7BLTtmbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662812, "uuid": "88ed4c0b-55ae-42aa-a9e9-f8d777c29092", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662812, "uuid": "19a192b0-bd00-4804-9784-9031cc8f77b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662812, "uuid": "844f82f3-090d-4a61-b445-d13cb4fa6a74", "value": "SWIFT MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8735c2-df33-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1625669594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669594, "uuid": "8fadbfda-7e17-432b-aa27-aca61ff02bdd", "comment": "Malware payload (Adwind)", "value": "69d225ac06e3b3526ce49d8571b9aed6", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669594, "uuid": "f78acef8-4965-4989-94e5-478591a1de01", "comment": "Malware payload (Adwind)", "value": "153835c5032d1795198ee8f1c89763df3781454d63ddcfb14ac92de9550a4877", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669594, "uuid": "3e6b1119-8871-473f-8730-6340ecc84cb0", "comment": "Malware payload (Adwind)", "value": "f56f95000f61e215507388ca9ccc794d817a2e46", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669594, "uuid": "b486a63e-dafd-4ca8-8167-2912079e2e05", "comment": "Malware payload (Adwind)", "value": "0d9c16ad0af328e73d8f6d6ddf5beab71bca25003658cbdb5a91643655fc4c8f7cdc0522aae273132167789e3a1a652b", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669594, "uuid": "519c6925-35de-48bb-8290-f7f31f37df8a", "value": "92A4121CFB9D84A6D7E6207441C209E6A3BA6D94E3C290B28E3136175335977EB13DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669594, "uuid": "295d4ca7-f4a0-4721-84cf-e97a8fb7e19c", "value": "12288:8labkMwFoXAo5z9BCe5pxogQNUhIK/0c2qnAw:GIN3C0sS7B2qnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669594, "uuid": "f8ab9b80-f38e-43b6-89ea-ea0b72270c2d", "value": 490952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669594, "uuid": "e3daa99a-26f4-4ef3-8be1-49bc41defc2f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669594, "uuid": "c2adf6be-c509-4297-ab07-3dc1e16f2920", "value": "ICITIUS33XXX10307051121001177...~320 KB.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16e16cf-df0d-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625653573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653573, "uuid": "ddc5d0ee-06c1-4cc5-b506-e118b3788e63", "comment": "Malware payload (NanoCore)", "value": "373522b3439b3d533b9ad48c794bfb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653573, "uuid": "85262269-facc-4284-b849-95e2aee6135d", "comment": "Malware payload (NanoCore)", "value": "158a5bed66657a5090a2e0a4c01481e67532d0f3111d4a183ee0c334982581a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653573, "uuid": "f1bbb9cb-f156-4ea0-8623-55fe6298e31d", "comment": "Malware payload (NanoCore)", "value": "08f1ee4d9cee9a6894e442a93299715d8daf1458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653573, "uuid": "45b6a1a3-4fe9-4de6-ae13-ac1762c21ace", "comment": "Malware payload (NanoCore)", "value": "f11d52ef41c2168ce3347ec4ecc27dd92d3007d5975668414951790593d3b8487bf3cac4580f0885269f3d2d82c243dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653573, "uuid": "4f70b6c8-a2c6-4ea1-825a-f516e32f75d8", "value": "3155E07630328A92CEAFC7F94731651E4FADAFFE904BB6741894707900F4B5E0A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653573, "uuid": "1b8fc3e7-6556-47bb-8c48-b0e883a7d913", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653573, "uuid": "220b6edb-6434-4657-80ad-b0fb49e5bea0", "value": "24576:8vHIkBOc+tSYB/VQg/oBdlzxKB8ng9zJ1fxtXEGZ50biYuWOBfWlB:EomkSYB/mggjlNg9zJ10GZ6biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625653573, "uuid": "dac389dc-4be1-4052-adb5-f16bc529b663", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625653573, "uuid": "187c16d4-52ea-42e9-bb9c-4b225ddc0d46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653573, "uuid": "8f62043b-e81e-40ed-9720-a47f2530506f", "value": "????? ????? ?? ??????? ? 1055207.07.2021.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9ac66e-def9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625644900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644900, "uuid": "aab08d69-3249-45f1-9ec3-e4ec035f1d81", "comment": "Malware payload (RedLineStealer)", "value": "4c786d5d8707fa659330847d7caabfd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644900, "uuid": "add0d16b-ff8f-433d-834c-c7f8466c411d", "comment": "Malware payload (RedLineStealer)", "value": "18c89a8f2ea47f3e31e55afa06cba58edf1adb616136a32d1c424287775ad4cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644900, "uuid": "c9595ee3-5790-470f-b634-a71095d0b3ea", "comment": "Malware payload (RedLineStealer)", "value": "c37c13d4ed5861d9930897716b52b374f85171c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644900, "uuid": "f1bc68d0-f764-49ce-8872-2cff2691aec8", "comment": "Malware payload (RedLineStealer)", "value": "4e9aeab965d3299c06d87dcde53f158ff2c23b31ba547298cb146384f561e39c837864e433af6809d7cafa20f8cc6da7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644900, "uuid": "277a80eb-9f21-4a73-bb46-ea04f531b5d2", "value": "0D33BA1856BFC529D4E3EA712DEC94B6D9A9A4E3200DB53B00B0732B4B52B84DE4F179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644900, "uuid": "470b6dee-5206-4de1-baed-78d10a0afac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644900, "uuid": "d8f2a876-9828-4ebb-88c8-5118ce77ddf1", "value": "768:TRUtnh6AZep6LCBvIkQPVpyU9EEQvNaZ47Kow0cydBhKRXytv//yte5QkKHJA02r:dUbnLYQk6SV84Cvy1KUtX/ytLl6T4F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625644900, "uuid": "fc098f9a-7d47-4bb8-965e-bc37fe8b8ace", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625644900, "uuid": "2164cf46-f9f0-4460-b957-080c9668f3f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644900, "uuid": "5eff0814-11eb-451c-8f62-8d338e59efed", "value": "4c786d5d8707fa659330847d7caabfd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2cdbbf-df3c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625673830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673830, "uuid": "4596b3f0-2a69-43ca-bad1-b378c918bb35", "comment": "Malware payload (NanoCore)", "value": "cc67a6ce221e767a7ccb597e27a0c145", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673830, "uuid": "8cb2855d-f813-4197-b3a4-f8df838037c8", "comment": "Malware payload (NanoCore)", "value": "1e7c33164f07dc380f9866ac4941b7fcb01b7099342e47254af509710049f5d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673830, "uuid": "b388c24b-18c9-48b9-ad65-6cf5656e8124", "comment": "Malware payload (NanoCore)", "value": "c2333eb598cb786e9bbe7f23c52df08796b7d17b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673830, "uuid": "a78d98b0-4da5-4ead-b643-56aa740ab5b8", "comment": "Malware payload (NanoCore)", "value": "6c175b259c64cdd4ce48006249f93dadd14611d72a3b0ebb9b5ec971786ad43d156ace915ab1d00b328f5f7675644834", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673830, "uuid": "7d98aedf-bff0-4d07-9288-a97aa98cb672", "value": "T19F45CE7960338A92DEAFC7F90730665E4F5DAFFE914BB6740844B47800F4B4E4AA1927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673830, "uuid": "56dd584d-0744-46c1-9928-8533fb2044ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673830, "uuid": "86316cef-d2e2-4abd-8507-2efd58a91ee0", "value": "24576:X2vxT+HznTdSL/mn+ZST0rbw6OLNNcvL0biYuWOBfWlB:+xTKx0rbEN0YbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625673830, "uuid": "ee641dd3-c872-4d5a-b15d-26bafaab9210", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625673830, "uuid": "96e09a4c-dee9-418a-a8eb-67d68c3c8cfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673830, "uuid": "e8e2481a-1f0c-4258-843a-e2a72c0ba725", "value": "cc67a6ce221e767a7ccb597e27a0c145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbd8fce-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662882, "uuid": "c58d8441-721e-4bfc-b6c3-29802b6803a6", "comment": "Malware payload (AgentTesla)", "value": "a03aba06517851425941522b0ce03a79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662882, "uuid": "7cac6fcf-a962-43ab-9386-9a84289be49a", "comment": "Malware payload (AgentTesla)", "value": "2082c09234c80b61a53c8e182d26a4a2e5068f9f0945dee8a4858f9312ee6f2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662882, "uuid": "648cf44a-e837-4c78-ba6d-0c4122d09cea", "comment": "Malware payload (AgentTesla)", "value": "4ea00570407728e185570a03ee2e528b439443a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662882, "uuid": "7ad323e3-0a50-46ac-9321-7fb76d0a7a86", "comment": "Malware payload (AgentTesla)", "value": "513aa0daf4cc88e8af10c222371345b4c233e5c963a3d2a10aa7845723d7537826396d6663b20fafa3538486350121c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662882, "uuid": "a4b0c3da-9cf4-445e-b347-af439d899a48", "value": "60F45A983312759EF4178832B9A7DCF0E6103E665B0B820350D73F9BB91E5D6CF941AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662882, "uuid": "b745b65f-acf5-4712-8703-66529f157f6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662882, "uuid": "718bc08d-cc17-4e6b-abe3-de856ecbce23", "value": "12288:Qi29X+XkO+bn43mquBeywOEcUBBnqwiqIG6z8SeZrD88huBrjoZAd2Goc:Qi29OUfnfBeywOSBnhihGCoD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662882, "uuid": "4dbcdc72-ed20-4d91-8e78-e1d133bc28db", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662882, "uuid": "bd0c8e00-6f4e-4f5a-8c4b-33c3a229e02f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662882, "uuid": "364bd318-73d3-428b-856d-bad58a3f38ad", "value": "JULY ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da3ed99-df54-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683981, "uuid": "5e154b4e-dcaf-47c3-9b5c-1aee75832fdd", "comment": "Malware payload", "value": "9e0f0affb0ceabd35d88978d4bd22a79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683981, "uuid": "ec8f1456-697e-4c9b-91e7-ad89b74ede4b", "comment": "Malware payload", "value": "210a46fa055399a9fe0b153724c4c6480c622e68fdf70c67fc3626d16619d68a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683981, "uuid": "57ec9008-bc48-4784-baff-d491ec321454", "comment": "Malware payload", "value": "4ee1dd0380b0e585217863133ea32a5dd48d444e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683981, "uuid": "6333e81d-c3b3-4292-b0d8-b9a0eb5f9ef4", "comment": "Malware payload", "value": "858d704b4a7e0dc32f1f3b0781190dd2a0c36e4082806b34ff6a73bcb1965151921e692291d667255accfe8a55e5017e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683981, "uuid": "38f954cc-5776-4d81-be33-eba52c162c0a", "value": "T17F5412916EB48762C46E437B60C691F20BA6DDF25443E78FAB407FC9827F3448BC1A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683981, "uuid": "57ad5408-c56c-4a35-9d71-a95284475907", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683981, "uuid": "241c7f34-4eda-4dcc-ab97-cebcb31019df", "value": "6144:vse3qV+D2dBUrNGeuRPywajDBjnWXnsAebddl8qz:04R2UpNuRcvNrAebjl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683981, "uuid": "9d2a3441-c244-4966-825b-93ef430e5cb4", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683981, "uuid": "8dcf6b05-a1e3-4705-9694-718acc6aa49b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683981, "uuid": "a8bf3bbf-36b5-40b7-b784-92b563f16b7b", "value": "9e0f0affb0ceabd35d88978d4bd22a79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e56859-dee6-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625636805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636805, "uuid": "7b98ce75-102e-4176-aefe-6213d4bda360", "comment": "Malware payload (ArkeiStealer)", "value": "dad0cd9fe3c9a36e05e1d56bd6988685", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636805, "uuid": "cb0a720b-5495-4d5a-8051-7303033c64ee", "comment": "Malware payload (ArkeiStealer)", "value": "217db596785d9b7b31ed6c2333c654bf974810dc7ececfd19fcfbb695cfae622", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636805, "uuid": "e4ebff8c-2289-4984-93e4-78f1f56c51ff", "comment": "Malware payload (ArkeiStealer)", "value": "f3be7abb61428fe0ed1554c4d366f8407a9f0a33", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636805, "uuid": "e0df5c91-2607-4d71-9b89-aa03a91689e3", "comment": "Malware payload (ArkeiStealer)", "value": "a9cbc475e238b091fa136e0ce794e705f986979f910540e038ae4e3436bc07271bfb5fe64cb35996c1ddb4307062ed9a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636805, "uuid": "e3038db0-3206-4a90-8db6-17b67e57a282", "value": "B2F412527D95C433C69244B05838DBA0263AFC6B2466960BB698FB4F4F331D267FA353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636805, "uuid": "ecbe8d19-f171-4430-9847-cf4e750c2174", "value": "da5446b036e9ca50ec91ebae60e40a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636805, "uuid": "d6036c71-c149-4bcc-baf1-19ac5431f5ef", "value": "12288:MS25qFjXZxLIaHckTo7phEpEih31izKoRXOS/wFkIHwM36FRzMfaYbEn7lo2zV8S:MS25mdxLjckU7phEpE+UOo0fHwM2Rof+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636805, "uuid": "a8e8c728-fa89-40e7-aa5c-205e5dd8aa98", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636805, "uuid": "91c164dd-0d2e-47d8-89c4-472c2266c4c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636805, "uuid": "694b58d3-d9e3-4ecf-be96-deb43b356d41", "value": "dad0cd9fe3c9a36e05e1d56bd6988685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d672a533-df34-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625670359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670359, "uuid": "108bb0f3-b942-4dc0-9550-5740b5fcda81", "comment": "Malware payload (SnakeKeylogger)", "value": "9287c396be1cbe7a78f1c815c2a2a533", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670359, "uuid": "a2e96201-45c6-46b2-ad9c-b3211cf2c943", "comment": "Malware payload (SnakeKeylogger)", "value": "23e91abfddaa3f52f22f4768119dfeb13b0f659b1d97078912dace317afb38c1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670359, "uuid": "21f80c16-948c-440d-9f87-1b7561b7cbcf", "comment": "Malware payload (SnakeKeylogger)", "value": "6b5faada277d9074cf9c44e4c0dca14f41e3b8c0", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670359, "uuid": "f94c73c1-c826-4902-bf05-11ae253633e6", "comment": "Malware payload (SnakeKeylogger)", "value": "fd1700cde8ad9efedeb0418f787ae08599161fbd1508d5526c4bd556ece6f2e29b5e2fb1aeca10da742c2fdaeb855432", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670359, "uuid": "b5132af6-1f43-4f56-9f87-f8d4e6be4019", "value": "2A842397F289F1C1CBFD498AC91667B9BC40E4B26E5C1DF7E8325A143896810B2893DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670359, "uuid": "d150e2da-bf0c-47c2-bb97-b78c18e55e60", "value": "6144:eyYsDy3LvgGxePXWsZINYAOg/qS42KBty3/ao/LxniMXb9ItnK3B5IvtoJa1YqNA:1yg0eesZrgRg83yGWtnKR5q1YVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670359, "uuid": "dfc338f5-f1be-4e2e-8369-1dd4109fdd46", "value": 402536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670359, "uuid": "1bee81e5-5eed-44b9-9ff4-a1e6236ca02a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670359, "uuid": "cf9f8bb1-f4bc-43f7-8670-6bbaa0c4db2b", "value": "IMG_056029741000.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b299dc-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625672909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672909, "uuid": "1608124a-b8e2-4696-99e4-afaa46ef6fb6", "comment": "Malware payload (Formbook)", "value": "2a3116088b3fdecea999d1f3574feb74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672909, "uuid": "51e1f7d7-876f-48ba-8c0b-25cb7b9cd668", "comment": "Malware payload (Formbook)", "value": "2494c4777a655ce4fe748567a8f0b77e86bddda01f6965d6a3e4012241ba3582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672909, "uuid": "6f37801c-bf5f-4b16-b2dc-246907758b29", "comment": "Malware payload (Formbook)", "value": "64c9bc4eee1f0b01a2ce1aab36d961e960837531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672909, "uuid": "54a79214-3b20-44e8-a081-92e596a3c10e", "comment": "Malware payload (Formbook)", "value": "dbb8620a2b2ed8f49032bae2c72eff9e2a37059376ccdf9291598fd67d6f89b9bed7aa172d0811e3676df2143455500b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672909, "uuid": "a6b98e8c-105a-4440-90ca-bcbefa7b7395", "value": "T12E45DF3920338A92CEAFC7FA4775151E4FACAFFE9047B6742894707900F4B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672909, "uuid": "668119be-0b33-4312-8358-67d42f6476e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672909, "uuid": "84a70c4d-ced6-4bdc-953d-bc563b3c22cf", "value": "24576:eyelDHdaLNFrubZ3mJaEJ/TSTrnYbCug20biYuWOBfWlB:gHdmNFrCZ3WZTdCVJbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672909, "uuid": "381dc515-08ca-48be-b0f9-a49ba2e9ae5b", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672909, "uuid": "1cd2f080-6e41-494a-99ef-15aba0aecb58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672909, "uuid": "413124b8-9fcd-4bc1-8acc-25b221563d80", "value": "2a3116088b3fdecea999d1f3574feb74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77040dc2-deee-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625640134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640134, "uuid": "1655e82d-0eb0-4eab-986b-f2fe209e26ce", "comment": "Malware payload (Loki)", "value": "cf7625f31be8349cbced5630cbca5a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640134, "uuid": "17291d81-e34a-483d-ae56-44d342e0071e", "comment": "Malware payload (Loki)", "value": "260787b8265c23f5bd922d6345f14a7f6242e336375544e96fe325e31af8a5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640134, "uuid": "67be2a79-54c9-42bc-b67d-ceaceb824343", "comment": "Malware payload (Loki)", "value": "98bbb038b57c286c88cf162c0d987443121c3856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640134, "uuid": "caf37d48-bd15-4479-a417-645fae860729", "comment": "Malware payload (Loki)", "value": "27086d54a0a06ae270be3041eb84fffde84864a99f9ef14802343443ffecd25568766834cc621bad00d9561261def35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640134, "uuid": "517bb789-2999-45eb-a763-fd66d88fdd7a", "value": "FD35BE7A60378A92DEAFC7F90730661E4F6DAFFD904BB2741844B47900F4B4D4A6192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640134, "uuid": "a5b16dc5-e42c-43d9-be16-6c4727c0628f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640134, "uuid": "29f308e0-1ea1-45d4-b0db-7055ef1551c8", "value": "24576:gD+HDHRVNPtXeY1V36PXCLrb0cS0biYuWOBfWlB:gDoPtzVqaLHjbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625640134, "uuid": "c9b0f7e0-5d26-45d4-82ad-3e819c76cd11", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625640134, "uuid": "1d9df560-1cf3-4685-9321-48f3dab624fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640134, "uuid": "ead16ad5-ccd3-4701-a272-df452b47c328", "value": "cf7625f31be8349cbced5630cbca5a2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78e1f02-ded3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625628700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628700, "uuid": "194df1fb-6326-4214-b83b-966400a61435", "comment": "Malware payload (Loki)", "value": "b60ae112f4898aca1b339db1e626c248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628700, "uuid": "1a2e7d02-883b-46f0-8db3-d1b395ea5bc6", "comment": "Malware payload (Loki)", "value": "2684761e515818d91fb705bd74babffe9519789b3c4c4e1ebde638a2a354ab92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628700, "uuid": "9f66b981-d483-437b-9b11-9288158fa0ff", "comment": "Malware payload (Loki)", "value": "82a042d1f0a9f2ef6a1ff40b7b00ea722c663580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628700, "uuid": "5e3f2198-32cc-49d8-9dfb-82e0c5094709", "comment": "Malware payload (Loki)", "value": "88c522490ef2298f7b32c6366255c370b557a2476f42fbc45a90ff221fa8c881cf38c68a1cdef53b6aa8a396c0e4a94d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628700, "uuid": "b3e32ed7-9bb3-4840-960e-797902532e2a", "value": "6835D07A60378B92DEAFC7B90331262D0F6DABFE905BB6741884B47500F4B4D4B61927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628700, "uuid": "945a2cf9-277d-475d-a642-11c0d16b0e25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628700, "uuid": "6bd9524c-bb13-4b2e-90a9-b005cccff193", "value": "24576:h++H63OE+ecjHknDQ6zga+/76GSi51yZD70biYuWOBfWlB:h+UmUf6zga43HoKbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625628700, "uuid": "578d091b-8d2c-45e0-9711-9bf2a6350c00", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625628700, "uuid": "110dfbf3-d890-4c48-b2a9-f0c3765c2a14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628700, "uuid": "89dde17c-525a-404c-a915-8ecfa01b530a", "value": "Ordin de plata\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1194f5a8-df4d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625680766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680766, "uuid": "1eb2cca2-6fe8-4a4d-b72a-eecc0feb7672", "comment": "Malware payload", "value": "e49eee89e1adafae8341de2715ff7e83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680766, "uuid": "c5a91d47-b4de-484f-ae0a-bbbb15439f2e", "comment": "Malware payload", "value": "26f1474242bed056da91e2242d5ffc4a4b92ae63db197df13aeaed97724f4295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680766, "uuid": "307ec5ae-331b-4981-966d-ab093d09e5e0", "comment": "Malware payload", "value": "156a4d225d28ec1db0c8e71aa74070c504179714", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680766, "uuid": "4ed5785d-fce9-4ccb-a842-d33f03949e41", "comment": "Malware payload", "value": "8a520cef3c222c2374a18cfebf217f004963ce81d0ab5a5dfdd34afd680bf443cb24831db7a9fe29ac18060c3aec8d75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680766, "uuid": "ec5c4527-ff66-4e9c-abdf-9899a3fa14f5", "value": "T17314D15076C2CCF0F4A319360CF5E37F5F3E75128A10CEA7D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680766, "uuid": "7fbb1cc2-fd5e-48a3-b440-267ee1a100f9", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680766, "uuid": "e16a7ad1-a999-4ad2-9351-a8cafc628262", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjHpYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjKfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625680766, "uuid": "f823acf8-9f8b-44cc-9652-c3ededcf4a90", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625680766, "uuid": "1502ce8f-36dc-4f40-8739-72586d630d7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680766, "uuid": "d51bc918-1dca-45c5-82a8-019a7b990c42", "value": "e49eee89e1adafae8341de2715ff7e83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3860563-df37-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625671515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671515, "uuid": "8e689c4b-9564-4283-b30c-a619e4af669f", "comment": "Malware payload (BazaLoader)", "value": "7484d7f01dc2ddb30a6e3027389d53a6", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dexored", "colour": "#496A89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671515, "uuid": "551b0017-63a9-4dbe-b9a9-aba2f1ecefcf", "comment": "Malware payload (BazaLoader)", "value": "26f3b97dfdcffc516a890f5e0bd3539c63603c26bea8298e7376ab9f9b53433a", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dexored", "colour": "#496A89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671515, "uuid": "9bffc0b8-7728-4986-a10f-601c1606f1d6", "comment": "Malware payload (BazaLoader)", "value": "9b0061a53b5e2e6bdb30edb55eafc8ea89ac9fc6", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dexored", "colour": "#496A89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671515, "uuid": "7454b851-2b1e-4191-810e-00bb4a6d4c8a", "comment": "Malware payload (BazaLoader)", "value": "59e3c5e1501cd06e14b1e49adf81b7d1f9a1447961b87b1a78b4843951bb2e5e5d4e93429162164192fefa0d56b9b1ff", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dexored", "colour": "#496A89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671515, "uuid": "2c9c7c58-1f82-4207-ad07-4c0f7401bfa9", "value": "T1B4048D11FB83C0B5DD6708B054E0A53ECD383D144578AEEBDF908F6E9F242618E39A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671515, "uuid": "82d18fec-e48c-4def-85eb-006d93c61fb4", "value": "aade7ba79f860dd3dec2afa9daec4f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671515, "uuid": "12f41bac-021f-4c00-8b49-ad5bbbd202f4", "value": "3072:ZfkkLfel75uouLeviqlFXr9Gu3ttrk1h6FDa0zzQxEtt9Q9jBu/vmOTMrTdGuUav:lkkyXEattQ1h6HQuto9F6k0uUa2YGZU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625671515, "uuid": "588f4ea0-a600-497b-89bb-b3007c9336b0", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625671515, "uuid": "53f6e4e5-333d-4721-bb72-961c512a13b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671515, "uuid": "9bc4bfad-4dee-4ebf-8bca-2e34fc123f7b", "value": "FQ4jzOGrg6udVQoV9d7S.dexored", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fea7f4-df4b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625679993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679993, "uuid": "b092813b-6d57-48e3-a0b1-63def4cfb3e4", "comment": "Malware payload (Formbook)", "value": "a019fd780d291a7883aa244b8027753e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679993, "uuid": "bb044551-08dd-4242-af4c-cf3fbba38b34", "comment": "Malware payload (Formbook)", "value": "277238fe27aa1e904990216225711e69461b664ac96e6537db8f92f798a2487a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679993, "uuid": "a529cbfc-1ba1-4236-b85d-7b9f5ef0298e", "comment": "Malware payload (Formbook)", "value": "5df96d4ea308d2212750b0a76d1c47a02a42b53a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679993, "uuid": "dbfb685f-1dd4-4506-a1c2-b2b332479413", "comment": "Malware payload (Formbook)", "value": "a1dd02814fe767474ffe2bce738d7ec9b8ca8b02a4023eb7c31d3bb6e5fdca245ceaebf14a036f65a74a8828f9d96548", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679993, "uuid": "e3758c0d-1cd1-493a-aedf-2c77cd86e74d", "value": "T159659E3576769F91D87FC7384331E13C4FB9AE66E213E2B46CE4389B64B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679993, "uuid": "da5492a6-a5a9-4945-9c5e-cc2775337a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679993, "uuid": "8e900b6a-bc21-445b-9c93-160b188dd7ee", "value": "24576:+qbrRGiOGabX/0bQAzt587B8rY3LAGfLVyoFnvj:+qbrRGQwMfG7B8sAMFnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625679993, "uuid": "311033b5-4c07-4a4c-85b3-b13e2bc7f688", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625679993, "uuid": "a9dad093-351a-4842-b560-43b2830ea7ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679993, "uuid": "30d0103a-dc28-48b3-87c5-478b51791337", "value": "Ordin de plat\u0103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f01d011-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625661622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661622, "uuid": "0e5aae22-33c6-4d3d-97bd-ae3f92fbe428", "comment": "Malware payload (AgentTesla)", "value": "0f7e806d7fdbff2ea81432fb1da0d38c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661622, "uuid": "290b778b-6406-4170-a2fe-1c1cb6b9916e", "comment": "Malware payload (AgentTesla)", "value": "2851a4554cca2d9d75f9c90f8aea43db1c28207868e1641fcc431353564a2708", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661622, "uuid": "8fd38f76-cada-43c3-a465-77f54639b854", "comment": "Malware payload (AgentTesla)", "value": "7064a7ae9e5da56ebafbe3aebdde54476d05b40e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661622, "uuid": "b755eb68-31f7-46eb-8b9a-66399854da04", "comment": "Malware payload (AgentTesla)", "value": "fb50d7a4efc5cd51f28b2f9498b2ae678e5fa0c4e4c3d9fe9f71c9513544ec688d00005d9f363ccd7439bfa2e86d1e0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661622, "uuid": "88e9cadf-0091-4656-9103-bd50e51d2692", "value": "D945CF7620338A92CEAFC7F94772151E4FADAFFE914BB6741888703500F4B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661622, "uuid": "20b2e50f-0f75-4e41-b330-006f69081905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661622, "uuid": "a417799b-15da-447b-9b7f-7e29dcfd0922", "value": "24576:HRa5RMRsVJbXqxrudvuN1naU3rTsU+vyvz0biYuWOBfWlB:Hc5RMYLq6CnaUXh4biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661622, "uuid": "d1b28190-e153-49d5-ba71-ef024103b943", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661622, "uuid": "252cb794-3e2c-49c9-8b42-3faaa9803448", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661622, "uuid": "1333b109-4d55-4074-a822-b553287cb75a", "value": "Delivery Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ada7a1-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625637714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637714, "uuid": "c277fee5-08aa-4189-bce8-1ba4962455f8", "comment": "Malware payload (Formbook)", "value": "12ee4beea062358df790ef9a6b994de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637714, "uuid": "9eca8c8b-b04b-45e9-be09-893d81ae91fc", "comment": "Malware payload (Formbook)", "value": "2d144aede91490944935dd273b5993d2efce771f5a6f522ef3a403f011920603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637714, "uuid": "b11beeea-bb49-48fa-abb2-47f6c3c14a4f", "comment": "Malware payload (Formbook)", "value": "0e193b1c0cb0e879d45b3d79d4021a3e564590ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637714, "uuid": "f879fa8d-b94e-4ebb-971c-d1c0b15c2e3e", "comment": "Malware payload (Formbook)", "value": "716f33e551c8b8ddaafcf4c42e2d0117b6340da4af708737adcd2bd17a945f4d25a227576ce75cc80b16db1d6030e938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637714, "uuid": "5d1150da-3da6-4936-b118-34dcdaf4ed8a", "value": "7CF45A983312759EF4168832B957ECF0E6107E665B0BC20350D73FABB91E5D6CF910AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637714, "uuid": "63e3e32d-0439-4e28-a0a4-17e525db1500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637714, "uuid": "ea54abb8-4f42-44d5-9540-e8719c1b6e85", "value": "12288:Uw62oHEbiI/4lR2i7Q904ojRHgugDmKDN+sSk1WCCBq4qK+dLY:l62oSioRi7I+jRHmmKD1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637714, "uuid": "c127ad91-3f97-4818-a981-8799c4179748", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637714, "uuid": "f2fbc9e6-be56-4807-bc73-4bb0b46b1ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637714, "uuid": "d8391692-f3a8-448f-ad58-9ca0dba2e015", "value": "product items pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39481b6-defe-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625647161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647161, "uuid": "b81048dc-ceb3-4934-87ec-a2c754e6fad4", "comment": "Malware payload (Loki)", "value": "95b974feaabaadab850cc3c8fd22df26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647161, "uuid": "56d0ed38-9ff7-44d6-938a-314ffbf55b4c", "comment": "Malware payload (Loki)", "value": "2dce24eafa10621801b9f984ddb754e5955b4d5d08d06c8ac6d59c023dcb9ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647161, "uuid": "faf2ed47-de51-4dc6-b901-71f7302891ce", "comment": "Malware payload (Loki)", "value": "e201793f56576cd12e3df2e0f2033542c0d398f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647161, "uuid": "80da6318-bca7-4056-b2e0-0f62d9a48613", "comment": "Malware payload (Loki)", "value": "c2e1cae4a40c68e2114d19bfa04c88c9c1daa81df9baae6fd17f84ab8fe29d0ae5df606a49b18a3cf15f0ea58a5bd069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647161, "uuid": "9a8aa1b1-2e80-4018-a47d-73832755acb9", "value": "5C35BE7A60338A92DEAFC7F90331652E4F6DAFFE904A76781844B47500F4B4D4B61A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647161, "uuid": "3c7cce52-695e-46f5-a452-f6492c1f571d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647161, "uuid": "22b68449-4fb8-4c1b-9075-1f8711615a3e", "value": "24576:tk+HGrlcQSBnn0elMQjXrMNkG7XD80biYuWOBfWlBF:tkNyQKnnTCQjriL/biBBBE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647161, "uuid": "3496cdf2-24e5-4697-8eb0-85b123ceea49", "value": 1115660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647161, "uuid": "aef4d883-0f73-42b4-88d9-8218f235404e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647161, "uuid": "d6e5ebe1-8523-4f66-928a-0d6bbd18de49", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb17d95-dee3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625635500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625635500, "uuid": "8bb6fa54-e8d9-4819-9370-3c271fd87353", "comment": "Malware payload (RedLineStealer)", "value": "cb3e9db04124b382e13e15404144531c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625635500, "uuid": "f88c434a-f651-44e9-9d7f-85853f0f68af", "comment": "Malware payload (RedLineStealer)", "value": "2e5c841497c4beb1aa615b1ae401e099af9e7134f021d67a15700f1e8a18c543", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625635500, "uuid": "41191240-f468-4de0-a56b-bd7fd07c4ab9", "comment": "Malware payload (RedLineStealer)", "value": "ec61c22416b08c59d280284d7a6e19c191f9df19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625635500, "uuid": "fb0911d5-b30a-435d-8741-8f3854483d43", "comment": "Malware payload (RedLineStealer)", "value": "e54c6d7de177892b0f07cad313aac80d61b086f97b690ae7589d0d31d3d92a60e2357a909a166fb2e9c034aab1cad6ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625635500, "uuid": "3c20dc0c-e8b6-4e27-8e0b-702e19adca55", "value": "B2453362769CDD4ADA059775DC2EAD003350950FC531E3AE718FAA2BE9332D2633364B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625635500, "uuid": "575e5391-1cbe-4038-a9d7-90583899f12a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625635500, "uuid": "c679b16b-c600-464b-9e62-cc4644371254", "value": "24576:CsilQTZpAFDlsUPu16XHizlatzJQrwGxPGsa2LgcwTQSju42UXuqzk7A:CepQDlCOC5aBGxOVtJT9fXPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625635500, "uuid": "4c791cdf-8d58-42d2-9025-777596734703", "value": 1238224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625635500, "uuid": "a8d2ab98-7290-408e-867b-02c3e96effae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625635500, "uuid": "0683a40e-6386-41a5-b86f-0cb145713eb9", "value": "cb3e9db04124b382e13e15404144531c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91729dc3-df09-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625651775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651775, "uuid": "9e24e893-e3a9-4779-b887-319776b4e097", "comment": "Malware payload (Formbook)", "value": "4e44665c0e3efa79b5860eb6f0fb018d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651775, "uuid": "3925c822-c3b0-4608-8736-c7521b1ec80e", "comment": "Malware payload (Formbook)", "value": "2ed038df20b8f41a844651ed1c2cdca2ccabac5b7a946ac06a0892f641481973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651775, "uuid": "8b9bbecc-616c-4057-8938-23edc62219c4", "comment": "Malware payload (Formbook)", "value": "f88110dbbe4877a343a7bc4aa36f56366f200496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651775, "uuid": "bac8e8a1-ff7e-41a4-84aa-a217e43318fd", "comment": "Malware payload (Formbook)", "value": "b551ad46333bfdddefa2e4273facacd4c215a7c13b20cc7a93b577268fd597e06615105d473c16f2b7afdefbfed718e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651775, "uuid": "40008b45-9ff8-40b0-b905-778fa26f0dc0", "value": "67058CBA60764B91EDBFC7380331161C4FA9B37ED21BFAB85D98B59801D0F450A92937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651775, "uuid": "ada32663-6677-424a-a0c6-89aa079a2607", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651775, "uuid": "98066fa8-d730-42bc-a98f-35dd72745c09", "value": "12288:cCwyBP6NsBvx7JZlyjsPEwZcFLlJ35qVfKVv8pCS8cN+TN6yZAM:cChP6NMxpyjsfcFJSJKZ8cQYxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625651775, "uuid": "3783bfc0-d0ca-46dd-bf26-24ec27250b0a", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625651775, "uuid": "f1843720-ea72-4e18-9d2d-3b63a2cdb70b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651775, "uuid": "e250b783-5f99-4d42-844c-c53ae5a3bbd0", "value": "2ed038df20b8f41a844651ed1c2cdca2ccabac5b7a946ac06a0892f641481973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7332ab1d-df44-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625677064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677064, "uuid": "25457828-01f1-4484-95a0-7d6352b028ad", "comment": "Malware payload (RedLineStealer)", "value": "954812278b07d656dcd4975b939b259a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677064, "uuid": "d2be15a3-4cd3-4972-9f63-9f294a33019f", "comment": "Malware payload (RedLineStealer)", "value": "2ff7ffce923329f55bc637371e54822d6ceee9962c807ccc42e3301e0a8a2cae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677064, "uuid": "d553c98f-0a8a-4640-bbda-65fe6123145e", "comment": "Malware payload (RedLineStealer)", "value": "13545df56d72dcbc8284d4d61ab879897974789b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677064, "uuid": "e7200815-fc09-4a8d-b10d-a22d8c3726cd", "comment": "Malware payload (RedLineStealer)", "value": "2720d275d3b33e4e7ea14309eb4658ea3105b80545ee7e7a4aafe082d272f956d30fb750ca161ba8f3235a16d93fe782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677064, "uuid": "2397fedc-86ff-4e81-9dc5-9cf676a16db3", "value": "T174D47B2576104929C37706BF83B37163017D9E076962F99D3AA537C80F3F286FA4AA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677064, "uuid": "6d75b3de-b36c-4b2d-ae68-b39daea81654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677064, "uuid": "024ab0d7-6f9e-413d-ae3b-bf5cc0dc013a", "value": "12288:JhqryhZQuabPqFjCH3FtnGk0eHJ3Ap1lIjZ:JUAiuWgjW3n0e8lIjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625677064, "uuid": "04e23491-5c0a-4297-a553-931270310145", "value": 620200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625677064, "uuid": "f06b3208-bdb4-4f7a-b1ae-f71edebaa149", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677064, "uuid": "a5ce52d0-6b2b-40ef-a216-93e8f9ef816c", "value": "954812278b07d656dcd4975b939b259a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1747bff2-deff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625647275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647275, "uuid": "95620f5a-ff33-4b72-8371-b5d3754a4bea", "comment": "Malware payload", "value": "7005d5f57a0742e31078f5567e7db5ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647275, "uuid": "4ddb431f-f72d-46db-a0ab-0b19782eddf5", "comment": "Malware payload", "value": "304058eed0636beeff43ac336526e5f76b67279d753be0fc0f74f2e2523296da", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647275, "uuid": "f95a5022-c1b0-4cfc-89b9-0d856c16ac9c", "comment": "Malware payload", "value": "e5564917ef975c79f350e9598e5b46dd1a1d5f34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647275, "uuid": "e90ac0f5-5f08-4700-b6c1-a2fa9bd9943e", "comment": "Malware payload", "value": "3579b407e3670efb3fa145253aff49a7813728d747487a5cf254264f5bb35ced46908dab2ab3bbd32d74a8b1ba1ea51c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647275, "uuid": "757735a1-a1f9-4554-bf18-0c6e007b08b4", "value": "15C1FA1B42456E79D550780F32CA1C9E63BDCC487B72CD8CBC998883F5553B85BD4876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647275, "uuid": "2ce0f512-ac66-409c-9d10-7e31ccd3dabe", "value": "96:L/TBjyQTEVsNDy+qU6w6U5rhxyKZwx2J7+HWYffE:jdyQNItUCsGW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647275, "uuid": "2a917072-9f30-43ee-91ed-fc2fff78ccde", "value": 5957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647275, "uuid": "5c12604d-59c2-4b1c-886a-a8a7bfd020c9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647275, "uuid": "34f19446-3be0-4d8e-bd59-78de8a21a269", "value": "9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f83c6c1-df22-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625662509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662509, "uuid": "37fbe702-c7b8-49ce-a63e-99516e0c79d2", "comment": "Malware payload (Formbook)", "value": "70feaa81667fb00ffb496579f56b7bf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662509, "uuid": "b59f3c76-9a8c-4514-8123-3c08f8dd0ba0", "comment": "Malware payload (Formbook)", "value": "314c2feb9e8798e4676b9350faba5721af148fa1e04fcaac8e698bbb027aa7cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662509, "uuid": "f603287f-8c31-4d60-b9ba-38078da9eaf8", "comment": "Malware payload (Formbook)", "value": "c565c5541211d1dffc0026c3373ea2dd8a5e7f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662509, "uuid": "922a2ce7-2da7-48a5-ae3e-e3b8b7ceb583", "comment": "Malware payload (Formbook)", "value": "9ecff048294c314a0e0c1521b5c14701ccd75ffc170395f11a2d7486614d869f005ee72ca8619b2400e4fdd237a6a6c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662509, "uuid": "7ec78cab-789a-4161-9f31-2ad2ee35bc9c", "value": "FD14125893E0C87BE5B3C3B1AE7166B32B97A81819721A1F13308E4C7E553D2CA0F395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662509, "uuid": "5696d59b-17b6-4d27-8670-a3d18346a74d", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662509, "uuid": "96566f88-386c-4962-84e8-ee3890b871be", "value": "6144:xMm4CCAMbxnWaSh1rjEndqzH0uMKbHJCsF+kV:xMwRMbOeMAuMKkKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662509, "uuid": "09f10f7f-b79f-4a5d-9a1c-acc0901bddf4", "value": 199981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662509, "uuid": "1e467e2e-3d1b-49d3-a8e6-a786850ebbb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662509, "uuid": "5fb5fd5b-1d75-45e1-ab00-a4453a3af99e", "value": "Maersk Line Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fcd1bb-df60-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625689150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625689150, "uuid": "6528e6d8-1944-4b34-8974-99249afcbdf0", "comment": "Malware payload", "value": "3ddeea156606b2e5d19c86cedf3dec30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625689150, "uuid": "e494ca18-53f3-4e74-a234-e27fa09de62d", "comment": "Malware payload", "value": "33cc3816f98fa22354559711326a5ce1352d819c180be4328a72618d20a78632", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625689150, "uuid": "c255df37-8449-4905-9dbd-e51518bb631d", "comment": "Malware payload", "value": "df75313a6c6af17bcfbaa55a693314b34cf97c1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625689150, "uuid": "98179a93-1e7c-4270-b63f-e93c41333e51", "comment": "Malware payload", "value": "ee0ec8bab13d926da23db0e3895443ab3e57ee7657567572b83e638cbb3167501435c83b675d657fba08bf11de138950", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625689150, "uuid": "9ab6c630-7cab-4726-aad2-06409d278bc6", "value": "T10A532A53EA650094D6EBCABD456E6B3BB8B87D4B0710B756F774C3C29322F65A811303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625689150, "uuid": "a4ec92c8-51d9-41c1-babb-af4fce1fa8dd", "value": "001d993cb52b06dd86f1aafa1c13bed8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625689150, "uuid": "32b005c3-f107-4a13-98ac-efd61c134e98", "value": "768:2qLODVjNPDZUEix9i3Mb/pvj5ZzbQJbTfHUdV8VTkj7DjpqZMRQ:2DDVjqx9RZjvbQJPfEA4/DEZMRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625689150, "uuid": "b45170d5-851e-43c0-b03f-de3879c63a99", "value": 63880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625689150, "uuid": "7dd6805b-c93c-4700-b19e-81a3c526953c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625689150, "uuid": "45358552-2357-4431-985b-bfb7a8d386fa", "value": "crv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b4f456-df42-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625676263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676263, "uuid": "3edead1a-2cc0-42bb-809f-1f6ef9994562", "comment": "Malware payload (AgentTesla)", "value": "e9b71f9a277178fcb296797e51926235", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676263, "uuid": "63c83a20-3bda-493c-afcc-f326c06f70d1", "comment": "Malware payload (AgentTesla)", "value": "33ea296a82c06a50910b4c4ec26a31c5e6af0e3c68519018adf4941122d627df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676263, "uuid": "2a63e586-04b4-4ec9-ad0f-c602a0c6edfc", "comment": "Malware payload (AgentTesla)", "value": "c681428e1d18b0fbc75d6a72cbe0e224ce90d8ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676263, "uuid": "c4c011b3-344f-48ab-a941-c91e75b0bf5f", "comment": "Malware payload (AgentTesla)", "value": "bbf7377d28b0d43e2163dc331b1cc350b4852addedddb0086dbacab6ebe34745b5ce5bfec0d9a78544f18eb482f2675f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676263, "uuid": "971b798f-ab21-4410-abdd-ea1fb3b3047a", "value": "T10BE4283A76955617E3BA65384F41C031F3AD8CDA763198A242D32DDB3DAD6233DA132C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676263, "uuid": "07c431ca-5b4d-4b8f-971e-731071395b29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676263, "uuid": "8d00807d-e3e1-4de5-88a6-317958b58ff2", "value": "12288:a48EKlXgFxY3wBeTnT3rqn8ntjlfm7crQgQFIwonfdK7s4JhbiinC27:UT3rqncpOxFIu7sdinC27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676263, "uuid": "edb33c9d-dabe-4db4-a944-fce08918f638", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676263, "uuid": "2440330d-2044-4972-a64d-856ed10f3ac8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676263, "uuid": "9fd57d97-2ddb-44f4-83e2-7ce1d4ba52e9", "value": "MV Colossus Particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf30bcb-df73-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625697373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697373, "uuid": "eebb687e-1cd2-41cf-a35b-ac5f894d6def", "comment": "Malware payload", "value": "c1366c7e949f42c3708cf8a6b9f8b59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697373, "uuid": "1cd77c45-ee66-4ce8-9c0d-a4e3bfd2d75d", "comment": "Malware payload", "value": "361c9dec84262c2fb2bde97fa077a3461cf150f12e372bda676eb9cd0f58441a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697373, "uuid": "4915ee40-da99-44ec-ac3c-7b1827707a5e", "comment": "Malware payload", "value": "a3dd7a2a77b7cc7c224d1636028eeecf4538b4e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697373, "uuid": "595ed07a-4684-4346-afb5-9bbf02004e4c", "comment": "Malware payload", "value": "1ae2fd496e3ab9367d81f781e958e647a7e5b700c7e6af1c6edf726ba569baa528f85640c7a2f0678794e8a90b16e5fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697373, "uuid": "2b684df4-8b0b-4f7b-b780-5273515b3beb", "value": "T1C97412A0A5B44B26C46E03F15023DBF00F79EF045D28E6DF9BA97E4A10B374513E1A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697373, "uuid": "d0b6f2c4-9f58-47ac-88c6-bf636ac20d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697373, "uuid": "3b1cf4c8-ada6-4d18-bc51-b1a8295594c2", "value": "6144:RxQTGhnzsWKaA25eSiVDrDjrZAkb7OXNMG0QpyFEgciDk3F8G1LwOegBfhWx7G:jNFzsjHlHr8XNMG0EyFEgc7V8G1L/BQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625697373, "uuid": "c9ab36ff-d5b4-420e-840e-07176fa2c408", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625697373, "uuid": "dcfcdf2b-0635-4bf6-8606-47460ba64656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697373, "uuid": "ef021e54-fdbc-4571-a63e-88527aa3d58e", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.16176.32764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde09b0b-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625634267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634267, "uuid": "75efee11-d110-4f40-a787-5cf80de8a61f", "comment": "Malware payload", "value": "388a4f0dabe75e87fd0041a75fd20130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634267, "uuid": "59123054-ae52-475e-b86b-bfcbad32ddbf", "comment": "Malware payload", "value": "37ef1ef47fcd6f019c1c28439002229881073b8a911618df7313f0a7f2518fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634267, "uuid": "e9c795f0-b5b2-4b4d-80ca-55134f1e122a", "comment": "Malware payload", "value": "e8b459b63a7a1afbab9c9165683766462449a64b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634267, "uuid": "bc7e6092-2914-463a-b984-e99dc0d7fdc5", "comment": "Malware payload", "value": "1d78ddf2b3dbc3fb6ead4396db13b215221da5f37636d8a81da1b69111f8084421ef094144e75d87ecbb5409736ab4fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634267, "uuid": "c3b2b830-88b8-4f1e-b16e-58856f4bae4c", "value": "BCF40A84B202619DF816CA31B977CCB0D6113EA95A36910F10CB3F6B7A7F6D3CE510A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634267, "uuid": "5aebedec-b2a6-4a50-a31c-a2df303b16ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634267, "uuid": "6ffa2e5e-30b8-4ddb-9182-9c5aed8ab7eb", "value": "12288:1AE5psSstWszVDmU0UyCApgP14y7y+8e9A+hbFuoVaftHGvrP7r9r/+ppppppppV:1vjxstWWDm9UyCbiq1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634267, "uuid": "eaada068-e720-48b7-9467-b8b18f582721", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634267, "uuid": "a612298e-ed7a-4c44-97ac-8560ad4978ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634267, "uuid": "647d31e9-c070-418d-bbde-13fc9bcb421c", "value": "bank account details pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db91587-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622912, "uuid": "5b9c31db-6e3d-4798-a121-6de079b6516a", "comment": "Malware payload (Mirai)", "value": "da3f804785a7e8e044ea86b0d64e0efd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622912, "uuid": "4ff5d95c-e3a6-4863-a1a3-b14f44c36087", "comment": "Malware payload (Mirai)", "value": "397c5420411346e52798344272366581c595821fe702d2725f2e85c87932addd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622912, "uuid": "3b428697-70b7-4c3e-a4fe-bc9437978936", "comment": "Malware payload (Mirai)", "value": "b9be276e872724953d641f555ed2c834fd709eb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622912, "uuid": "b5c34fc2-7bdf-48ac-9ac5-43daf458a3b4", "comment": "Malware payload (Mirai)", "value": "3b8450682628b6c8c4f9dbc9c1899ed209e55e7082358bdfe45d354e23e8c247c6c5281fb5c9b62b25df9080d6ca045d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622912, "uuid": "d8f7b25f-7068-41aa-88c0-589ef405ab6c", "value": "17635B24A9792E27C4D4A17F62F7C321B1F5260E25B48A6D3CB50F8FFF2468064572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622912, "uuid": "150627c7-3125-4e18-b6d7-6bf85d9145f1", "value": "1536:LdLCLiRSQtNTFddyAI+gccU+zowi6voBUsXFxP:55omMAI+gc/+HnvohXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622912, "uuid": "ffc2ddad-faa1-41c8-8607-63412e77bcc3", "value": 72580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622912, "uuid": "38118966-5b18-444b-821d-a19e75468042", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622912, "uuid": "2d123176-ebb9-478b-a046-8988441ac55f", "value": "da3f804785a7e8e044ea86b0d64e0efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e604cd-dee6-11eb-875b-42010a9c0053", "comment": "Malware payload (Phorpiex)", "timestamp": 1625636741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636741, "uuid": "5b18dea9-01c8-42b7-85e8-c575de0523e4", "comment": "Malware payload (Phorpiex)", "value": "58082f11d6f6c275e933ee83f19b1687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636741, "uuid": "92bcaa3d-7df8-442c-9e2d-73550a37ad7b", "comment": "Malware payload (Phorpiex)", "value": "39a049ad593b7405e767213e5e3204b7be9b8c38add91b124294c1a5bbfc2871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636741, "uuid": "6c178c75-8d67-4c4d-9224-c54f85ada775", "comment": "Malware payload (Phorpiex)", "value": "6edcb084961425307f009af934d0b47a6b96d87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636741, "uuid": "5c8b5931-dd69-41bc-9f2e-f73a761b3d8f", "comment": "Malware payload (Phorpiex)", "value": "4caaab54608d1e613f1c9f03be11661bae0f2c003547d7a36a29147872b86b4b05a1d3e4e3124c926eb5120754306108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636741, "uuid": "20cc79c6-a182-4897-bff8-8af81fcb89a8", "value": "87029501CB6005A5FAB11A7142B647DCD93EAE33174A74EF327B59898770F12863263F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636741, "uuid": "2f8d56b2-e6a6-4104-83cf-4004ff042570", "value": "1563b2ee8126d5f7f20b72d997b7505b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636741, "uuid": "88a44776-60f9-4ed6-8eef-deca6e2a9ef8", "value": "96:UXZxDzfGc7oplBkmBS4jTRmstboynxnzbACtIs2:ULvT7r+11oynJz3Is2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636741, "uuid": "3df9c451-e170-496e-bdda-8127c97d1d77", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636741, "uuid": "0facdff9-33be-431b-a96d-097da2e85cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636741, "uuid": "e67d9d7d-c94d-428d-9973-5837186d29d0", "value": "58082f11d6f6c275e933ee83f19b1687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cae31b-df32-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625669551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669551, "uuid": "3f3d8ba4-6a13-4121-a695-ba83059d3244", "comment": "Malware payload", "value": "e5301028c71f525a8bf0883901a152c4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669551, "uuid": "c8795d0f-6f2a-4dae-bbb4-1b792305ecb1", "comment": "Malware payload", "value": "3a0e23595e6fdc660095663b9623a7b5df58f6115961602b6722b91ee1fdf1cd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669551, "uuid": "48cc23c1-e85f-49ac-be1c-452007011263", "comment": "Malware payload", "value": "bab0dc80530e614cdd293364ca42be9b09e367d8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669551, "uuid": "2fe3b26b-ce6e-4df2-add2-6381c0ed1787", "comment": "Malware payload", "value": "c98a05b40ad01bc45a7ed81bfcbc72e3ab793beec87d96bf3aa05390814b2761ecdbebff7a30c81cbeea4841094ddb4b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669551, "uuid": "bf7b53ee-ebd7-4b00-ac72-dcabf2c124d8", "value": "D644BE76472B6DDB0F710C47F05E6A85CCAA68B7F369A581EF84418A4BA013C1DB9DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669551, "uuid": "7399903e-e5f9-4bac-9633-8b34476acb8e", "value": "6144:vMvFzgnTKIyHe3v3LZ2luJj97RoOlspdThmbpgRv+h33mkUi8IWK:vgixyHejZlJj97NsFm1gRuHmkeXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669551, "uuid": "863d68da-4123-4a03-8424-45c3b3216c74", "value": 277856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669551, "uuid": "702d118d-5810-4825-a8a5-58c58f78e353", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669551, "uuid": "10505243-4704-4fb5-8e69-cb0c74a6dd56", "value": "Itinerary.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed657649-df22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662666, "uuid": "9048ab74-9b13-40d5-8254-a2c430b24c9a", "comment": "Malware payload (AgentTesla)", "value": "554189e2c13ce6fa82de1c66d3cf2ac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662666, "uuid": "c36994a6-9ef6-4ad5-9bfe-086f8f6f0f83", "comment": "Malware payload (AgentTesla)", "value": "3a5552eb8225b7d738de605a091210aa67b61a3ff262e2f7c75a5c7f8c314c3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662666, "uuid": "4e6b837d-604b-4620-b186-264238fc8d51", "comment": "Malware payload (AgentTesla)", "value": "7d7a8e7678fab1fba154633c68add9a5e93efaf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662666, "uuid": "3e749a10-5c61-4429-bf6b-2641d4d50a60", "comment": "Malware payload (AgentTesla)", "value": "7cf5cc909da1d6b57c3dde840e488118561084f9fd80a5b03a7a9aac390c0826fb11111e0d614b438143ac2d866dd717", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662666, "uuid": "cd87368b-6acc-43b4-9b30-bdb1e1f3c755", "value": "CDE449983312759EF416C836B956DCF0E6107E664A0BC203A0D73F9BB91F5D6CF901AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662666, "uuid": "3a67c08e-1d8a-4f99-bb4c-6418e13e0ec3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662666, "uuid": "012b0ad2-c21d-4c8b-abb6-11de1b9129b4", "value": "12288:QsNzcs87gblE+PdO+ih2lydRur9YW2hoGnMYQ+IaqUUrfr+622c1BxkZTw5FPLpn:QscGjPdO+nQer9L2Rq+LqRrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662666, "uuid": "2d4dd5e9-553d-4fb6-a5a7-552c209eb33f", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662666, "uuid": "d03cb879-aaf5-4a90-b634-52a9980282e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662666, "uuid": "93ef5e5d-816d-49ef-aa81-a8e5a334ded4", "value": "SHIPPING DOC CICOOPLBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bca90f-df34-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625670376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670376, "uuid": "9a924992-acb5-40d7-bff4-6c8a42e10ca4", "comment": "Malware payload (SnakeKeylogger)", "value": "94874dd39fef1028359b680bcd6d262f", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670376, "uuid": "8fac3779-a0fd-4963-8898-beb2e475d75d", "comment": "Malware payload (SnakeKeylogger)", "value": "3be5b20825ff5414b72b86a123fadae59468a06f7e7f9962ba730469cf0d27b3", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670376, "uuid": "40119c2b-9e66-4f59-b113-52994e0e9426", "comment": "Malware payload (SnakeKeylogger)", "value": "76502ef6fbbe87eb05f3ccb532be867419469b11", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670376, "uuid": "ff7dd20a-f643-411a-8af6-795f71c08d4c", "comment": "Malware payload (SnakeKeylogger)", "value": "4e1064fb0e310f6557950276c0545112196f9eb99b89ffd656910219fb6bb40d2e63beee5e7beedefbecae506d865dab", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670376, "uuid": "86d16061-71d3-409c-93b9-770bd0206471", "value": "A2127B198D79CAB8C219BDF300412C80E85278B58416F98FB771CC8E9E737EB1B19A0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670376, "uuid": "3d9e7ae5-ff71-4710-8ec6-bd4b53df314c", "value": "192:w5KsFxoQBsRphvI7kVJHRTqlQSRUKBs2l+d8:w5jxogs+7ap4mSOcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670376, "uuid": "af4869a2-d19f-462c-821b-9bb347d77706", "value": 9124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670376, "uuid": "1f976c34-784e-449a-8d8b-821ba7ab28ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670376, "uuid": "8095600a-ea4b-4088-92dc-7f71d843c0b4", "value": "IMG_056029741000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d4a445-df4f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625681740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681740, "uuid": "e8a0ae7d-3584-43a8-b7df-439fc9cd0a77", "comment": "Malware payload (AgentTesla)", "value": "26bec52cecd204a3e5fdd830675e5138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681740, "uuid": "45c9500f-c1aa-48f2-a278-c546c43a2b61", "comment": "Malware payload (AgentTesla)", "value": "3c493947ff53dafec4b6261a9a95638d629c48ee5a7295fa48455bbe1aa61ee5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681740, "uuid": "a7149150-d677-412b-b583-661919f1995d", "comment": "Malware payload (AgentTesla)", "value": "604b2c6657ede9271de7066248e0a29e834ce642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681740, "uuid": "b3205e93-d0b0-4c59-9117-6bd5b681dca5", "comment": "Malware payload (AgentTesla)", "value": "443f606c88fcadf5473e954ac2d394cff13adee595fee16bdc246120c0d8a24b50fc0f7fc938fb4835e4e0dcfd1033b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681740, "uuid": "be2dfafb-ad6f-44c1-a456-a2df6d2d1e71", "value": "T1BF2518773211207FF8C278F174DADEB699283D951E0AB10692D63F4B762A1C7FE90069", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681740, "uuid": "c15b65da-9b18-4e30-a371-04de7ad7e015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681740, "uuid": "b7d5526e-da59-4a9c-aef6-e47f37f1686c", "value": "12288:ExIyM8HnOoXgqcdEHd3MQFd7gVF0Hlyuij06wvey7F8Knijy+xI8pkqvRhCN/RJP:EqTupXgDelFRU0mIVvd7FXnky+xPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625681740, "uuid": "b492e0b5-cd03-4eac-892e-8cc0a07855eb", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625681740, "uuid": "c01aa572-4a33-41f3-806d-ce310205747c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681740, "uuid": "e3d39696-01ca-41d3-8ddf-150c3332061a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f8fb90-df70-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625696094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696094, "uuid": "7310eb57-68a3-4214-91aa-eaa471a169a7", "comment": "Malware payload", "value": "df1d74a5070fd985b1b0cd8ee783f870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696094, "uuid": "3c78035c-a968-4281-ba49-45caf20ad7c1", "comment": "Malware payload", "value": "3c7961a3ee40fdec4c40a44d5e7b8f1324ee0a3f4c5c4b439683064b229a08e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696094, "uuid": "49fa5d74-632f-43c7-9e3b-6c87edb19c02", "comment": "Malware payload", "value": "73b1a34e5c0e253355e377815a8384480b514c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696094, "uuid": "33764324-e829-462f-b59a-6c6bd1cbdb47", "comment": "Malware payload", "value": "cf7152720bc51dd23465a5eced0d0134e18550f6ee6e94eb6c89e1b7df913346252493c720daf74bf8460b7d8d676d04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696094, "uuid": "0d025250-214e-49fe-b30e-d49957a0a4e1", "value": "T162558D3576729F91D87FC7384731E13C8FB9AE66E217E2796CD4389B20B0B410A56623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696094, "uuid": "8c87bb87-3a4e-449d-ae3b-d4b89ae65c8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696094, "uuid": "baeb4650-cbe5-4504-82b8-23198628157f", "value": "12288:ogbHaIMVjLz7TaU5iOcep3gVZsZZZsZGPKuAH9sEjIzC0woXWmu4YZJsP1N5jc5w:yiO8H6EEzsmmZaP+nfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625696094, "uuid": "36292ad1-082f-497f-9526-e50b8fc5410c", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625696094, "uuid": "d8be271b-4adf-4a2b-97c1-34cacb459699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696094, "uuid": "25b9bc30-746d-417e-a4f4-8aa56d052def", "value": "OZtAyZssAg2ezGX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57df5cfe-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622902, "uuid": "2dc4d987-da54-4d83-be21-7fd863ea6a21", "comment": "Malware payload (Mirai)", "value": "62d75f182d89e447a6aa6828490f0060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622902, "uuid": "38e6df10-eb8b-4215-ac89-13d36305baa8", "comment": "Malware payload (Mirai)", "value": "3d07f210a0588c27d19966ef590dfbdc3e6881225d9215128d052b920e4919ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622902, "uuid": "921a2bf2-4c81-41af-bd3d-486abf23165e", "comment": "Malware payload (Mirai)", "value": "4506bef35f8e683d1215b297bb9300162c4df766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622902, "uuid": "a01f3bc4-31b8-48a4-b0e3-80bdf1695aa7", "comment": "Malware payload (Mirai)", "value": "c7229ac2808d2574e775cc07573011edf3a5f16642352638265ffa18bed1bd36fc7b0d05c4d44822521dc23b4c6ae951", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622902, "uuid": "12f6d09a-d701-4055-baf6-d9c07075ff7c", "value": "3E333ACDA5212E6EE9D698B980675F0ADE552210A093070BB3BBFDC33D33264FF55849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622902, "uuid": "866210ae-98e6-4acc-a665-6ae7dd0d0769", "value": "1536:xzDGiaGKiTm92KLxa7ZmcMNus7Tetg1p8wBZ:A3xa9m8Gesp8wD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622902, "uuid": "cdd51da6-45ab-431e-9770-daf2b175a5fe", "value": 52356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622902, "uuid": "462daba0-07fc-4f1f-8de1-12f411ff4ce3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622902, "uuid": "611f5154-3b7a-421e-abd2-32f33e959b82", "value": "62d75f182d89e447a6aa6828490f0060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485f3768-df35-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625670550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670550, "uuid": "c816eb55-5aad-45e9-8842-943d358230f7", "comment": "Malware payload (Gafgyt)", "value": "d1539471bcb53599dc32880e3f13c5af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670550, "uuid": "5a559f2c-6e66-4143-a26b-1152543f456b", "comment": "Malware payload (Gafgyt)", "value": "3f19fc312772226bb8af7f75fab132a8df0d2f2f81c556132ead655731327afc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670550, "uuid": "2ecf9ce2-d5f7-4973-ab07-af2ec0b10080", "comment": "Malware payload (Gafgyt)", "value": "fac4acf2f01a0cacb42397717db40d9fe5f7dfd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670550, "uuid": "29e6a380-3d0b-4aa2-9022-f5493f60221a", "comment": "Malware payload (Gafgyt)", "value": "a71ae5df7455303340ade5db8b35b3da52380d7898e8715ac9593ab90f4de5b87c34d282fd4e22a4be71637cb2303b8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670550, "uuid": "c6fff0d3-cb54-4f11-98ad-8c813d2272ff", "value": "T1EAA3F972E642CA72C44306F102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670550, "uuid": "163e86fc-42a6-4370-ac76-58232599698d", "value": "3072:SOGAEtZoGZKWl6u4YTnbHfbimmFVcqq0G27ZT:SqEtZ755nbHfbimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670550, "uuid": "ad6453f1-7f52-4004-9302-b1d1f616e94c", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670550, "uuid": "38518989-d4a3-4bf6-aefc-548eb2097477", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670550, "uuid": "9f5f5efb-ba8a-41aa-983d-1a995a125b35", "value": "d1539471bcb53599dc32880e3f13c5af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43deef7c-df4f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625681709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681709, "uuid": "f974196a-0a5c-4c5c-be88-0148cd404d8b", "comment": "Malware payload (SnakeKeylogger)", "value": "bc4374c6ee22b4849dacd6a3c4a55fc8", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681709, "uuid": "339d7cf8-03e5-4b37-88aa-c40e3e38d3f6", "comment": "Malware payload (SnakeKeylogger)", "value": "3f225eb9913036f86afc0f3d812cc537f1bd108bff2d6a6d7802781d18d93d15", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681709, "uuid": "50a3600c-70d5-4b91-82bc-7c5a01b72053", "comment": "Malware payload (SnakeKeylogger)", "value": "e79a0f4740c66ae9cb49690835c3539db5bee901", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681709, "uuid": "f11889d9-e71b-4c24-9664-40904c3aea70", "comment": "Malware payload (SnakeKeylogger)", "value": "6d735fc7324401ca4f29a51d3683805afc83a3500850a3753118b612261ca34db06ef20f35186b8211b9ff0632d3ee12", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681709, "uuid": "92a51945-f96c-43f0-9dc0-0ca7da097d02", "value": "T15A5423C513ABB84E9931696230185D468FCB4BA85BC3DFF2D31E743FDA68490FEA0545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681709, "uuid": "d9444c75-123a-496a-bfb2-8f01b14533e9", "value": "6144:Pzx6ZNPKHpbltNd1Y2Qklhp8OtcATWulDeaDxqm6Zi2Pt:8MpbrNG5R9aDxqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625681709, "uuid": "1bcaca93-86d4-429f-a71a-fce61d6808d9", "value": 282435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625681709, "uuid": "e2ec57e8-68f0-4553-ae68-8587c9edd525", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681709, "uuid": "cd2712d4-79cc-42f0-93dc-514078d9ae1c", "value": "ETL_5100006278946.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b439ad2-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634075, "uuid": "63e12f64-2043-46fc-90b3-499e1f3ebb87", "comment": "Malware payload (AgentTesla)", "value": "5078f73f3f744867e6c5e07cda5b5120", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634075, "uuid": "6891e551-3184-4a41-831b-a51fac3c066b", "comment": "Malware payload (AgentTesla)", "value": "4092cc3841bc5e1377fb65e343cb837f0255e33d2194c3b24c8dde82a28511ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634075, "uuid": "0314b286-2f91-49f2-ba65-890191b2c7ed", "comment": "Malware payload (AgentTesla)", "value": "b9942b80d7c51c114d4fe23418b547bc8c43a382", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634075, "uuid": "859522cf-2152-4b00-bd3e-3204784a8601", "comment": "Malware payload (AgentTesla)", "value": "546ac1cf75bb56e1917dfa7399f8edc95a17004e152ba5a120986a42801a139766445a80df8e8b55df417dd390207b98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634075, "uuid": "4ea30d64-5a51-4a7b-ac17-20cbf604ba7b", "value": "34B423292DB03A01B9897BF2797EB4C4C351846BEBF7B9806D877B19D7412076674B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634075, "uuid": "05b7fa8d-9738-44e6-a7f0-1876267e5ebb", "value": "12288:qLIorh6C4eM4488y++eIG4f3A8smbTWPEr4Vi41dFSJNyXci0xk6fAn6h:qNr4Den++eIG4f37TWPErp41r5MieIn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634075, "uuid": "438a63cb-8cfd-45e9-aebe-9e34d716c2d8", "value": 527279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634075, "uuid": "89857eec-4728-40d5-913d-a7b8e1bb698d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634075, "uuid": "71970167-0717-42fd-98f5-e05a236c077d", "value": "S O A -44E45T76468.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a08992c-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662849, "uuid": "0055a2f0-30b8-4607-b87b-b987b7f573f2", "comment": "Malware payload (AgentTesla)", "value": "5770a617d3dfcb4ceee404dda2780469", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662849, "uuid": "9d013437-cb83-4041-9f2d-c080c99f89eb", "comment": "Malware payload (AgentTesla)", "value": "40e4acc6fdffb511d09bfccb6859e36865b0c4f748b0dd8d32fbf4ba0bb71a4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662849, "uuid": "4b621bdc-205e-4a3f-9e81-f64ec84ebe13", "comment": "Malware payload (AgentTesla)", "value": "8c1a862b657535dd70ab68cbb1ea3663bb80d4b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662849, "uuid": "5e0c323e-12e3-4345-ba77-dcf44d4fe4e1", "comment": "Malware payload (AgentTesla)", "value": "fe66de5740dde532a148375d62ff9e7adc810fcd85dd00060566a138dabbc467f785670110d0d48d057af02bd552dca2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662849, "uuid": "d849308a-3ad6-4e6f-b651-66b4606c592c", "value": "8C45BE7A20338A92DEAFC7F90730662E4F6DAFFD904BB6741845B47900F4B4D4A61927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662849, "uuid": "e50a5d77-9556-4b87-8c6f-1eed33398a57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662849, "uuid": "d52cf225-7cee-4afa-8d62-dddf2dfef017", "value": "24576:31a+HMes2m8AA2g3ca6PvuG7FOAwvHN0nNPn+M0biYuWOBfWlB:31aCq8A5FXvp5wfq+DbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662849, "uuid": "3d9e185e-6f3b-4fbb-8814-5214b8bb18b8", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662849, "uuid": "29af825a-fa6d-4087-ab09-8fcf6a4da544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662849, "uuid": "069bef95-2e67-4d23-97a8-f7d4070d250b", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bb6bf4-df4a-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1625679647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679647, "uuid": "dcf0976b-7b0c-49e7-9ed1-83a43a6b2002", "comment": "Malware payload (Pony)", "value": "ea40d77d365053cb11d1ad5e89b9937d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679647, "uuid": "c345587f-030b-459f-ac51-77ebdb9ef82b", "comment": "Malware payload (Pony)", "value": "41810fd3481f8d4ccfb45fddc97fef5ccdff10af555a2c1fa239c541d3fd16a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679647, "uuid": "889ea5cf-bdf8-41ec-97c9-94ff35634c79", "comment": "Malware payload (Pony)", "value": "94ce4a149f7e703abb15018178a062dd3c454b04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679647, "uuid": "1d0483b5-ddcf-4bbc-a584-e2c0f16e8389", "comment": "Malware payload (Pony)", "value": "e598831ac8d42c116cc4992c5df5c07de52f509fa49da15c2c357a9066e4f37f179a27e5627e9c01ddfd69968c090ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679647, "uuid": "e7cddece-b716-441b-88a6-a0b68f6129f7", "value": "T1BF3401C563C1CDA7EA5D677204AB5B7346B5CB0182606AD70B187F6BEE36201C52BF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679647, "uuid": "185f20e6-f3cf-484b-9059-13add320e02f", "value": "e990dd07e89d04c53e337ab9b3f5e0cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679647, "uuid": "0467b548-774c-4459-bddc-ff2917665a8f", "value": "6144:e2YnYaY9bgKWCebssc2iRZP+N3oC/DMhO3yYlwe:gZesCN42moCbMhO3yY6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625679647, "uuid": "c703ffb0-9206-40e0-9662-f54cf7eafb1c", "value": 232806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625679647, "uuid": "477c4f91-4a3d-4e45-89e4-a085162440c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679647, "uuid": "0940001b-6f57-48dd-91dd-642c2137f3ff", "value": "41810FD3481F8D4CCFB45FDDC97FEF5CCDFF10AF555A2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3b4aef-df1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625659713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659713, "uuid": "a0fa9433-f8b1-4569-af54-1fc2e27bec12", "comment": "Malware payload (Loki)", "value": "7b804d7f6970b96957a403e2d3314c43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659713, "uuid": "b5dd089d-4023-4b9b-bf95-8e9b106c2a9a", "comment": "Malware payload (Loki)", "value": "418399f3a43e0194760d05e2ffd6a61bcde6d79bff4c016114f58fb4aa6e1b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659713, "uuid": "963db251-ec2f-4c7a-89df-3447b704ca14", "comment": "Malware payload (Loki)", "value": "de858c806131ebbd61b1f2979174b9b18b571f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659713, "uuid": "6e64b0f0-b493-4a5c-be0c-628fe60bfdac", "comment": "Malware payload (Loki)", "value": "679c6a2fca190666a8310f8abdad82fe8cb4f08bff06d443ec1ff2148b8a7cbf393c6fb14db60fe178e49d3b183ecdd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659713, "uuid": "7db24f1b-fc8e-4972-989a-7aced8d0fb2b", "value": "BF45DF7A20329A82CEAFC7F94B71551E4F6DAFFE904BB674189470B800F0B5D4B5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659713, "uuid": "5c75fbb0-cc0f-464a-9895-cd5fb5affdb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659713, "uuid": "d841f431-e3a7-439e-ab36-8d24518029fe", "value": "24576:QRdZzakLhWBwmWPdiBZKKRwt0biYuWOBfWlB:0eBtWPYBMIfbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625659713, "uuid": "6103dc71-c138-4d1d-84a4-ca3e84a67590", "value": 1200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625659713, "uuid": "30aab19c-414a-4335-a0c4-16ced661c0db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659713, "uuid": "8516edf7-b46a-4a27-97ac-3c3b6f772aad", "value": "DODE 103...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5933d4-df0d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625653570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653570, "uuid": "c20c3b8d-8182-45aa-a2bb-7693f46e0b0b", "comment": "Malware payload (Loki)", "value": "b3d74883edd8922b38fea4ddc36e6df0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653570, "uuid": "51b556bb-6657-433a-bdd4-ae8e9eca341e", "comment": "Malware payload (Loki)", "value": "4198268e4e5691daf4de28d183aef0836897034c0c6a57288436f742dd7ffa8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653570, "uuid": "f13cc715-6a62-41f3-9482-7c691322372f", "comment": "Malware payload (Loki)", "value": "22b02b93c45a3d3d171c265978d6371675031b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653570, "uuid": "2c890ab5-5bd4-4b98-8455-2ce786bec8a7", "comment": "Malware payload (Loki)", "value": "ae8056b269c4e36434e3e586bb89e855deca24ea223c87fa66f58566ce1818bf3e9a5591d5cc0d65957f1740d0eb1999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653570, "uuid": "796980e5-d258-49e7-af28-ba8aaedc3031", "value": "A6455A9B7AC2E4D9E0788D304564B6B883162C56BF879D0EE4EE325F1F32E923431756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653570, "uuid": "4016c00b-d99b-48e0-97a2-f14f5138815d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653570, "uuid": "c268b840-3a7c-4069-b77a-4987d3f6b2ec", "value": "6144:PBboYbKGSWT/o3SmjSDyUAdahdZ1aRZW2RlTXFNuIyn:PBbnjyndsaRZlRlTVPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625653570, "uuid": "e2273ea5-4884-450b-abc8-c5bb602d4317", "value": 1211912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625653570, "uuid": "5579e49f-b706-419b-bf95-3514c05889bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653570, "uuid": "f5516da3-c1f1-4def-946c-5f92d914b461", "value": "4198268E4E5691DAF4DE28D183AEF0836897034C0C6A5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660a4525-df05-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625649984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625649984, "uuid": "2525d7d3-4e95-4908-8d01-7fb94fbcb48a", "comment": "Malware payload (RedLineStealer)", "value": "58ccafb5ac33ebece058b350c3d6ec1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625649984, "uuid": "88b02089-fede-4347-a673-5fb00ea0ea7b", "comment": "Malware payload (RedLineStealer)", "value": "419dbec500b45dcb0aca32df66ed6107975ae346cea116494e7f36445746aa27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625649984, "uuid": "a5e6148f-8009-4775-9b22-414a6c6927aa", "comment": "Malware payload (RedLineStealer)", "value": "fc06e502c696adcc8813cffdb4dfa4a86458013c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625649984, "uuid": "81e76470-16a3-499e-b295-237e8c1e7507", "comment": "Malware payload (RedLineStealer)", "value": "9239acea18e4d86f262ac7979fd7bdf703082ae9628bfed91fd85dbcb6738c6611b0e9f362b77e379161ce14d4e7bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625649984, "uuid": "4c35028c-edad-4f57-ba68-d6f83b203a60", "value": "05E39F2633A7C475C1C42234E461CB3B2664CD2313B4724BB4C9AE67BD6B29D5DBC6E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625649984, "uuid": "9854cdff-d675-4a69-988d-0b6b64bd767f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625649984, "uuid": "ae8e23d6-823b-46fc-9bc6-4428a611c4ae", "value": "1536:9Fo4/yKq/UYMYlGf0ZjAsMfbrylEH6a3Fm3RiNDVXSVmIi35H64/4/4f:x/yz/HMbdiKaQFm3R0hL5H64/4/4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625649984, "uuid": "47651a3e-7a32-457d-b35c-efac01419804", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625649984, "uuid": "176203f3-4837-4eef-8d53-4a6db9c477da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625649984, "uuid": "cd50b240-7d07-4b73-84dc-9dc3f0b5ee48", "value": "58ccafb5ac33ebece058b350c3d6ec1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a721c5-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625634357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634357, "uuid": "79d4b150-53d2-4b90-8091-a46fd0104046", "comment": "Malware payload (SnakeKeylogger)", "value": "03454dfa6abb4bf48c7926b028d348af", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634357, "uuid": "53b202f6-ccf0-48e4-8173-817f6ce72cf8", "comment": "Malware payload (SnakeKeylogger)", "value": "422f8e8038736caf2381d8f88914959d502951fe70d41d9d40eb6b53e1016a87", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634357, "uuid": "0f2475a4-fac0-4f8f-9d26-5b2b6233e0ca", "comment": "Malware payload (SnakeKeylogger)", "value": "8f27d5c78329a64c13e34bbb925ac0da70d3ee03", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634357, "uuid": "ca395d47-dbfa-4508-8928-88de131175e0", "comment": "Malware payload (SnakeKeylogger)", "value": "d0990e8b30f772f00a84b67408e428e33ee5e370c45444f845b9f30a032b12103343caf7630590bf77a0886a90f461d4", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634357, "uuid": "14efd49c-6431-48b0-a3dc-769ee9ffd310", "value": "AF15335918D2CF785B02DFBB1497FED0305A8D322716A9CB5C704D75CA9D2FE26A0B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634357, "uuid": "ac7d23a2-f4ff-4fed-848c-29f249d765fa", "value": "24576:q54JMRw7Ogi2Y4+wMiivTiGo/ot5PVvZZE8L:qGJk+Ogi2Y4+4i7iGoQLFZZPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634357, "uuid": "185b8c72-d873-4484-9436-5e40c8381162", "value": 912029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634357, "uuid": "bbd58e39-5fa7-4a0e-acf8-112f8a56f86d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634357, "uuid": "69ba8bc9-bf7e-4fee-8df6-0191e2daee8e", "value": "EPCC Of Export Oil and gas equipment.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c249f4a-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622936, "uuid": "fc5acc5b-6af0-4faf-bb2c-38378d83ad25", "comment": "Malware payload (Mirai)", "value": "99f35c25cc462c9bad5a0125f520fab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622936, "uuid": "d945c530-5f93-4af0-b26b-81ff39238690", "comment": "Malware payload (Mirai)", "value": "431b5e9e3881eb7ed01b3e28a3a752948fd43f75595a3ef9db06533947c94abd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622936, "uuid": "d128299f-d22e-429a-aadd-ad485f8aca00", "comment": "Malware payload (Mirai)", "value": "1a0f3093b0e12f89e1401f032741f0a459ed19bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622936, "uuid": "ccb0b5f3-7823-4df6-9d47-a13f74cf8529", "comment": "Malware payload (Mirai)", "value": "267852e1624ee91062b2f246df9095c43b75f5120475e70686cda9a77c8d405d80d675920e6751c086f191b03f59c8f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622936, "uuid": "e9b2bb2a-34fe-47f3-b4f3-93a1e858c040", "value": "2EC2E1BDB0946DE2EFBA26300E04A4D127650FCD73425BF678C69F02764620ABE457E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622936, "uuid": "19c5cca9-9760-4500-a015-13062d0dc91b", "value": "768:hFGQf8SPO4wZqk9G6bY+ObH/3vo4uVcqgw09B:hFdx/Jk97bqPvo4u+qgw09B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622936, "uuid": "12c0861c-0298-49f9-9f54-11b8a738ceb4", "value": 28080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622936, "uuid": "9888afc9-090f-4b8c-83af-06594bf8bb3b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622936, "uuid": "dbcbf115-46b6-4ba8-8c1b-74c6c78c24ce", "value": "99f35c25cc462c9bad5a0125f520fab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67665a25-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625637531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637531, "uuid": "d01491bb-b22b-45b9-9423-3cbc68ec3abe", "comment": "Malware payload (AgentTesla)", "value": "8a6d1a94602f0d96a0b1ed4cf399011f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637531, "uuid": "a11e95bb-e792-47f8-b385-cb28d210cb22", "comment": "Malware payload (AgentTesla)", "value": "435367494138f298c1171551343a6785f49ab7d8425ca3a72c76d7599dc6bc63", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637531, "uuid": "41d927a3-5685-4375-a741-690ee45c5dd3", "comment": "Malware payload (AgentTesla)", "value": "756326a273f8914f2e284cb6fb79e512701acce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637531, "uuid": "2dbe63fc-ef54-4386-9c8d-3f23a4169e89", "comment": "Malware payload (AgentTesla)", "value": "69bf54a0d2f5d2fa0d9b58c61771d0d6b4136d6a8d0940776274fad58054c3bc4720b888db5f1b44c6fc0dbee128d5ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637531, "uuid": "f93f7ec2-1315-46f7-9a03-35513d8c1134", "value": "0DF48C9C3650B6DFC85BC977CAA82C64E66074B7831BD303A05712AD9D4EA9BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637531, "uuid": "58d0bebd-12c1-4660-b297-8e5c353fc3b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637531, "uuid": "680c15bb-3048-49d7-a0a2-08ca52223be9", "value": "12288:Ag7YqwRpBD1+6MO1HJ/I+aYqJaQWNLHEZT4ZlbvJEjUr6flbipV3Vc0kaR8zR9M1:Ag70RnDA65J7afJ2NsklijJNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637531, "uuid": "95c6a833-a65e-482e-86c9-c64bcb74395b", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637531, "uuid": "ba141296-159a-400c-8018-02a31adeff19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637531, "uuid": "0aecf08d-b446-4352-ad61-c9c0222c670e", "value": "Pharma 3 M gogglesValves parts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79acdb9-df1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660080, "uuid": "98db0418-e72b-45c1-9318-070a45b9bcc3", "comment": "Malware payload (AgentTesla)", "value": "c4e49e4a04afe088b449eb20df5ebb93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660080, "uuid": "beebf427-f593-4e57-a03f-d33eb31c551c", "comment": "Malware payload (AgentTesla)", "value": "4522f433567f4ab94f81f6ec9f445aa12ed32449260e789cacb529cb7e36a0c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660080, "uuid": "89fc6372-df2a-4d74-9a1d-873f84543da7", "comment": "Malware payload (AgentTesla)", "value": "f50f130c24dee465ff586f241b37e65f717a268f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660080, "uuid": "9ade3bbd-9711-48d2-b149-9601291d3654", "comment": "Malware payload (AgentTesla)", "value": "8efe71cfd98c0840fbf3f2899ad2612b74f4ac225b372c22ea8341c6969364cd266dbeceecf0cb5ca5a64c97fadb4492", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660080, "uuid": "88354364-74f1-4c46-a18b-961e17bed1ff", "value": "9745DF7920338A92DEAFC7FA4732152E4F6DAFFE914BB6741894713900F4B1D0A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660080, "uuid": "e0a8390e-c5d3-418d-8050-7d09bbf53202", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660080, "uuid": "427d9bd9-ba46-4ffa-923f-97dd24422fb8", "value": "24576:Jtg2r3bmWf5HyQ4wOBU9sbsrZrNuEYTJwF0biYuWOBfWlB:B6MHX4wOBUOCrgbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660080, "uuid": "7fd36f0a-abdf-4908-9919-45f173a32acc", "value": 1249280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660080, "uuid": "9acec4c9-972c-48eb-a3b3-a95575372ab2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660080, "uuid": "f1faad53-4728-4618-8999-63266e2e3d8f", "value": "YLQp0bQF99Cl0q5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a8f396-df31-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625668804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668804, "uuid": "8c99c718-f1bf-4d51-b9d1-9b985a60c4f8", "comment": "Malware payload (Formbook)", "value": "cbf5a9027344d8d5f7498f317138caff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668804, "uuid": "ff76d65a-f655-4304-bd83-faef7dfbe64f", "comment": "Malware payload (Formbook)", "value": "4670e9c00fc2fd7cd756e02782933318b2ac8e5a61cd57ddcb4072de13a14707", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668804, "uuid": "33c88672-8427-40a0-b027-ff0d14df9873", "comment": "Malware payload (Formbook)", "value": "c16af50965a4cd3349b5cb844576d248a6abf77f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668804, "uuid": "89d13ea6-f9e7-4718-ad9d-7848f1ce3097", "comment": "Malware payload (Formbook)", "value": "bcc858e992ffcab5f32337c073be3b4d60c444e198452f09288aac3a0e63b34db9ff183b59565bd23df693d3a87f1613", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668804, "uuid": "9b5cb8f6-12d2-41e4-a2f7-7955ebd0d376", "value": "54127D6B02AAC85DFB1741B110481941ED713D52015ABFBBBAB2FA5C4D773FB070B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668804, "uuid": "1e7bd9ec-8b40-4f8a-a177-59aff8e5821a", "value": "192:XnsfFOoQBsRohvI7kVJHRFAfLqAkyy+puBHqmEw80ht:Xn4OogsN7ap4f+Ff+CcyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625668804, "uuid": "b1735fe0-a466-45f6-be60-b1a2711ae007", "value": 9088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625668804, "uuid": "2f1606a6-a0c3-4fe4-95fd-b3de65eb998a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668804, "uuid": "c1844070-9978-4dd7-98d2-fa3144a8db35", "value": "PO#15032016-A001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8e93d8-df15-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625657105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657105, "uuid": "83f112c5-e951-4efd-ab76-1f1eed37e634", "comment": "Malware payload (RedLineStealer)", "value": "f334deeca46d3b5349d9ad820df1a8ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657105, "uuid": "54b5e634-1cf4-4a74-bda1-573433196b3b", "comment": "Malware payload (RedLineStealer)", "value": "46b808244406eaac6aaaec7440ee63fba5e0c7b51bc40a49e0db3f17586d0c34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657105, "uuid": "2f06d827-a272-4768-88ef-67ab83b42c5f", "comment": "Malware payload (RedLineStealer)", "value": "9a47f83f159c80b7e157d2e51b2bc0d9a1d31701", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657105, "uuid": "69af818e-ac8f-460a-93da-e0f2d3ae4a94", "comment": "Malware payload (RedLineStealer)", "value": "03908f0dfa8f30c21a0227eec8ca5ed1bd8d92eadc16f7af976941bf6adcdaf1902567a302b8a14d9e2c3a6453e6c66e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657105, "uuid": "e7505226-8c68-4d57-976d-cbe0a9b22dd7", "value": "B35523A22A3C0BD1CFD065B588261109FF7EC9724E96C53D6907AC14753AB4FAB374AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657105, "uuid": "4ae2b538-167d-43b1-9d15-89203ab07295", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657105, "uuid": "193f5102-58a0-4903-90da-4cb70ac4dfbc", "value": "24576:8cairZ18VYBDzr5qnOKN5dAaZVZDTtQbcz9uTiVR2Xoly:vaMmnzfdAaZLTeFiVIX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625657105, "uuid": "33574a13-a575-4383-849a-34b5472f4d7b", "value": 1339600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625657105, "uuid": "9d90c045-cc34-4bec-a79c-27db69747467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657105, "uuid": "954c71a9-1c1e-468e-a24b-65eedefe4d21", "value": "f334deeca46d3b5349d9ad820df1a8ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5720112-df22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662573, "uuid": "e14404c0-46f9-437b-bd1e-7637b1a1abe2", "comment": "Malware payload (AgentTesla)", "value": "39186dc53c619a4a9759e24d0d4c022c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662573, "uuid": "8051b407-ccff-4666-823d-bfd60e4fbd9b", "comment": "Malware payload (AgentTesla)", "value": "488e95bfe1dbcec59e4d18c057e251a576feb8cf0b8222d1ebeefee8121bbd7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662573, "uuid": "44bc9895-6c94-4864-bf69-e89010c1829d", "comment": "Malware payload (AgentTesla)", "value": "3908702c5c04daed9184e152998e835e765e192a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662573, "uuid": "058329d8-ff5a-4266-bdee-bcc975c71319", "comment": "Malware payload (AgentTesla)", "value": "0935a59be69974028fcc697d3bd59ebbd97ad78bdbd622492e44b761170f4d9f08fd809f73f8d8617f4aef27899d5536", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662573, "uuid": "eb2e23a0-537b-4561-a76d-085ebf7359bc", "value": "17154B88B642619DF816CA31B937CCB0D6123EA95A36910F10DB3F5B7A7F1D3CE510A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662573, "uuid": "ac34475e-a01e-4a06-9c19-3789c6ea696f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662573, "uuid": "abe2bd24-5740-48b3-85da-552821915ab6", "value": "12288:YQleIyyhdf640qv0ECa6SbGsOsxTOzjetHO7v/t407zP4KFwOwL9rAmcynahZkPc:YQl7Hhdf6iBlasQjetH/1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662573, "uuid": "dddcf27c-6d0d-40a3-a846-7693c550effa", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662573, "uuid": "ee3e5034-ddc1-4a2e-bbe5-b34f85bc9754", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662573, "uuid": "b8e53ec9-ff93-4b00-b0aa-cb674afd4ad9", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18cc62c-ded4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625629038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625629038, "uuid": "2a534cec-f189-4794-8cb7-14da20b5e7e4", "comment": "Malware payload (RedLineStealer)", "value": "2fdb8c19279c145aba4db98775868168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625629038, "uuid": "c53036ee-722d-468b-b926-5502c582f507", "comment": "Malware payload (RedLineStealer)", "value": "49e784cd4664d480317bc3e726821d153e14ebc8b335cebce963ec427e4dcea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625629038, "uuid": "b6089fac-a88c-4d83-9fac-c2efa2081dd0", "comment": "Malware payload (RedLineStealer)", "value": "301fcc04380c5626e2e4f5708cd2451ee43d4070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625629038, "uuid": "ac459ed8-4550-4f97-984f-eb90b7c0e59f", "comment": "Malware payload (RedLineStealer)", "value": "0895feabbd3d256d222f7e6320bcc44f8475328aa2c70460d57b8b755192b8d27e5a66c133551283fc7db397771a4a73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625629038, "uuid": "b02df8a7-2d29-4ab5-9e43-d217566639eb", "value": "BDF4E0107692C035F1F326F499B59369553EBDB29F6850CBF2D866EE1A706E0ACB0307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625629038, "uuid": "741f5017-8ff6-408e-9163-78646e9709ac", "value": "1e8c0f829b104b9959a084b4dd191d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625629038, "uuid": "a25e868e-84d0-403f-8cbf-bb2474e5340c", "value": "12288:/B9DmBPLjISQoEM0jGuL4POmEQDSb5IEaYUT3hrD52HqTDd0aAyA4C3o:XD6VE9j9s+SE3UFrfB9Ab3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625629038, "uuid": "8c41272d-fc99-421c-bd94-070802d35289", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625629038, "uuid": "0f77de78-da03-4be5-9996-af7dff34eda8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625629038, "uuid": "b45aac6c-ace8-48f4-a679-052d016e80bc", "value": "2fdb8c19279c145aba4db98775868168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07936b83-decc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625344, "uuid": "e152545d-496e-4146-9e38-49e8a283f86d", "comment": "Malware payload (Mirai)", "value": "8491cd98447a59474d70574de6716f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625344, "uuid": "a22e4513-1988-47d2-815a-7e333661863e", "comment": "Malware payload (Mirai)", "value": "4a14d769b0311de948994dc27583e905391e2692338faa4eefedfd5cc8482efa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625344, "uuid": "7488c7e1-c3cc-42a0-a6b2-6f60d6948792", "comment": "Malware payload (Mirai)", "value": "54931ae716f2612f5575e457401bbda815167873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625344, "uuid": "aa47172a-009e-4a04-978e-cb4b6859d6d7", "comment": "Malware payload (Mirai)", "value": "505b48c13f1e0cfbd96501f78b16d56d5733bea72fda87d0e929b3ce031e7ac9f773d6cb64876667fa5246dd1e8b7eee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625344, "uuid": "bb5d0a6e-62c2-4e1b-9ef2-0f28cd4f8cdc", "value": "D9D2E022A39A370ED9BF00769BAFB61504F5D14DF884C6B5E6C429BB9D6DF9133240D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625344, "uuid": "224691e0-3aa8-455e-9581-1ad05e0e575d", "value": "768:0uH5tyEYkO4uhxG6OazCIdLynattsFbNnbcuyD7UHQRjc:RZIEYt4uhI673dLynatsbNnouy8Hyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625344, "uuid": "318b5116-4f1f-4489-838d-a569f2558502", "value": 30880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625344, "uuid": "47fc4330-049d-453e-a924-d5c3ad28eed6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625344, "uuid": "6597e099-8cf3-44d7-a726-aa37d3e4a0a2", "value": "8491cd98447a59474d70574de6716f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f349d406-dece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625626599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626599, "uuid": "8c214aff-8301-4d96-a81e-a8d13ebb9bda", "comment": "Malware payload (AgentTesla)", "value": "b2cfdb5cbc0e54708550fc1b00c52c1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626599, "uuid": "1eb76410-7ae2-4372-9e25-7367a1f0b598", "comment": "Malware payload (AgentTesla)", "value": "4ad6cad87774991c87fcbbc6c9d90461f084ae1fc8940a7b8d56dde693f1068b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626599, "uuid": "880a89f9-df94-4f29-bcbc-117934a91c49", "comment": "Malware payload (AgentTesla)", "value": "11f60f00254b2997f295bf02fd256db31b08a1c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626599, "uuid": "7e0b2835-2895-42da-840e-e9584cda6e04", "comment": "Malware payload (AgentTesla)", "value": "d93420e87655157d7b986fd10a70e0bf617880c2a382c84925e5833b7eb97639047453cc4a21e3d1d26dfc6c0f292fce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626599, "uuid": "3916e834-25c6-4aa2-a66c-f987735cd1d0", "value": "72F45A983312719EF4168832B957DCF0EA107E665B0BC20390D73F9BB91F5D6CE941AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626599, "uuid": "4eb9de5e-8af8-4046-b873-9bc1b4c5d4aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626599, "uuid": "928fe2e0-8c33-430f-9e65-792b57d357ef", "value": "12288:Z3E0hS2ZAJQ05BwBLeJHBn1N0oiGeJ0O4g8dVkLryx2SCTns5nBFkpIJuPG3mtZz:pE0hSjxLwNeRBn1tiGK0lFVkSYxs5nBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625626599, "uuid": "1fe1892a-502a-435d-bb99-2bc46833d67f", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625626599, "uuid": "9f241bad-8c0e-47e6-83ff-a0f129bdb11d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626599, "uuid": "c3eb35da-98b7-4d70-9d1f-d7f12c843b49", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.12465.28401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a805071-df52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683009, "uuid": "09b8b029-12cd-4e73-b150-8fd414399d31", "comment": "Malware payload", "value": "55795b3fdea01aa40bc69887d36e22f9", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683009, "uuid": "34b93eca-5099-4a86-979e-9480ccd44bb2", "comment": "Malware payload", "value": "4b550c500aae1686f38edfc7e28fe3a7939b997e01ee73a432c0caa7ea69892b", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683009, "uuid": "88badb8a-9535-4e39-b5b4-267f2dde5961", "comment": "Malware payload", "value": "7988c9c721a2b2d0fe8999f6bb6abc676988d43c", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683009, "uuid": "186a19aa-153a-4278-9516-ac853bb658a8", "comment": "Malware payload", "value": "6160732e366d4e7554354f83935be2d9e35e9da26e685bee4bf28ea0e6c0cab6569aa31263cdca51035a1026e140606c", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683009, "uuid": "1f48f40f-359a-4c07-9df7-7865ab08927b", "value": "T1112440197057C15FC6A80E358C9ADBF63B31BD029D8AA20731947B6E7DBF640DB02687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683009, "uuid": "c669285c-ceee-42d8-b2ef-3a49fd8adb13", "value": "1536:Iz7x3UvVr7qTMacbS0BC6/FO4mK1sIHeTPbsFm9n9t:GZUvVr7qTMagSIpNEw7QVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683009, "uuid": "c765c101-dffd-4b7b-933b-5df70766874a", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683009, "uuid": "89e35163-e2ce-4c8c-b9c4-a322e43fc427", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683009, "uuid": "fb67016c-037e-455f-96a0-c1ff1c250bab", "value": "SecuriteInfo.com.P98M.Downloader.11.2459.21312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7275f4bf-df53-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683506, "uuid": "24a19266-f777-4700-a65b-3caa1ade658b", "comment": "Malware payload", "value": "f096b9024bfafa8e3403a13125c0a6a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683506, "uuid": "c9504dbf-ad7e-45c0-a6a1-4e7d94905da1", "comment": "Malware payload", "value": "4c840cf8b8e6ffbd8fd1140e323f898e220a405714353834ce98a1070cbe4a4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683506, "uuid": "490b4412-0bf0-4307-a89a-875b6c84e42e", "comment": "Malware payload", "value": "1c55d367223d7bdd9fb3cd45d2ce6411ddd97c78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683506, "uuid": "6a044cf2-edf7-4956-9f75-8f623088be89", "comment": "Malware payload", "value": "a27fccfdb391594e30608c7d4eba9928a7fec1f1e419b27fa98f63fda47c464d06bf6aaf4747322f198e102dfaf7dd16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683506, "uuid": "0f03b7c5-297f-4ec7-89f5-5981bd73f278", "value": "T1A354125276AF8A71D056B1B5CCD397041931AF42AADED38F25483FEF7472B0A081A63D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683506, "uuid": "19713c28-ebea-4647-b533-3e75d84b2514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683506, "uuid": "05162898-698e-4f5c-bb2b-080e8f50358a", "value": "6144:WpBRbrWvs2eMBvPdCSHFXGBKqBcRjdPaAW0K0m9S:jRdPdCmFXGBDBOYlEm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683506, "uuid": "7564dfd6-16e9-4dbb-83e9-6903d61e94af", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683506, "uuid": "dca40ecc-605f-498f-a64a-e9588093bace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683506, "uuid": "dbdd419f-6a49-4957-b9c6-64b83f59d732", "value": "f096b9024bfafa8e3403a13125c0a6a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f0f2c9-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625634138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634138, "uuid": "4d95d7e5-65b8-43d7-869e-681ae1552f65", "comment": "Malware payload (Formbook)", "value": "736713c2f96f9b42222b2898a684b6f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634138, "uuid": "6ec1cbc2-de00-4382-933a-ffecf0090fa5", "comment": "Malware payload (Formbook)", "value": "4d15d10d62977acbf98b94bf2d836c116b5410939809e5a961a1d9dea165c3fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634138, "uuid": "123b8a1e-d0ed-40c3-a608-6a59b776b0cf", "comment": "Malware payload (Formbook)", "value": "f8d0f835e3e3fdcc2ab42b7668505eec241bcfc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634138, "uuid": "3b546048-143a-4ed2-8b72-aadd9d69e602", "comment": "Malware payload (Formbook)", "value": "b9c707e357ba1e60fe14fd269d887fd77977c813c608d13b076f270133f80d7fa40eb5aa46ab350386dfbed8c5194bbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634138, "uuid": "de6a11ab-3593-4653-a345-d762e3354b95", "value": "15F44B983312719EF4168836B957DCF0EA103E665B0BC20360D73F9BB91E5D6DF910AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634138, "uuid": "94d5cf32-418d-4998-b1a8-4065fb9ea5f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634138, "uuid": "60e85f33-aa18-4164-98cc-89fe51728b1e", "value": "12288:Jan1qroLvSevp7xrMnzMx1gdHzO8kBpXF9Xam8+Rp9AI6Y8sn2svFvvjLFgVoTVS:J6UovZvptozMEdOXXPxp9N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634138, "uuid": "9f9cdaf0-6e12-4bba-88de-2ca91ac0f42c", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634138, "uuid": "a2835627-8ec0-4134-a13d-5664b66977ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634138, "uuid": "a14102a3-6c72-4387-b86b-fa3101122960", "value": "AVR JULY 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74469a2-df3d-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625674172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674172, "uuid": "1d8fed5e-859d-48ea-a520-9204dd47f50a", "comment": "Malware payload (AveMariaRAT)", "value": "4ebc326025032729e501bfaaa224eea3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674172, "uuid": "5b785067-efd9-411b-ba64-31f08fbefde1", "comment": "Malware payload (AveMariaRAT)", "value": "4d1768d3f6b0e4f53299b34417b213cd30b1719cd6e939a68cf4d5ef9d705fd8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674172, "uuid": "2d741c79-ae45-4174-aeb4-83407547d05f", "comment": "Malware payload (AveMariaRAT)", "value": "347f76ec2e4d3ee265bd6c9273fdd5c8e11772c7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674172, "uuid": "37f503a4-e57e-40ca-81e5-399ec7e125bb", "comment": "Malware payload (AveMariaRAT)", "value": "482a3698b027669c683bdbaffbae6856d790b3854d1e5d0fd46c32a155d7678ded8271e9060842d8134b27fec4c63993", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674172, "uuid": "31df4d44-e1cb-44f7-8fbe-dc3f472f4db8", "value": "T1E6B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674172, "uuid": "a353af4c-aa9c-4067-8724-54b1eda3ec00", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674172, "uuid": "905af9ef-3720-414b-ad18-dbc35e61182a", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01v:K1VmhaH8EFvW+0OVE0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625674172, "uuid": "f611ab18-da52-4f42-9271-bd34f897f91c", "value": 112156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625674172, "uuid": "2ca299c5-cab4-4e4c-b4d3-e6b21b98cef7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674172, "uuid": "6dfc8076-1b5e-4d66-8330-3aa94f530421", "value": "4ebc326025032729e501bfaaa224eea3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae0dc1a-df1d-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625660139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660139, "uuid": "dfbdc0b7-4619-4119-9454-3d69c97bf479", "comment": "Malware payload (SnakeKeylogger)", "value": "c334c25378b26256ccedcac32b20936c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660139, "uuid": "2ce70f6a-a087-4dd7-a193-ed6a06b9965b", "comment": "Malware payload (SnakeKeylogger)", "value": "4ec9edeef140832b12f7f79b0867a9387f66dde0abaf483f752c873e35ffe8f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660139, "uuid": "bdf3f88d-c97e-417f-8db0-5430d08f19ce", "comment": "Malware payload (SnakeKeylogger)", "value": "7899e64ebcd76df70e095c63425b780452196a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660139, "uuid": "f58820de-cb08-4a71-8837-87f884f90b31", "comment": "Malware payload (SnakeKeylogger)", "value": "784d4211c8c71622a9ff60d1548aeaae21c70977a86998f4fa02258d0795e5970f522d4c5e7c18e3a8cc429fbd89fe42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660139, "uuid": "f5a39c18-639c-4f39-9110-2084efde6cac", "value": "10F46B593302609EF81B8872B957CCF0E6507D6A8B0AC20350C73F5B7A7F5D6CE951AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660139, "uuid": "3061b326-c414-49ea-a70f-9550e2e3084a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660139, "uuid": "df39f367-f843-4b95-a5ff-1827a6ada2c3", "value": "12288:Rr1LHXLZBemAWyX6niyqBUJEWTHqSXkkXues1xTtdtENqO+NxoP6W2doEhZALSm8:Rr1L3em7yXg3qBUPXbuesJjEV+7eLurd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660139, "uuid": "b2125504-87ee-4d66-9414-69847ca627e3", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660139, "uuid": "1077e4b2-c509-4479-b4b7-2fa82e8b9fb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660139, "uuid": "7b83f71c-2e5c-425d-a8a9-6f17d7cdca05", "value": "P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d904bc70-df0f-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625654472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654472, "uuid": "e2ced9cc-034c-4f02-bf64-d46e606e1f03", "comment": "Malware payload (OskiStealer)", "value": "59f7460dc225bb728d71b4675703eed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654472, "uuid": "85f53bb9-fed9-4de8-9302-fac76670a995", "comment": "Malware payload (OskiStealer)", "value": "4f1bded2f0d6d077f672506e9a3ab5f4021a0a1a579e0b00d2773cd44199b813", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654472, "uuid": "95d3fe08-5aa5-4566-b29e-79cc6d9589e2", "comment": "Malware payload (OskiStealer)", "value": "1cb23326e19eba0ad22dd3cdf9fa1b0cacdb2efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654472, "uuid": "321a6308-597e-4464-8054-6bcb444fda44", "comment": "Malware payload (OskiStealer)", "value": "fbd9e413f8fd7bb1c5e75320d2f9c710c43175ac8fa2c7593c3def39a9da7538a4d36769deb44d78e24bdfc51f8bb3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654472, "uuid": "a1ee79ff-3c96-4197-914a-0aa1decebb3a", "value": "CF2402C51AA4C893F0F655331B3E1B666FA7A107155C9B0F07106B9F7F26A82CA0F761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654472, "uuid": "16dfb8a0-301d-4260-9476-64bf407e3572", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654472, "uuid": "e88d65c0-ad05-41bc-8754-46e7bac3796e", "value": "6144:xMm4CCAMUMukmHfZaG9pKnigdOUcWsYs6EY8VBEw5:xMwRLMhmaG9sOUcjzlY8fP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625654472, "uuid": "1b3f8ec8-e118-452d-8dc9-0171de719b6a", "value": 219412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625654472, "uuid": "bfd14007-8086-4fee-a28c-ddd645231117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654472, "uuid": "271db519-a694-451b-85aa-85a432eb737a", "value": "FEED DEBTORS AGEWISE JUNE-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40607f10-df4f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625681704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681704, "uuid": "23fba8f6-48de-4db8-a5fa-d04d876b819c", "comment": "Malware payload (SnakeKeylogger)", "value": "fe1c0a4a911151038bf5a3beb5793d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681704, "uuid": "5f273e17-506d-4ca2-84a9-0b374cea5dc8", "comment": "Malware payload (SnakeKeylogger)", "value": "500e5287dba2679bde2df8551de4a7066bf8fe9575d3bbd7d8051cec76c12501", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681704, "uuid": "0770785d-c163-4b50-a37a-571101306527", "comment": "Malware payload (SnakeKeylogger)", "value": "1a237c7515f372a9bfaad01d2347b7dd514198ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681704, "uuid": "182801a9-845f-42a9-820c-0155afecb05f", "comment": "Malware payload (SnakeKeylogger)", "value": "3c25102c1edc670a8a663f7a15c723246a52b1646f1b6ec3c43551cf50163b0bbc062ef0262c0ab45d6d655c336bd35d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681704, "uuid": "81cc5041-423a-4eb8-af43-b88a033655dc", "value": "T1CA6412526E29E175CA18757788E3D6B00FB08E42D466D22B203D3F7F743A3853A916BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681704, "uuid": "ac413a9f-4200-4b59-9fa3-0e96246dfca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681704, "uuid": "0a83375a-6b8d-435b-aba8-4f5de9cb5fb2", "value": "6144:WnQb/dIVRUu/ff44R5ENMkbYOR7JydepIXu2NQUI:W4/OFnf49cOR7J6eWXuIQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625681704, "uuid": "037683c2-9188-4cee-ac76-79c837a44f04", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625681704, "uuid": "9e657c4d-3838-4402-930d-24df4394ec72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681704, "uuid": "fb499862-3d94-4d69-87f3-ec2149d77bcc", "value": "ETL_5100006278946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549e5c07-decb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625044, "uuid": "b79c3961-528a-44e8-a006-c853eaeea1dd", "comment": "Malware payload (Mirai)", "value": "32b2feb686fc42467ec3784eea682a08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625044, "uuid": "296fe3f7-f8c5-4056-b1de-86de6f6069ea", "comment": "Malware payload (Mirai)", "value": "5028959505fffaf5fc672fe73a8687261098c7ae77044ed3fde31fbeee7074a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625044, "uuid": "9928bb94-da08-471c-95e5-3dcd59364f9e", "comment": "Malware payload (Mirai)", "value": "02aff2bfa0f6c58cf0d1e5312d7ab6970073cb49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625044, "uuid": "ef0c70b6-f1a8-4e39-8ae4-5fe0bfed1eb7", "comment": "Malware payload (Mirai)", "value": "c6c8fa8d787f49a8efc6efbe68534e2a0aaded170496572f81c1529c4c3a290bee224686d49dbef363a8e65ac25aa69e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625044, "uuid": "f93749fc-fe2b-42e8-a76b-fdd3f82a8a3e", "value": "9C637EB9E1795E54D35105787D108938C723F00AA6DA2EF2DE86868FF99BEE8F004771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625044, "uuid": "92eb89b3-c78d-4a42-9a8b-b87ccac71b46", "value": "1536:B/9tdVPQwaEwt+9f66gFN1pSDTZAvj3fs3kSbw7DizQsCsS:BltnPtbVd661DTZArf+tC2zQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625044, "uuid": "4448129d-0a61-45e9-96a6-da110fdbed34", "value": 71836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625044, "uuid": "467d9b47-719f-4107-a061-498bfeb875c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625044, "uuid": "a56550de-a422-4dbe-976f-95e4d1f68d3c", "value": "32b2feb686fc42467ec3784eea682a08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b038f22-decd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625626021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626021, "uuid": "44493c39-74f3-49bb-9299-e523e5a2b15a", "comment": "Malware payload (Loki)", "value": "35791ed5c68c3345472b5461f707133e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626021, "uuid": "f2b94308-e89a-49cb-b374-71956b03ee19", "comment": "Malware payload (Loki)", "value": "50d0db92c6de3d679f3fa468d0454da82ff9d3084029c7076e1ac3644cc0dd14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626021, "uuid": "a10dddc4-e658-46ea-9d02-239b1372225b", "comment": "Malware payload (Loki)", "value": "a2dd4d5e8f2b9d81a18371746c3ef8a127a0cfb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626021, "uuid": "e0cb1336-ab94-4700-8384-15fad690eb5e", "comment": "Malware payload (Loki)", "value": "722f2c5c4b7dc67d82403d52aed7289329157c6133d1912c8acb90d191eb901aaa083fc9f1a5020bc803d5aa4e17cfab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626021, "uuid": "911ada46-e816-4a79-b1f8-b8d5fefa2851", "value": "50457C99721072DEC95BCBF289581C26E7596DEE530B9203A02331BD9A7D99FCF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626021, "uuid": "ff912859-dc8e-479f-ab0c-0902059e83fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626021, "uuid": "1dcb79d3-7215-4b4c-ac2b-6ddaeaca4c58", "value": "24576:3zpvMLNSJZSQmeO9d4fYNFKi0biYuWOBfWlBC:3FENSnSQsd4fYSbiBBBEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625626021, "uuid": "e5af90e6-e24a-4d60-b17d-eb7d06ad9c75", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625626021, "uuid": "0cd353ce-b234-4856-93ae-49a039aaa532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626021, "uuid": "2424bd6b-e597-4709-bfc6-221368b13bd5", "value": "RFQ20210707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c932080-deff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625647284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647284, "uuid": "154e2afa-4f30-4d4c-894b-2973998140e5", "comment": "Malware payload", "value": "69cb0132016e82db0198ceb5f527bb43", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647284, "uuid": "83557f7b-9ade-47f6-892f-652bd097afb7", "comment": "Malware payload", "value": "50e1c2be61e9f2937df649868a641e3f3221c7222b8bf5ff75820d51aa8ab34f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647284, "uuid": "deea2228-8dc0-49ae-b53a-da90b7e6510d", "comment": "Malware payload", "value": "b571db19a73c7e0f5cffb47cc064d4902a311ee3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647284, "uuid": "0073d686-6bbf-4e18-b787-c806b02bfb88", "comment": "Malware payload", "value": "3fd11d69ba28e9fecfd633471dd3dbf4f0e459cab827f86edfbcfd1c3b9496f67b2861e93a865141e1bcb33eaeca6b3f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647284, "uuid": "1857402c-d1cf-43f4-b647-226f9572d073", "value": "F7341237042EA491DDBBB1FD112028F2BDC0C998C3A4F72AB4A8A6015ED701375A97F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647284, "uuid": "fa73a8d8-b139-4b58-a436-4db3208d7e4d", "value": "6144:OS+zTqlduGGenTTT5ctGQXzg+SKt0VH5MGT6QqSc9RISe0:OS+zmlZnTTTutGQXMfLHOplSc9RISr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647284, "uuid": "24ec0d0e-1a93-47bd-842d-cbb8109c62fc", "value": 242966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647284, "uuid": "3b1a6d3b-7903-48e6-8d1c-2a9c3d62290f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647284, "uuid": "9242d897-8ef0-4593-b101-4995f43d8ed3", "value": "10.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b33992-dedf-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625633716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633716, "uuid": "6857ecee-48fa-4bb0-a879-df249714f0e9", "comment": "Malware payload (SnakeKeylogger)", "value": "35d1dfede00cba54d90273491df9b05c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633716, "uuid": "82413205-a8b4-4c99-98e7-c8b7f8a303e1", "comment": "Malware payload (SnakeKeylogger)", "value": "518278cdbf87c6e43a3d8949cd14671a97a8450021ee8562609988abef8df79e", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633716, "uuid": "94a2c07b-e878-4dbd-b42d-8e2db3441790", "comment": "Malware payload (SnakeKeylogger)", "value": "72ee1f95abea42ccafad0757740512581b996e55", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633716, "uuid": "45165a06-32fd-4180-9084-d0e6055e6ba5", "comment": "Malware payload (SnakeKeylogger)", "value": "c9e11c016d4f537f46416685a9dae1a9401a9911a6d36e7ef18d2d4bd3aa3fc121722305bf9c90e14deef683af4e5f6f", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625633716, "uuid": "bb442a63-55fc-484a-9a01-c85f9c31b40e", "value": "6A755A7960F28BD1EDBFC73C2FA5750C2FE5A666D247EE786C9470890580B404A71A2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625633716, "uuid": "bf715f53-7842-4324-a731-3b8064302917", "value": "12288:8d+KKi6NsBSD/F08SxyeUDtZykcmWk+qF5JDxHKrQN4VA:8dNKi6NVYErjwSHmQN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625633716, "uuid": "12aac5e6-b996-4fbd-9dbc-31ef4e447280", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625633716, "uuid": "2ada8dc5-6c09-4ee8-abd6-dffc64e5e50a", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625633716, "uuid": "de994421-12b0-4979-ba02-e3e9f204a046", "value": "INVITATION TO TENDER NO MAT 021 PJTS 021 FOR THE PROVISION OF SUPPLY Instrument Bulk Material exe.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f22bea-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662927, "uuid": "c916b17d-27bd-48ae-a519-0407f9632eda", "comment": "Malware payload (AgentTesla)", "value": "b3ab7baf905abc13342af7d13cda6c85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662927, "uuid": "55381de8-1db2-45f4-8804-ea855d573d73", "comment": "Malware payload (AgentTesla)", "value": "521f65a7d39edd2e748c09cf55828cadc6dea6848688e455a7e32b3f3629a654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662927, "uuid": "497c3799-1846-45c1-87bc-7ca368edc58f", "comment": "Malware payload (AgentTesla)", "value": "6794b6a674399ead4bbb3cac4bb28044bcfe621b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662927, "uuid": "ee85dbb4-35ff-4d64-b0a1-77070b38439b", "comment": "Malware payload (AgentTesla)", "value": "ec18c70c806658b9b630553e71ccab1d1908cea84fdec4f4ca56d00f2d011e42833c384dac280764fd8072d53c48af1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662927, "uuid": "3f2e1287-cfb4-412f-9e36-7bb3ef891526", "value": "F3F44A983312759EF416C832B957DCF0EA107E664B0B860390D33F9BB91E5D6CF911AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662927, "uuid": "315785ae-8d01-40b5-9543-3a6e3f7459e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662927, "uuid": "bbb806e9-96a1-40a1-aa87-dc2688c5e95c", "value": "12288:pi+8lwaRKRREbAfvaeZXAXexLiwIJevR2LgfqKCpG6kjyzZL4+cHl:pi+q4DGA3bXAXqvR2Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662927, "uuid": "4109db6c-fb70-480e-9df7-d03cb9aca893", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662927, "uuid": "93c11e6f-445d-4701-9ee4-eff7f8b388a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662927, "uuid": "1f90fba3-7dbc-491f-81cd-5bbe7fdad111", "value": "SWIFT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684fae53-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625661584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661584, "uuid": "6c2fff95-e6c3-4ec5-8ed6-a41b5eb60fa9", "comment": "Malware payload (Loki)", "value": "3ea4639e4da6290ae0ac20a72a3b19dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661584, "uuid": "1d742592-1c92-45b7-aa77-d744cebacade", "comment": "Malware payload (Loki)", "value": "52a330fcf88eb3f54632c90b02954f323415f84e61b5e1a4e06e0fbf076127f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661584, "uuid": "6daa5851-866c-4215-8605-2b60dc966551", "comment": "Malware payload (Loki)", "value": "c274fcc51498fa95a50914e081c9de1adef187bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661584, "uuid": "20cba05f-394d-4977-b9c5-f24d96649e48", "comment": "Malware payload (Loki)", "value": "b04dddff5608384c98fc9e8757e7b91e5c56709543f918a747ea0d8d8e397cd8dc5c81cc7c49c57cc1db4fc600a1e80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661584, "uuid": "90f52411-812d-4ed5-b48f-86ee1d948cff", "value": "7384E0001507F92BE9BAD4723483B08272267F2518F09EEE9747793D06B11589AFFD7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661584, "uuid": "c19a47da-5112-4efd-9736-f09e895370af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661584, "uuid": "25ddf555-dfe4-49d6-97b8-1473e1f4d02b", "value": "6144:Mff+klKamRRfsvEPJTlRJa7HCobbl22/ddJvFwD4kgwYqjewdp0kO8AX:gdKaoRfsylnLoHw2/ddXIMwdp0kOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661584, "uuid": "29b6b6f4-03ba-41af-9602-0b4eecdbdbde", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661584, "uuid": "cc8590f5-0d6a-4396-b952-1e93c94ebb87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661584, "uuid": "e246c574-b0ef-4d53-897c-907a641d8711", "value": "Form RTE PT COMMUNICATION CSI PER 2021.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f0db56-df51-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625682725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625682725, "uuid": "c18270c3-ae5b-43c0-8af7-55787714b95c", "comment": "Malware payload (AgentTesla)", "value": "6d3b2f6ab75bbcc9bc6a0dd71b178fd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625682725, "uuid": "24b9bf85-b977-4d2d-870f-642dc94a1f03", "comment": "Malware payload (AgentTesla)", "value": "53746f9d7fdff42f0dbeb621a10e5ea4f98587a39926fc141bfded0549207d28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625682725, "uuid": "25707ec8-36fa-4cb8-af02-9c9b24de544d", "comment": "Malware payload (AgentTesla)", "value": "b8055689e10c3459ba2488ab750eec31885eda09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625682725, "uuid": "37abca55-36fb-4679-bfec-e1dddb89b95b", "comment": "Malware payload (AgentTesla)", "value": "03b099eb6d133d9bd45cbe644a7259a4602432e064a8629e633211c8f389161749c017c97b108ba35669bc9514c37afc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625682725, "uuid": "ff17e3ce-a114-4426-abec-cc9882f4e228", "value": "T17F45DF7620338A82DEAFC7FA8771251E4F6DAFFE904BB6741984707800F4B5D4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625682725, "uuid": "422e317f-fdde-482d-a552-9777a2a37c88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625682725, "uuid": "2a616140-bd7c-421e-80ad-56e84d646948", "value": "24576:84+9CLSH6FJyMghvrmvPTt9CSDR7ztSChTUeB0biYuWOBfWlB:8T6WMglsPWSDR7FTkbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625682725, "uuid": "23345d58-88c0-4b25-b030-0c1928338ae9", "value": 1252864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625682725, "uuid": "6fe8ab33-080a-4377-8d46-06c7066c3ec6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625682725, "uuid": "ffdc3b88-140e-482a-84d4-2851ac38711f", "value": "INVOICE FOR SETTLEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea925f75-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625634744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634744, "uuid": "2587e2a9-6b37-4280-8f12-8efa51999df1", "comment": "Malware payload (GuLoader)", "value": "d6c42da192f6d2abf7724f5ef5b91a44", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634744, "uuid": "e49d511e-6675-423d-830b-910ef674e813", "comment": "Malware payload (GuLoader)", "value": "5412f23a1b3a16a80582f3c4b7546aa9816b36dc66702101b59cb63625ba5e0a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634744, "uuid": "ea20e61e-0333-409a-b71a-55943dc24e31", "comment": "Malware payload (GuLoader)", "value": "1aa2f29aa9c192040adf401f54542b1328c46e9d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634744, "uuid": "9a865b56-dbe5-4186-9f03-fec786a78161", "comment": "Malware payload (GuLoader)", "value": "8cb8c6512bcdcbf0e2f663146f5243ab1becd44304768fc9ea5d393c3a016f270e4b8caba706a24ce1031377c86679f5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634744, "uuid": "439df55d-d615-48d9-a539-7e4af9807163", "value": "A5451282BAB057E9EF4630BB36666CE8B5CD8EC45DD46B17A24233BC15711D8335283B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634744, "uuid": "fa910736-c954-4956-8bbd-80bb61175e0a", "value": "24576:KBhDZd5bChkzXcSxyO6pNX5uFOxQQmUO8whm7BpRE3:+zb0O8Oc/I2tfwsHK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634744, "uuid": "2b184938-da44-4606-8fa3-6e42b578e4bd", "value": 1201304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634744, "uuid": "c5212a95-c4bc-4390-9af6-796ac17be79e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634744, "uuid": "09bae4d0-dcc9-4790-8494-132501020981", "value": "6306093940.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2649b61e-df09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625651595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651595, "uuid": "ef3c3211-8c87-413b-93ac-e57020321fe0", "comment": "Malware payload", "value": "1895ca3eac42fb4084d007bb4fe5ae7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651595, "uuid": "d4267d14-92a5-4796-9ab1-498d8e3ee139", "comment": "Malware payload", "value": "5570986beb105c43ab6207cb482e8c133c87cbf9dcd3ac40ff016f945c0faeae", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651595, "uuid": "cf2799a8-b516-4556-84cf-7d86fd011d3a", "comment": "Malware payload", "value": "a0120dce0c694e760fe1936a26a569a35cbf2f52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651595, "uuid": "16398801-dc43-482d-a48b-69a5391d3cb4", "comment": "Malware payload", "value": "a581eaa07ccd28879f6e6b81cc27482df4aaad10d2681a609d2c9dedaeac127ac44375b6b15c82b67cefe8d64baff206", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651595, "uuid": "fca1b249-d255-46de-bef0-a43bc7338068", "value": "4B62F9CB47061817F6F7CB3F2C31DD948FA62AB041A910F0DDC076BE5EF654A849A61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651595, "uuid": "dd229126-df38-49d5-b3ab-10936de76b37", "value": "befd011f90184d7406f46fd7bf9ac681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651595, "uuid": "262ce76c-290e-4213-a578-d11824450705", "value": "192:3wDdHuPzssrQmzpkDLGgTAtfHujj582WPcCgW2hgN55a8rajb57ARo8e:MdZsrQ0pQLGg0huj2ahgj5vMsBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625651595, "uuid": "35acd47f-2f4c-43b4-bb72-1bbb3f5847a2", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625651595, "uuid": "f6925a38-d8a9-49a4-8688-f98941f26745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651595, "uuid": "92d82bed-6ffd-4edb-8614-67f9d5c62f26", "value": "SecuriteInfo.com.Variant.Barys.126731.5533.1148", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9a59b6-decb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "b283ebcc-f89d-4162-8c84-b5fef199af6e", "comment": "Malware payload (Mirai)", "value": "2ce9df08d924b0be55e7669009ca4b99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "bc7e7c96-02ab-4f53-b2d0-278b54b2c732", "comment": "Malware payload (Mirai)", "value": "567d23319550602bc615ae2a85178b1382437a87295b52e479496b46f9a06f43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "4e388756-f88a-424b-b383-ebb41b491fdb", "comment": "Malware payload (Mirai)", "value": "d4b35c4f014cb1850be4f20601f881ca2b26eaa0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "b03d9780-f779-47b2-8eac-d5cc386fb75a", "comment": "Malware payload (Mirai)", "value": "ec1cbbc02da55c6f4f64cddb34aac76ef34246a44b3d6c42fd411faf41ea67ef123b6674dfa21d28ebe71b6b605975c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625329, "uuid": "2732743e-86f8-4ca6-9978-964e7a107e54", "value": "65F2F2756B14EC32DDB0143F9894EDD229C40F74EBA6701F04125AAD96826CB3EF58D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625329, "uuid": "b4715fe7-6ec1-4981-98b3-0e5fdd1b4efd", "value": "768:rL1Xbnn+KP8jIdgVEAVjBdF3Mps470tGknXPc9q3UELQl:r5TizhF3MpNGXdLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625329, "uuid": "a0678cf8-81eb-47af-b4ef-382a65994285", "value": 36272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625329, "uuid": "0a409e6c-334d-4133-b7b6-952dbcefc6e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625329, "uuid": "a564a7ad-5dfe-4b0d-8b8b-7beacf9218ab", "value": "2ce9df08d924b0be55e7669009ca4b99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f185bf-dec5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622634, "uuid": "ec342305-1734-46e3-ab0c-96a54ef8be0c", "comment": "Malware payload (Mirai)", "value": "481df6d99dd4909695b592ca21aad1be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622634, "uuid": "c900b535-0a43-489d-b3e2-e0e9a15e7885", "comment": "Malware payload (Mirai)", "value": "58b09aa78fda9ab9bef14b678e6544b1bd272172772bdbc97a4bd5e4c2052707", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622634, "uuid": "8ab59d63-bad8-4115-80ac-d500038ebefb", "comment": "Malware payload (Mirai)", "value": "12edaf6e59fcf39582376de5f76f2835b79e835c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622634, "uuid": "de7a9957-a462-4b91-b231-1f83f2cd6731", "comment": "Malware payload (Mirai)", "value": "4de6119315ad72d6547a1fb6b865f9c481179b7557078135789d6672ad2264e850e7bcb04de286419bb35e537d047421", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622634, "uuid": "2b9cbd59-d8c4-44ea-8af5-8ac841e87a08", "value": "DBC2E17CBBD9749BC2711839F81452C3B98792FCD1F281613168098C62C5C0BAB7DA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622634, "uuid": "a88138ce-a748-4ce9-98c7-4661acafeaa4", "value": "768:xTvRPbnltNA1FeB3NxiBgmqBDy2wj2uBis3Uozns:xTvpDm1Fw33iBzWD2Bfzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622634, "uuid": "816e4c61-e259-42d4-bf22-74f4275cda83", "value": 25912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622634, "uuid": "644bc7ef-00b5-4b8f-b32e-83b2fd88d723", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622634, "uuid": "12fa6f8e-6e96-456c-9e77-e59179ecb70a", "value": "481df6d99dd4909695b592ca21aad1be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879cb2f3-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625637585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637585, "uuid": "a59d76e1-4a82-4b9e-8d41-fc9e4cbc6b43", "comment": "Malware payload (Formbook)", "value": "adf6ed5fef0e3ed6753832748aa4b00b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637585, "uuid": "51ae075a-5214-4f29-a238-06175fa3e802", "comment": "Malware payload (Formbook)", "value": "59c0070a646d2a159d705d743a4baaffdf9a7c20e0a4587a488050b9af1eaad1", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637585, "uuid": "c6c8d71c-dcc6-438a-a34c-4339f436d32f", "comment": "Malware payload (Formbook)", "value": "716ecdebe997aeb7713e3a84fb99a030219a18c6", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637585, "uuid": "09492766-d095-4b25-b84d-a48ff36931f2", "comment": "Malware payload (Formbook)", "value": "9547487008edf1dd263a1431dea416fcb1ed3268ed8aa890835577e3bc964227765761e48609a46188952926b7a248b7", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637585, "uuid": "a79e34c1-a2f5-4c59-9620-b94e418adc5a", "value": "03D423D7BE5F058E900CAF236C8FD4E320226E506D2F546B237689E7E31A6D91BC1719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637585, "uuid": "07f8d46b-6e2c-4711-b6ff-2f6bcdf09962", "value": "12288:JxgfSH7g+GQyGEWr2CkW9sQIzKl/0DKBS9xSoaq5n+YXJhKiWDJPxQI:wfSHJGQyGFC3Wmh28+BUwoa9YjZWDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637585, "uuid": "af63ab56-9da4-41be-8ac6-83f4b902a45d", "value": 610050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637585, "uuid": "fa4535e6-b34a-4206-89ca-e8b4d4ae7163", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637585, "uuid": "66bd6f88-5a0e-428e-9726-9795de831fd0", "value": "SOA-456612.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedfbc8f-decb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625330, "uuid": "84be2ade-6b17-44cd-8e1b-02ce7263354f", "comment": "Malware payload (Mirai)", "value": "4fc8482ebdd877c8260c212a04fb5ca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625330, "uuid": "509fcc33-eb7e-4133-a2cb-bb51362f71b0", "comment": "Malware payload (Mirai)", "value": "5a95e1af62f43ed6e90d8f59c646d8f5813934b383d5261742b5e6376f53d783", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625330, "uuid": "02a8e7c0-bd43-47c6-905e-f83dc8898e46", "comment": "Malware payload (Mirai)", "value": "dcd55f48e401ae1913e09f816491e40cc8d8193c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625330, "uuid": "7e02d69c-2571-40a7-aa18-1154e6df641a", "comment": "Malware payload (Mirai)", "value": "b2b35d78aa2a2d89a6e52da6d6d8badada03eae7bc62f611684acb55942db277a6d2c1c1baf7a915fa8f93462cb1746e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625330, "uuid": "529debcf-fe45-40f1-822f-ae2cf77b1e25", "value": "49E2D1ADE3693454CE651E79704B1A7C4FD832C1327B8B4E53359CC56236489B73A8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625330, "uuid": "f86fbe8e-7ed6-4f00-bf73-300db3467011", "value": "768:eLf78pr/7dItbVbi8LGNj5m74Hg2uF4B7TGecUwwvp2cvhogWM:er78phI/b3G1sEHYFOfGedp2Cho+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625330, "uuid": "cbbd0d73-2395-43e4-a838-183db9e6137b", "value": 34032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625330, "uuid": "060ce828-d3b1-4bbc-808d-9c7f8025431e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625330, "uuid": "d82b8aa2-636b-41db-a0b4-a1cd6254ed0b", "value": "4fc8482ebdd877c8260c212a04fb5ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638fe54d-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622922, "uuid": "f2137479-eb27-4038-8fa0-a639eaace93d", "comment": "Malware payload (Mirai)", "value": "f04b6024a9eea468f6f26ecc5a3122a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622922, "uuid": "72a03803-4212-4ffc-8aae-43e051914997", "comment": "Malware payload (Mirai)", "value": "5bdea880206079ccfaa64615e7695a1d7c1efa0cf44f0fa27a04ab9f8eaec288", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622922, "uuid": "c25d1ed0-ad64-4ecf-b958-4f15435dfc76", "comment": "Malware payload (Mirai)", "value": "a39fea36dcb0164578f8b676d720878dea4e1d6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622922, "uuid": "fdf29d18-f549-4f81-9bd2-e0d71ba20458", "comment": "Malware payload (Mirai)", "value": "2cf63eec1045de75f52a36c1dc72879082a0a292c6b7a8eb0817b9cbe94e430bc3e67aa4982007ed0ec21279ab144572", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622922, "uuid": "fd4a1f7f-a7e1-4f8d-9f52-d4dd1368d721", "value": "00D2D02720A221DDCB6781F35B7087602B919F53D203F41AA395D1E3AF9A9D03C937E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622922, "uuid": "276b3093-b1db-4e86-a0b7-31f3cff3b633", "value": "768:ZVCqcDodXE3kBzjwR7vKBITqrmIBJgGlzDpbuR1JT:ZVC9odXEuPwNsmiVJu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622922, "uuid": "a200ba35-9129-42bb-9899-c04ae085cda9", "value": 30516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622922, "uuid": "53d6abcb-27e4-430f-87d7-3fd1289a7762", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622922, "uuid": "211e1e40-5f53-4d7b-84a3-852e1478bb88", "value": "f04b6024a9eea468f6f26ecc5a3122a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ff88e2-df6f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625695717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625695717, "uuid": "f24d8447-49c1-4c94-8d33-14cd7b8c2cc2", "comment": "Malware payload", "value": "7db2c2cb8780cfbe64ac49beb00f27f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625695717, "uuid": "13bbb0e5-df3b-41ae-bb24-9c1d782420e1", "comment": "Malware payload", "value": "5c85d31e96aa84a80c123af889f960bbf39a7c13a2ed9e2d9644ad2e3fa366de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625695717, "uuid": "a5dee7e2-7e28-48f5-a4ca-235e63d82a9f", "comment": "Malware payload", "value": "443f56c64b3c6bd6b4c0969a59d5d3fd21170386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625695717, "uuid": "316d9bec-e100-4bde-9eb3-e464325e6a08", "comment": "Malware payload", "value": "1ff1a8fc84f68b369bcc38c75d5e6f66e48c287604e77ef31bde35077e39d70b932c1297a3a40339b9433ef8c738052b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625695717, "uuid": "aad6ff5a-7e98-47a1-a42f-db80169b61b8", "value": "T1ABC42351B338B510D1DD09F1C4A3A8A002B4FC8665A2CF6CB58A773B64277E58B97B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625695717, "uuid": "3cc7a2e9-2e07-43b3-af55-6ead1fff6dd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625695717, "uuid": "0511879f-c6f4-4f01-83ac-e43a09536698", "value": "12288:izKUMYX9H9JWf9yIIvEqNFrRdjnU/nHFSBQ52ooy:enMYXhwH2ECFrnUvlSG59z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625695717, "uuid": "b6db01f0-46b5-4e2e-9243-192be736ed06", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625695717, "uuid": "0e0e0edd-97c5-4d6f-8a08-d351e6e34889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625695717, "uuid": "b08a76e0-7ed1-4afb-90dd-a87d7d259376", "value": "7db2c2cb8780cfbe64ac49beb00f27f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c1d208-df1e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625660806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660806, "uuid": "94437624-a0d8-4019-a73c-f0c7bb9d7148", "comment": "Malware payload (SnakeKeylogger)", "value": "d8bdc4ce5f93cb0175f998b83706328c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660806, "uuid": "43f2d2d2-9827-48e4-bddc-0c4b5d826489", "comment": "Malware payload (SnakeKeylogger)", "value": "5c8974292a63e007d64fb43ffa31166c7ad3daeb7e08e7f9bab2f8e0e17b060c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660806, "uuid": "5a836f39-346e-48f8-95c1-32aaedb4ac8d", "comment": "Malware payload (SnakeKeylogger)", "value": "3ae1d7b109786a2ef379e1e46048913a30df0967", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660806, "uuid": "c89b30a1-ed3c-463b-a2b7-b7111162d5ba", "comment": "Malware payload (SnakeKeylogger)", "value": "bd3af5246c8dcd94b41043dbc6a0aac9ecc033f76c57c1cc31f894f8770433b88147a27d91c5726ce88bf0dfd80a2187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660806, "uuid": "44de5ed0-390a-4f52-9cc1-60ec8235a828", "value": "9B55AE7E70F28BD2EEABC77D5FB5751C6F6C6EAA90066E741C84716800E0B590A3142F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660806, "uuid": "2110207b-0eda-4aba-a88e-202b321e06c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660806, "uuid": "0671ef70-df01-4db0-a692-ed116fd6e88c", "value": "24576:9rOM/Ir8EEl2woqWBr04LZk4EicN5IvIK3i/P5N0biYuWOBfWlB:Vk8EE0hzwdHIAm05+biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660806, "uuid": "c3a2131a-8de9-4b93-85bc-d16b8e6124bf", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660806, "uuid": "9b89eb3d-32e5-48d7-91bb-477227002746", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660806, "uuid": "3970e1ad-fe8b-4ef4-9cba-e19fa63a6dc3", "value": "INVITATI.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9450bd1f-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625637606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637606, "uuid": "ed90dbd3-5aeb-40b4-a9e8-4eb2d1c0bfa9", "comment": "Malware payload (AgentTesla)", "value": "3a6fd2470a5449be09f34196f1c68874", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637606, "uuid": "52ce3d82-0965-4672-89ce-97f025c466ca", "comment": "Malware payload (AgentTesla)", "value": "5e3dd11769ba2b4d02e36ea18cac6e5609610daae6cdc659db647dac1efbeac3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637606, "uuid": "a4cc59b0-9299-4433-83e5-fd7f89643426", "comment": "Malware payload (AgentTesla)", "value": "499f040713d6da679fdfeba8a9a19eb211184dc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637606, "uuid": "970062db-700d-40a2-bd19-3151eff089a2", "comment": "Malware payload (AgentTesla)", "value": "c2cf5b427448799a2ae880e764b6dc1cca2c21d06a40c0df4a09be3705e2dbb08082f697851b6283d7ae6dafc650bbc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637606, "uuid": "ce188aec-6cbb-4413-940a-b54a80846237", "value": "CCF45B58739231DEF4168432BD56ECF0E6107E664A0B890358D33F9BB91E5D6CFA10AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637606, "uuid": "43dc97fb-7ac2-404e-8ac2-9186c432d991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637606, "uuid": "323a2bcc-7d9e-4257-9c7d-59c3c3d19f3d", "value": "12288:gsfZTxai0UpnYLvPsQKhcFF7zH58MkEcc1n6XUwpdZhzfjY5f/Zk:gsfZNOIY7PsQKIFnOfc1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637606, "uuid": "b825a8e7-9ba1-4ad0-9cba-0261ac5500c1", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637606, "uuid": "08aec8ba-9db6-4829-bd6f-76bdc35b42e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637606, "uuid": "7a4818d5-312a-444e-8b61-38d4c78f97c2", "value": "quotation 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58040c4c-df1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660268, "uuid": "207480f5-e36b-4786-b012-7d37341a540f", "comment": "Malware payload (AgentTesla)", "value": "9007a877c85bcd2055100848bdbbc3e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660268, "uuid": "b9ee4904-5236-41f4-bfb9-0d0fa11b24de", "comment": "Malware payload (AgentTesla)", "value": "5e6822d0bc5dc704978529cd98df1bf6bd86bb44240a6afc74e222b69260e29a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660268, "uuid": "a455b9cc-25d1-4390-ac6a-891d776da01d", "comment": "Malware payload (AgentTesla)", "value": "a53b34c66f6f08880fb37ee7d13073d47082d6c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660268, "uuid": "f2279ec5-b651-4dd3-b2ba-d3bc0363e60a", "comment": "Malware payload (AgentTesla)", "value": "d5e124c939a84df3ebe1f5870a81788cd2bfb6ec3975ef3ab533a9bcccad0483bdb7868720bb5018d108fbb8238aa515", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660268, "uuid": "10086417-1c00-456d-a9dd-41897a87c7f2", "value": "C0259D983312749EF4568832B956DCF0E6207E665A0BC203A0D73F9F792F5D6DF900A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660268, "uuid": "6eedd6e3-6689-404e-b574-b6d1f53322a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660268, "uuid": "cea77bce-c915-47d4-b994-be07d4620d4b", "value": "24576:kxd+K7Lkmk7NZBoQM/QGOAK2DK81Wjmv+2:Gd+K7LI/5WJzf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660268, "uuid": "ed3b4d4f-f2f9-4e10-a0da-efab657b9d35", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660268, "uuid": "9e4e3a0c-298c-435e-9e4c-c02569146b39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660268, "uuid": "98fb906b-04e6-4fae-8c96-1cb7c021e5c9", "value": "Cape Tallin - 21002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c90509-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625634609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634609, "uuid": "391b0abb-b47f-42e2-a38d-964e696b7bc6", "comment": "Malware payload", "value": "6197e6f8ab09d8906d9ccd08277f3c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634609, "uuid": "5132936c-976d-47e5-9cda-da774271d670", "comment": "Malware payload", "value": "5ea0e7b1e594dd2fad47eb3761976558291987c54ec03ce30bb29cb72389f7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634609, "uuid": "ba33a232-0f8a-4fc2-8012-525ef71edb31", "comment": "Malware payload", "value": "e60b222b763a73abaac8f811bfea2c1ab76e1b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634609, "uuid": "7064db23-384f-4da4-806d-9ee78b12b97e", "comment": "Malware payload", "value": "3fbaaa4f5e429a3d8f80511c80ee1a8c6601a767920d6ed39966f1ca5bbf73c985212fde1380452d7d293c79b39b7950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634609, "uuid": "32eff3c0-51bb-4778-964a-3d9fc980a3d2", "value": "98E5235028DBDD35CB7A24FE063AAA20E6D12D93C475932B3BA21D651A097B0CF4F4F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634609, "uuid": "2cddc8b9-a289-464c-8c18-915a9a2248d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634609, "uuid": "caa372e4-67f1-44fa-b150-91e63532798e", "value": "49152:D/smhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5ge:dqXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634609, "uuid": "0ee91136-9e5a-4b36-a952-5f4ae91f87b9", "value": 3098112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634609, "uuid": "c26e6e1a-a2ef-44dc-8c1f-08c2ea785a02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634609, "uuid": "2b686e2e-c852-405d-b30f-e006ad0c31a1", "value": "6197e6f8ab09d8906d9ccd08277f3c24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58829b27-df4f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625681744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681744, "uuid": "3508fd7c-caf8-48af-aac8-7ab575dffd15", "comment": "Malware payload (AgentTesla)", "value": "a0af0f22d739ecec5c93285155ec7ba1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681744, "uuid": "ebae3ad7-4146-4bcd-af0e-c6d869224e36", "comment": "Malware payload (AgentTesla)", "value": "5ebba9ffed0f85b2cea24705945b216bc4cc0ae8899e3cbd45aca23aa5cf8621", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681744, "uuid": "03537c61-76f6-4279-a8fc-1c9762d669ad", "comment": "Malware payload (AgentTesla)", "value": "65429e65179e0e7946ccb9397224147b80a0a08e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681744, "uuid": "45b9ff63-1267-4327-8980-910e8fd86485", "comment": "Malware payload (AgentTesla)", "value": "c360e3a5deeeb592273928e9be790aa4753875134e05dc10dc6126bba4f5c8d0c72384ab72a52ed9cc4b6d86d6222c2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681744, "uuid": "ae2f68d0-8388-4cbe-a48b-4ec2722ba92e", "value": "T166F4334C046D0B5EF923462B352EE1EBAE98576187DA32AD7583288C714CE7ACD4DCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681744, "uuid": "ebae4970-7765-49ae-8740-04b81ac4803b", "value": "12288:cbqvumpypMeh7ejTGLziZyrMoyhMZdwRJTcqy2NkeirF0zFaOzNVh8NBf9vcmbcf:cbmUJ5QWZTqyyFf8NBVkmbc8vkF26tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625681744, "uuid": "76ba1423-4a9f-4b19-ad5c-4c35369eb0c1", "value": 727306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625681744, "uuid": "e2c309fb-7fbf-45ff-b661-32c76d6027aa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681744, "uuid": "768b661f-4beb-4196-9983-9161d86eefde", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af108af8-df3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625673729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673729, "uuid": "ae937869-cfee-46c8-b4cd-a3eb740a34e5", "comment": "Malware payload (Dridex)", "value": "4edcdb358f196720b42de2e604053b4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673729, "uuid": "de8a0741-6067-4cb2-b928-082b58d71f71", "comment": "Malware payload (Dridex)", "value": "60292d0e9ee95a94029fc83e6caebd7d8bbc694bef446d90519df743cbc45cfe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673729, "uuid": "7d7a7427-0ced-49b4-815f-34f086afdba8", "comment": "Malware payload (Dridex)", "value": "a9a7e1372e896842cdce281f35608cd0019dd966", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673729, "uuid": "b354015d-0174-476b-8b74-2067604f9af8", "comment": "Malware payload (Dridex)", "value": "ca001a2e2265116534581e03b979ae3117e664bf11f5030ab242d1cfaf3a0354cba213a042c7ecdee9432f34963e8f46", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673729, "uuid": "72702838-4f20-47c5-ab73-b5747bd37e21", "value": "T187241280D96ECD22E8531AB0B0A53635F697B412E73C88FAD5510E52D4E60BBAEF4394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673729, "uuid": "f215b7fd-b654-4402-86c0-59a32a1912ee", "value": "5ed8255955121801372e7c6b712481f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673729, "uuid": "3b49c145-a666-4251-8097-0336fd1be2ef", "value": "3072:+SI+WoG9xtWHr+5me2pjf7rmWVOX4ntUke2hwQKwuIvh0Pe:ZItF9xQ+5d8jf7ynX4WcKw/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625673729, "uuid": "ca8c4571-7d06-4fda-afd9-3b0cdce45604", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625673729, "uuid": "d2b20dbf-cac7-45f3-85ac-94958ca99d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673729, "uuid": "fecb1fd1-293d-4ceb-b83b-c4cf105bb79f", "value": "updkas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a1a18f-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625661628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661628, "uuid": "22967f17-9836-449c-9cfb-87bb40304b6a", "comment": "Malware payload (Formbook)", "value": "2aa0258dbbe90199fd72527657934d99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661628, "uuid": "b3c05d09-b6c8-454b-93ba-cae6f346b52e", "comment": "Malware payload (Formbook)", "value": "60e441c4ec5069f84883ce8ca94dc81e0d364691e7ab620216c9c9364f9242a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661628, "uuid": "d6cab6c8-bcba-41e8-b03c-fd42300df51e", "comment": "Malware payload (Formbook)", "value": "c88f0125761523cecb8e222be131acc95c22cba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661628, "uuid": "a6cc9886-4c4c-4d7e-8a7d-93dc8b4bdf8b", "comment": "Malware payload (Formbook)", "value": "9e6d4c0c7c5b3ee032482d66a679886c1f0a038f4652567c9aa21a999d5e84d5413e5823ddae0b5163c15850f3e03a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661628, "uuid": "5b32d0f7-8d88-425b-bae2-7fc464743842", "value": "A754D0513990C832D3E60C30D576C7B0567BB8722A729A8BF274BB5A5E337D215E6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661628, "uuid": "56cf746f-77e3-48da-8386-720f13d232e1", "value": "66702af7dacbf23df3a48effcd9b6a08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661628, "uuid": "52a6c833-7874-4982-aca7-0aa42ac88aa0", "value": "6144:9Zgr67PAzxKZqF7hrd93c+ljYbx/Lj30H8xu1q:L7PAz4k7Mx//Ecx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661628, "uuid": "ff1bf5f7-46a0-47e3-9089-b91ebd279605", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661628, "uuid": "1de6d863-88d4-40b4-8352-98f7f6ef7751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661628, "uuid": "5f8e7f7b-f08a-4879-b712-f95fb7d0dfca", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e081d53-deff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625647259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647259, "uuid": "bd9b0178-573e-41d2-9091-1bd6a26b5264", "comment": "Malware payload", "value": "09375463114a69a8bddfc35e1dd127d4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647259, "uuid": "0b0239af-5c15-4181-88cd-9667b67f3497", "comment": "Malware payload", "value": "61d7aaba22cd963c497c4525749bd54f6a7241f0c9c6a128f262645f42ecc536", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647259, "uuid": "7604542d-acd9-4d60-996d-5a55fdaa456a", "comment": "Malware payload", "value": "9ad1b811fef89494f52c65531a293fb68efc957e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647259, "uuid": "01e5c567-ca21-4d2b-a703-3cc874d577c0", "comment": "Malware payload", "value": "a32c1e51cfbff1234ab54e8c6addf20a0d54a9f6f6686aa8ca0c7a2f3a2f18d8ac7dd8a5be4c2458dca79662199dbb71", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647259, "uuid": "3dbe752b-6dae-4882-83c6-6f4985c9b584", "value": "2F54230A29947463F5174EFE8C23963545307DBBAAC895C7A70CB6FB03C0D685AE1D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647259, "uuid": "78db9bd6-40fe-4dd3-8b98-76a422d01bb4", "value": "6144:s9UYi12iCVDfW0Mj8LJPVwvuKAs5YMwIEkjL8tJ2OS4oU41u:L2fDufj8ZVwUgEIEQ9Oh41u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647259, "uuid": "c0adcae2-a19d-4bb1-a1cf-54715323c4aa", "value": 304147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647259, "uuid": "5ba1f651-c9ea-485e-bb10-bfd2471e2754", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647259, "uuid": "233ca721-c060-47a4-8b0b-53651d0fdf7d", "value": "7.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1575e4e2-df40-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625675189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675189, "uuid": "ef2b8bda-5ae9-4152-9a20-1571901280ec", "comment": "Malware payload", "value": "e59c9e69d042db4c6a46de00cd82f309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675189, "uuid": "0840aea8-f956-4afd-b1f5-d6c2deebcaf3", "comment": "Malware payload", "value": "635456b0435989d1f25876ba2cdfe2514a8b23944741ef8c5ad271663ccc9a8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675189, "uuid": "468f136f-b361-4170-bd52-c2d09cea90d0", "comment": "Malware payload", "value": "2a58909b493db8ad80386d730d63b07928bc3a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675189, "uuid": "3946ddcc-54b9-455d-ac45-f02bb29f8bb8", "comment": "Malware payload", "value": "a0b42520fec6706702026ee5a6f1b6491d7eb328dc68c133bf4fbc9d1efa7a4f8722d3cb57ba9a182cdf0e2fade70eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675189, "uuid": "9bf81f89-587e-48aa-b495-916eaae3e236", "value": "T10914D15076C2CCF0F4A319360CF5E37F5F3E79128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675189, "uuid": "92aa64f1-7a30-42d9-8200-242fcec0a9a5", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675189, "uuid": "97af9431-ed47-42c0-8db8-b2feab4fd367", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJj8pYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjnfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625675189, "uuid": "bf276fdc-da5e-4a01-94b4-16e4d23a9969", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625675189, "uuid": "a595878c-7ba3-4969-b4b7-57224deabc38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675189, "uuid": "36ab16b5-8e3f-4793-9e7b-c413ea31adf5", "value": "635456b0435989d1f25876ba2cdfe2514a8b23944741ef8c5ad271663ccc9a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281c6249-df09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625651598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651598, "uuid": "c0d3458b-3fa7-4c47-baa0-6f4387c93a0c", "comment": "Malware payload", "value": "685a607a9982e23575e5461dad50c180", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651598, "uuid": "de18ef43-9661-4d8e-a3cf-5a2f0fd6b091", "comment": "Malware payload", "value": "6471fe3bc71b62c58c38ce3b098b56bf6be5b75c7a62b72a6437ce530defba73", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651598, "uuid": "9fb5715a-1095-44e2-94ae-4687600bdb05", "comment": "Malware payload", "value": "749e068ff0a11b00d5a76b9bf85e1ed6c2f2fda1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651598, "uuid": "1383558e-69d7-4a8e-8edd-ef254d62eacb", "comment": "Malware payload", "value": "0541b2e8eadfe76f55c25cf9816a4d6be6eeced0862c18479624c9a1d02846179df3b1b53721be41e283f686c6d0e17c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651598, "uuid": "a541459e-ca54-42c8-917f-bd65e2d1ae0b", "value": "A932D553291E0FFAED6B4DB90D8348677D250D43A3004472EBCAD26A9F9C617BA49943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651598, "uuid": "0af1dd98-a360-4d76-be9b-ba95fd329e24", "value": "befd011f90184d7406f46fd7bf9ac681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651598, "uuid": "80e98c84-1f9f-4264-a45c-8df78c0234fa", "value": "192:raNjP4XnYYmGzLjY9U928OBAteWHn48Xq:eNjAXYJGzLjYq/V/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625651598, "uuid": "f2f82bc7-fdb7-4d63-9c74-9e440be739ce", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625651598, "uuid": "9ea3d293-87d4-45a5-ba15-ae39ee5866c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651598, "uuid": "4da5464c-3130-4c68-91df-25faf9a6d776", "value": "SecuriteInfo.com.Variant.Barys.126731.21480.19771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2c196f-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625662958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662958, "uuid": "b907e78f-6868-4359-955d-92b2ada3d1b1", "comment": "Malware payload (RemcosRAT)", "value": "e923b22f256d91583a849dd17f043c2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662958, "uuid": "04351e84-1129-4c63-a827-8a92e1db4244", "comment": "Malware payload (RemcosRAT)", "value": "653162513b0b91ca4232620e9233402d8da6b89a362c78475d2c20da78f9e72d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662958, "uuid": "cfaae9ff-0f05-488a-a3ea-ec67c1e9d522", "comment": "Malware payload (RemcosRAT)", "value": "aaf20ccd444cf00d9db84c07170db3b785157d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662958, "uuid": "5766fa44-d7c4-4892-8081-1d28e90e6517", "comment": "Malware payload (RemcosRAT)", "value": "954548d8078107bf9d5fe1d88e5b7069b4426503b166a8bfe42e490b8c9309569146a747e8399076bfd57644e7233ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662958, "uuid": "d27cf824-e151-4880-b86c-647b3a801f52", "value": "27158C983312719EF4168932B957DCF0E9207E664B0B920350D73F9BB91F6D6CF910AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662958, "uuid": "0a371005-1d27-4a86-9d4d-04cf60100c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662958, "uuid": "b7366dff-3bed-4ec7-b9b7-cad8d260c4d2", "value": "12288:0FOfAdG0NqYVUKGDG3GiEOnFjD4dWq9g5RTb1OX0DU4tegT2lg9gVqIhvnxUmn9I:0Uf2xj9GNOFjW1K5BbUrhg6g+xUmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662958, "uuid": "76647dcc-d70f-49f9-b177-5545d41f742d", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662958, "uuid": "b9ebd594-b40c-4f5b-9a11-b10258a711c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662958, "uuid": "b5166b8b-28e8-4f17-a845-d4b77db0cd31", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347b0c59-df33-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625669658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669658, "uuid": "5bf23997-58c2-488c-a4ad-c24c846a1277", "comment": "Malware payload (SnakeKeylogger)", "value": "f50ed57926f5a64aa7e9133d63c14bcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669658, "uuid": "c2af00a3-77ce-45cb-b1db-9f95897cba70", "comment": "Malware payload (SnakeKeylogger)", "value": "662ee7fc631d3c10fe076a423737392e2937950fa734be06e3a3775d7bb91d4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669658, "uuid": "f4036c7d-b61a-4931-8a92-722e5a6dbffb", "comment": "Malware payload (SnakeKeylogger)", "value": "ee1e1c061a1abd9b6526a93bb279026b86fc5c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669658, "uuid": "d2074134-49e0-4c0c-bcaa-ca0478815dd5", "comment": "Malware payload (SnakeKeylogger)", "value": "21620cb2d0508df377baca08ffa434b390ad678ee9655e5400e4183e7e19738e982c18a7cdb93d21fc2e92e4f7c22784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669658, "uuid": "a4cf20a3-e06d-4253-9708-c1b52d57acb9", "value": "7945DFB670328A92DEAFC7F94731511E4F6DAFFEA04BB6341894707800F4B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669658, "uuid": "38fb8ccb-441c-43e2-bd05-282ab0dd9392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669658, "uuid": "3d3eae5e-cafc-4d90-adfc-00f4fc0989c1", "value": "24576:FJnhxsKVlcmV8Wxq6F17sY5bDY10biYuWOBfWlB:FJhxsWcme8F9soQmbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669658, "uuid": "1d3c9602-fc0f-419c-85ef-004c031c933a", "value": 1247232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669658, "uuid": "0974d799-5444-4691-b749-bb738d5cfaed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669658, "uuid": "bc282cab-3f6a-41de-a517-2041b1e0c013", "value": "TNT AWB AND INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbad953-df43-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625676758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676758, "uuid": "045c41c2-c625-4de6-81f2-d57436070256", "comment": "Malware payload", "value": "80b7c8675b8876142040c591273c3e4c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676758, "uuid": "a66d22ef-c367-4683-83f5-bbe31508cb53", "comment": "Malware payload", "value": "6897103cb308a216378f44599cf7f6aa885d904a41136a0143ec40d05a3edc66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676758, "uuid": "67e2047a-25f7-4c36-b9cd-76db0cf02eb4", "comment": "Malware payload", "value": "a19508ddcd24809d34a0cbbca074fb9d0c47112d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676758, "uuid": "9309ac61-3f45-4f29-acfe-58f6b84a079d", "comment": "Malware payload", "value": "6f1d1bae8fef6c9cb8c9155993968beb9ac7c8bb596316284f410b5c52459b6b339d44cb15eb62e311c816e243250a93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676758, "uuid": "189bda77-e327-46c4-b895-2e785b2e015d", "value": "T19D6208174D181C0FD4AF8F36C827023BF11AB48CA99235F92EE3D4687AC4D553A6226E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676758, "uuid": "829b2078-96a3-44d2-bb21-8f7b11335c40", "value": "befd011f90184d7406f46fd7bf9ac681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676758, "uuid": "3b2ad726-d79b-438f-8284-2e6863353adf", "value": "192:Hy5+S+rwY5uEd3C/eFQgv1sy0dL9Hs6ItnVVGQvBpIH:S56Nuz/tI0pPiLRppI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676758, "uuid": "19c2a79a-632a-4301-b663-d57dfe11b490", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676758, "uuid": "97bdfa9b-0c2f-47eb-9de2-248094c6857e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676758, "uuid": "8c0ec053-dfd1-4e82-adf5-385278202ff7", "value": "SecuriteInfo.com.Variant.Barys.126731.15225.1944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f756aa-df2d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625667296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667296, "uuid": "ac6c6f37-a63a-4fc1-a340-f7a0ddf6ca70", "comment": "Malware payload (Formbook)", "value": "2917322b5a697f277c547dde1f48df49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667296, "uuid": "8814f362-6680-4f51-b7c9-bbdf1d53ec6e", "comment": "Malware payload (Formbook)", "value": "68ce8d90669037ccbd6aa1f309b397fc0c0126eaf250329ec5e4974fda2d7b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667296, "uuid": "0ce8f39a-44f2-4c52-b6d7-ccea3ebc4a14", "comment": "Malware payload (Formbook)", "value": "164c6bb605a1c3ee43c0b59267f54b6987be3d6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667296, "uuid": "007bcf48-623d-48f3-9e9b-14e89a96c318", "comment": "Malware payload (Formbook)", "value": "ada6967b43fe3c7e277576039afbbdef9c1d5447313e467aca5a34585c1e38c8109df40ade31d135e47ffbf70c5eee42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667296, "uuid": "abba2caa-47fb-4d48-83e8-4cb060e25c0c", "value": "E2E459983312759EF4168832B957DCF0EA107E665B0B820360D73F9BB91F5D6CF910AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667296, "uuid": "e2fc813e-9c40-4cdb-b6aa-cbaba072d066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667296, "uuid": "9e3fa48c-cc75-4c52-9bd3-79fc8883ecea", "value": "12288:z/XGagZPS8ZU3NRUagZFyj6DoZ/QdIFLm1sHO268hRf0lD/zhoMbJO8E:z/XV+U3vgZG6D9IFLmuHOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625667296, "uuid": "acf7a868-2f56-4c31-992c-3f20b8144945", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625667296, "uuid": "7a1c5c99-7496-4253-b53f-258d25d4865b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667296, "uuid": "7f91e8bc-ab40-4e23-ada5-66a8bc87f7aa", "value": "00098QW6890JHG_SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a414b2ef-def4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625642787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642787, "uuid": "07f2223b-24da-4ee1-8a9e-d5336d6c0ea0", "comment": "Malware payload (Loki)", "value": "c0d19c0c4abc226521cb265d731a4427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642787, "uuid": "45283d08-4592-4a54-82e3-e0095ab17908", "comment": "Malware payload (Loki)", "value": "6a1be88d091d3365e9343a762f8ef32e88c6c0953efd09b7fdcc6bbf514b2ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642787, "uuid": "4fc6e8c3-dfd5-4f3c-ac32-9c17c1c04cc6", "comment": "Malware payload (Loki)", "value": "631018572dd0f611e928cc4f6fafdc9024fd1f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642787, "uuid": "22333710-67b9-48ab-98b2-0a2fc3fb325b", "comment": "Malware payload (Loki)", "value": "871d3d2c3bd4e028b54fd64a555e1df2aad63d38737bc29e9c98daf4ebcbccae33fe9d7f816d3f35767ed81dcc93d72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642787, "uuid": "209e0c0c-794c-4597-bc20-c88c4f0b0a47", "value": "8F442B53BD609421FC948E30F86CA67E33063FF591409A2BB5B7BE637A70742B465623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642787, "uuid": "1683d85f-4d23-4654-b8a1-f34c872834cf", "value": "af73adfc1f8d67c79f555ca796fd24dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642787, "uuid": "1b2cc122-0834-4984-ac42-04f5b34af7b8", "value": "3072:qw535ErzkG0OmATuY5ZncroXWbQkUZuxXJxYiZS7uarzkG0+NKSbX:qw5JS7moiMWbQRuxZaiajkSbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625642787, "uuid": "ecf6da7c-8c1a-4ca9-add9-3607a892688c", "value": 255120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625642787, "uuid": "5db217f1-7354-418a-bad5-5644bb94ba1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642787, "uuid": "421942bb-02fe-4065-bf91-8bd1117e3f85", "value": "STRATO-AGB 07-07-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeccb081-df41-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625675876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675876, "uuid": "8b1205cd-4002-4341-a33a-f78515fa60d4", "comment": "Malware payload (Formbook)", "value": "36a47ac43e18edc49e7433882c6b8b82", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675876, "uuid": "5179ac94-0ad5-4bcf-851e-ca186008eac7", "comment": "Malware payload (Formbook)", "value": "6a94e8eaaa10d0324ccb099fcaba42420078047bbb72195de2e6a94be9ec0706", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675876, "uuid": "93f397e6-b639-4c9a-8421-0b9f10eb8451", "comment": "Malware payload (Formbook)", "value": "91b13d548b329451bc72e6227c8ab7d6c34e25c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675876, "uuid": "5a9123e2-6c4d-4fd9-a08c-e0436326eae4", "comment": "Malware payload (Formbook)", "value": "1c1c4b6af330e8fba94f60dba3a68e021b6f4245e51c596c759be276c79d82e5ee69ddff3b7523b272b49e3aeeb4f5a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675876, "uuid": "2475b8a2-0a85-4bc4-a2d4-79f54946bbb3", "value": "T1A7353355EE24712AD5AB98B2E337F0D6063F1D6880170C1436DF6A4FE0AF42B6A5CDE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675876, "uuid": "1887860d-6338-45da-9f45-736850c82043", "value": "24576:eIrIg2AYbD8cMwwGcuNNgw1KS9K3bvQvMYh6SMWGl5j:d2A6D8c6JuDX+mqzl5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625675876, "uuid": "5ed2b596-dc09-47b2-9243-09a290722d70", "value": 1138241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625675876, "uuid": "4f3b907e-7508-4f6e-8530-d679df0ec2fd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675876, "uuid": "832d289c-5758-4c90-be2d-63887e986fe2", "value": "SWIFT_USD51876.00.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f97b9fc-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622942, "uuid": "f7d49fe3-d3c6-422d-aeb5-2532a17824ea", "comment": "Malware payload (Mirai)", "value": "3de1b63875fa1163a9cc71b6e8a4afe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622942, "uuid": "cfad4356-3aa4-4bb6-9c60-c1064dab42bd", "comment": "Malware payload (Mirai)", "value": "6c206978349b85e38b281ee58a41769f3799b93fbcfb52da10f30c009aa903be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622942, "uuid": "ff9623ca-70cc-4eb8-a0a4-b579c4deaae0", "comment": "Malware payload (Mirai)", "value": "5d17c1bd6e98e466318a8c71c1ee3c53f61adb75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622942, "uuid": "47121b79-0717-4371-8549-07f3c7553fda", "comment": "Malware payload (Mirai)", "value": "37798639d685f0520ec447ff881b8a63a168f6837ad1c30d0f3cf924d8784ba123ef27467ac229a7d3ffd12af29cdddb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622942, "uuid": "2c1e950b-6fb1-442f-98fa-5fb4a8f9c254", "value": "F333F121288DED71C9A00075DC7485EBDA5A85CDE8BE397F278258A89D430C6DDB835E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622942, "uuid": "a3c0ab10-b54e-4832-bc7f-8c9428e1d9ad", "value": "768:DElnIsmG+uBawJ1gc/HHcDtO/w489q3UELmHBWdyWMk2o+URTjMmTfC:IlnINuBavcfHcDA/DFLmHBVxUJjFTfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622942, "uuid": "e0755b0b-9aa9-436c-9bd8-5567ed7079a5", "value": 53304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622942, "uuid": "315d3ba0-6040-4ba5-acf9-a7d20f613b1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622942, "uuid": "16e44182-cd86-4885-8659-98d4669e06b4", "value": "3de1b63875fa1163a9cc71b6e8a4afe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf354a76-deca-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625624793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625624793, "uuid": "5446d462-10ea-47c9-80fb-94e800454add", "comment": "Malware payload (RedLineStealer)", "value": "6dae4048322cc7e3e8aeed2b656a6de9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625624793, "uuid": "fb3e2bf7-1030-4b78-b662-9356dc145aaf", "comment": "Malware payload (RedLineStealer)", "value": "6c529300665e2cfd74a5375533e6b7e9c4cf4eda074c1578683d0094edb6ef94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625624793, "uuid": "95b6c1d0-be67-490f-8528-491654c27dab", "comment": "Malware payload (RedLineStealer)", "value": "5eaeb621bfb0969699f2d313acddd433813ebb61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625624793, "uuid": "593ecb79-61cb-4f9d-ab90-6473c881a21a", "comment": "Malware payload (RedLineStealer)", "value": "066156c37200a49d19a383e797432978f2a4a27e522eff72fc48690fa0619cbb1c012cd6a16f98911bfae95131d5d6d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625624793, "uuid": "663a811b-9ee2-423e-aee0-35c25e1b5713", "value": "39744528647FC01985E3EEA22DDCA8FBD99A95E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625624793, "uuid": "8853ca63-6d0e-41c7-84c7-7843006d038e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625624793, "uuid": "05d6d11c-7728-481b-9461-bc3f28ee4b9b", "value": "6144:RSwKqovb6tR7e5cBpasa0Dcn4eFLTmgN8m7:EwK3vb6tR7e5cBpa30Dcn4eFLTmgN8m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625624793, "uuid": "71742dce-eda7-43f7-8aad-18ab77f8ca01", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625624793, "uuid": "0cb6cfee-f72a-4ffb-beae-279ec3018cd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625624793, "uuid": "ca30e9e6-7d85-4fe6-bff1-4c8e4ac87567", "value": "6dae4048322cc7e3e8aeed2b656a6de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa9793b-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625661615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661615, "uuid": "26049ca2-4dde-4770-b1f8-879f630458cb", "comment": "Malware payload (AgentTesla)", "value": "b1e9ae91515bd1908fbd56f4dc456aa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661615, "uuid": "d809c7e1-363a-4cf4-9a9c-14206b6fb1b7", "comment": "Malware payload (AgentTesla)", "value": "6c838b83ecff0d930f544dc8b10c9e856e2d601bb2552f01cc6c8dd57c2f99ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661615, "uuid": "221cece7-ea5d-43a8-8771-cafa080ddd86", "comment": "Malware payload (AgentTesla)", "value": "4befa0261ed66622c3b0d4ffea5299049f895a54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661615, "uuid": "8091f380-bd28-42d7-8ed5-2df620b70cb6", "comment": "Malware payload (AgentTesla)", "value": "715b018e3f079527a4c108fc40352607b7ef504461a36de7330c00f39865df5b733df2be1ada96f951c74c8d4f32fe9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661615, "uuid": "a0c54b52-0559-4087-860f-e043a8712c23", "value": "2D45DF7A30328A92DEAFC7F94731561E4F6CAFFEA14BB6741884757800F0B5D4A5182B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661615, "uuid": "cce89c51-bcb6-4c2f-a64b-4adbea2281fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661615, "uuid": "4c7c8f6c-3217-4c93-b868-3f3508309761", "value": "24576:yG80pGODJZlP/xtUFxpR8AeRjaDq41Ucou0biYuWOBfWlB:3GsP/HUFxpR8AeRCqpbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661615, "uuid": "74e9b085-40eb-4f23-b6ec-9a2680df126b", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661615, "uuid": "ebf2b677-8e7d-4c47-b575-974f663ca676", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661615, "uuid": "15f73525-e467-43c6-aefe-5fc4460de809", "value": "PEDIDOS RETRASADOS 0706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e0f9b1-df35-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625670566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670566, "uuid": "77530b76-0582-45c5-9516-22d328fba7f1", "comment": "Malware payload (Gafgyt)", "value": "dab926c1161fccedd46d06159db6d659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670566, "uuid": "3e64dbff-8d26-49e0-b325-66a86db17666", "comment": "Malware payload (Gafgyt)", "value": "70381fa25544a87eda4cccf095c399446a467ddaa024b4814739afe059229f2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670566, "uuid": "c08649a5-5420-4ff5-8471-b9977ae2acad", "comment": "Malware payload (Gafgyt)", "value": "16f8c26f47b3da5d189a298d213cbd1654ee1c65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670566, "uuid": "d03a12ad-559b-4203-a49f-f090484428c6", "comment": "Malware payload (Gafgyt)", "value": "e44ae3c637c2f605549dddc23c9e22bac5f712283df876b796ba04d57a7b04f827c23015b414c0a5a5ce04f1127d215a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670566, "uuid": "9ee87a13-9d33-4b47-bc70-e80c9213dede", "value": "T1DFD3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670566, "uuid": "96ce52e1-b53a-44b0-b45c-0e383d16c939", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+p5AOhmm/QMurB12CGNb:RrUlk5Xmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670566, "uuid": "304c1715-8a67-4517-9af7-164f59018d53", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670566, "uuid": "8e0b61a2-f4bf-4492-95ed-6c553542a72f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670566, "uuid": "214e7540-d39d-49a5-9789-e328477b7df1", "value": "dab926c1161fccedd46d06159db6d659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4c7398-df34-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625670367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670367, "uuid": "7ff84cbb-6b2d-4562-bd58-9ff3c191a0e6", "comment": "Malware payload (SnakeKeylogger)", "value": "c78cd345bff52bfbf2dcf485e1ba8837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670367, "uuid": "38c1a9e0-5f29-48ef-b853-8857bd30faf8", "comment": "Malware payload (SnakeKeylogger)", "value": "7115e54104d01f83c9561389268c68082f3b20d93bfe1469a5e8de614f3dd74e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670367, "uuid": "f6debadc-f0ba-4d72-9a48-00182f7deb6a", "comment": "Malware payload (SnakeKeylogger)", "value": "f7ebb1550e6450e5d6d429ac36026fe0b016a706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670367, "uuid": "5b5b4cd3-4e46-4996-9bcc-b22d113106dd", "comment": "Malware payload (SnakeKeylogger)", "value": "f75f2a50f52e5c72169811e2013f6cd673bd8528e5ac302050ab9f7492386d9d8833187b40ea2c7452f9dcde8f2d9b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670367, "uuid": "4871222f-e94b-4524-857f-4d81aab1acc1", "value": "FB942286A301E6BAC7D976B6488BE0181E7E9D45C516EAD7956C3FAF3C7E302039013C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670367, "uuid": "e1db0f7d-5714-480a-9b7d-dea8196fa102", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670367, "uuid": "25940978-caa2-4122-96e5-15b09373b3df", "value": "12288:l9qn1wgXrJCOWyGV6QVsCjqpm+8TRU253IZTc/:Hk2g7JCOpksCjwm+8TRU2WZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670367, "uuid": "247d8114-8965-4bb3-bdad-38d0ced6a014", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670367, "uuid": "f988047b-72f9-45fb-b947-c2c4494cd6bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670367, "uuid": "5393bcaf-3130-4059-a632-b32dd606fcec", "value": "IMG_056029741000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28bf5c4-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625672876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672876, "uuid": "591b4149-9e82-4f04-8a03-09984f3b9f02", "comment": "Malware payload (NanoCore)", "value": "623413e919ae0a97a295205d7ecc016b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672876, "uuid": "3be97f49-c261-4aa7-b9ac-bb771d3443e5", "comment": "Malware payload (NanoCore)", "value": "736a674fa02f8e3035c2ea7c3698b36db0feb980b83522578e0c6e2aab05d0e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672876, "uuid": "f4d1206f-0af7-4076-b914-4f7e48a320eb", "comment": "Malware payload (NanoCore)", "value": "4f78cdfe53205bcabdc1c2e6fe5b097d7c1c851d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672876, "uuid": "dbd905cb-94d3-4dc0-aebf-ff7238dca727", "comment": "Malware payload (NanoCore)", "value": "0cad3ac7e697ea51a667f393c618af00d3c93e0b55547bef76993984be2b0a46da3700266fb133a8af790ae69da152f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672876, "uuid": "27eaf4ec-145c-47c8-a7cd-23031c070155", "value": "T1F5B4018161548632D2994CFBC86973C80FBADD1B1B22E954607F3EA67C323899BF5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672876, "uuid": "f2ba9200-f4bc-4eb1-8282-a0480c985806", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672876, "uuid": "839e4b42-a9d6-49b6-b479-e0dbfe130909", "value": "6144:c5NAanpFSrv+ZLJshJTPVKhxS9Wew74F6eQWhrCxIcvoL6bHhqK0/6sJEyNZ:dan4vJJRKbepF67Wh8IcvoWma8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672876, "uuid": "8a2bbc37-6d40-4ed2-befa-8afa289680a1", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672876, "uuid": "1d7adf12-89c5-4c9e-b822-d4eb05356dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672876, "uuid": "4572ad29-d9f8-4ac7-b6a2-5cb4d29215a9", "value": "623413e919ae0a97a295205d7ecc016b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b78e423-df54-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625683762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683762, "uuid": "3687590b-5a8c-4d61-83fd-e909a3b7b629", "comment": "Malware payload (NanoCore)", "value": "2aaf8f8966376cddfab41c51ff9cfc1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683762, "uuid": "31c16b95-f434-400a-9fad-c2a5b4926cfc", "comment": "Malware payload (NanoCore)", "value": "73e73341805c1e6d337567c0c6388efb665f759b879e15737794006af1e6f258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683762, "uuid": "77f537c2-4f43-429d-ab70-b635cc039a43", "comment": "Malware payload (NanoCore)", "value": "76e2ddcb3bdf098ed63ac4a8d624721604482a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683762, "uuid": "a8f11210-b408-4767-9554-d9b166e60236", "comment": "Malware payload (NanoCore)", "value": "43b1eee47fbe4b7dc79554fee5e09219a566158e43c527b7cd92cdef6b2d05bd7fbd83ee712dec476515e8d397f023e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683762, "uuid": "2e4c04c8-a2bb-4fb0-89bf-0d2dec4a9d64", "value": "T111B49D3DAAA4272BF77791758A814055F1BC90EB36319DD787C7228C350E9027EEA32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683762, "uuid": "6b65cc82-703d-49d7-afb5-c41294d6d9da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683762, "uuid": "c6dbab6e-98bf-4646-9bf2-332693a5a528", "value": "12288:RpT8EKlXgFxY3wBeTY7aehbKsh5rsQ0+Me+E2RZxwprD7Na1YrBfZww:npdr/Me+EUZxwRQ1iBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683762, "uuid": "dfb311ca-1eb0-423c-b0a2-b681daa1c5dd", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683762, "uuid": "b1042fc3-35dc-4534-94b8-36162d1b1357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683762, "uuid": "14f9dab0-a959-476e-bda9-351b9e696dea", "value": "2aaf8f8966376cddfab41c51ff9cfc1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab3ecf2-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625634369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634369, "uuid": "5b8c20b4-5f0b-4755-9aef-1adb8dc12c9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d25e59d71e6c22a46620a33295ee46f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634369, "uuid": "70f971ab-af9c-4914-89f2-c75f55bcfccb", "comment": "Malware payload (SnakeKeylogger)", "value": "74a7a39a137e6a3d6874b56099218317d0a34f105bd1b1d3ddfbb9d3c8429ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634369, "uuid": "6dc1832c-925b-498f-90c4-db0f29b70288", "comment": "Malware payload (SnakeKeylogger)", "value": "aae3a7701e7500a6bc5970bb43cd05c118331b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634369, "uuid": "80da9940-b3ab-4b6d-bc3e-713c848efba0", "comment": "Malware payload (SnakeKeylogger)", "value": "733a6449dbf168463da75df31b9fe5449148e16f4f9ff417969e6ff60a64b21adcb3652930c37394ced6be7220f171aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634369, "uuid": "0875115b-b065-4c90-a32e-df22a181e3e1", "value": "C135BE7A60328A92DEAFC7F90731661E4F6DAFFE904BB6781844B43500F4B4D4B61927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634369, "uuid": "04e58f94-b2f5-4329-bb4c-3cfb8020492c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634369, "uuid": "19528aa4-4ea2-47a3-9978-e8a010117731", "value": "24576:T1+HdTuaSvvdhADj2hr9xbsd1KRElbavi0biYuWOBfWlB:T1ujMd6Dj2R9DR2bYlbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634369, "uuid": "e6d051ce-6d77-4766-848b-2256b7ec014d", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634369, "uuid": "c7287e47-cedd-4002-bad5-e2d29c44a298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634369, "uuid": "4d7bcc4b-d429-4d26-b480-c7e6c7127b50", "value": "EPCC Of Export Oil and gas equipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3334206c-df5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625686835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686835, "uuid": "af2b0c83-6725-4118-9c6b-1342700687f1", "comment": "Malware payload", "value": "1b16ac0e8f82a21f04fd43f2501c81f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686835, "uuid": "a7151f61-9d60-4752-a952-55847b05c7a8", "comment": "Malware payload", "value": "760b2466db1fdc2d2c1651a730cfd6c14bfbcbd8f69eeb56ec8426d46784f4b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686835, "uuid": "cc4e76af-25ab-47ae-8435-3d67e9c9c5d6", "comment": "Malware payload", "value": "de043c2903f10c128475489dc79567de5660a4b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686835, "uuid": "fa664b56-79f5-46c5-89b8-af311a687584", "comment": "Malware payload", "value": "815d34d70adbd29d71ce575a8188ebc9b2faa4c528c85fb571eb200fec17bc21ad127a410dd88a574278ca17f566cbf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686835, "uuid": "718b42d6-63a8-4eb8-b3ed-14db89c7da10", "value": "T1F6F47D23F5D25437C46219784C0BE6DEA96BBE002D2465C7ABF53E9E8F7928138391C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686835, "uuid": "3e497505-b07c-4df7-955f-745a956a9bea", "value": "76139ff953899a69c3980d2d044e4370", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686835, "uuid": "14b085cc-0c6f-4cf1-a6ee-3fc934560698", "value": "12288:FqXq5p/SAz8XgXuv4SOkMn1uFW3R1MDEZUQ4NZcxv3TWjSiuPBR5lpbTYwMvF:Fn5dSAz8q2GkM8WqUNNTGSBRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625686835, "uuid": "b6343d6d-c0d7-4fd5-8ac5-32a16bc12ff6", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625686835, "uuid": "0c6ff972-5f5a-4d67-b82d-9b931eb53ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686835, "uuid": "09764a25-1ee9-40fe-959b-c25d3585875c", "value": "1b16ac0e8f82a21f04fd43f2501c81f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd456124-df3d-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625674290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674290, "uuid": "3d0a4646-077c-4034-8e14-be05b2d6a5a9", "comment": "Malware payload (AveMariaRAT)", "value": "027023909c1173e2b46e65eb7a2cd87e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674290, "uuid": "dc21c08a-5849-40f7-befd-ddb57eab0b8d", "comment": "Malware payload (AveMariaRAT)", "value": "76a3a025aba08f23847bd9367069baf5ef711723737f09e940012d627fddf195", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674290, "uuid": "96405d95-88c0-42a4-aa27-2f1abb3b9a36", "comment": "Malware payload (AveMariaRAT)", "value": "8dbcb0a9a6c85278f582955f074ca050c2db26fe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674290, "uuid": "c564dccf-ce83-4ac3-b717-171c29fd4610", "comment": "Malware payload (AveMariaRAT)", "value": "d8ca2957d01958f0544c9d1bc2562d8f9cbaf4b4cfe7c6b6320a7e386a484d980711d6e2a5f6a72561a3fe48e7f06514", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674290, "uuid": "dc08d468-5c6b-4dac-bd1a-b0e0a15e0667", "value": "T1AEB39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674290, "uuid": "dc4e6d8c-0e22-4420-b4ab-f3d14d4014ac", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674290, "uuid": "4033072c-5391-45e4-b9ec-47b080772b27", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01R:K1VmhaH8EFvW+0OVE0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625674290, "uuid": "f1b1bd5a-bc5c-46df-b9b2-ffac9bc0f0a8", "value": 111547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625674290, "uuid": "7238ae14-7b60-4fe7-8b04-2ce57585f5c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674290, "uuid": "43e25427-dd92-4e73-b57a-c92f1f7ded0b", "value": "027023909c1173e2b46e65eb7a2cd87e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd1b356-df57-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625685348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685348, "uuid": "1a7264f3-9664-4244-ae3c-c0634f4779b5", "comment": "Malware payload (RedLineStealer)", "value": "0d689efe87b06c73fef15abcf36d2821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685348, "uuid": "90549644-a6c6-4f0f-b970-7edb15aac8ff", "comment": "Malware payload (RedLineStealer)", "value": "7824dd7f9f25fa2e7e3fb71122453db738875e67a6b447b015f09d44354fc993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685348, "uuid": "0b5b6765-5a50-436a-a93a-d199e5b30355", "comment": "Malware payload (RedLineStealer)", "value": "130c909d30c236c21cd4caca4566cc983f4a379d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685348, "uuid": "09783d8c-1772-4f00-8e67-c14b989c14d9", "comment": "Malware payload (RedLineStealer)", "value": "7281334e478d1fb59757bc53400a7b35bcc07061d254b57731b7a6da72ecc8d6f8886b73705a89637dbdd5219c9d0cf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685348, "uuid": "a06ab774-d2b7-4eee-823a-37cea301bf4b", "value": "T1C0C43AC1D01081E9C8757771C87F4CB606B83CA7DAD13AA61798B52F3A791E7483AB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685348, "uuid": "9f92e86c-a549-468e-a982-b242345a15d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685348, "uuid": "b7a78220-3a43-422c-b721-07d068c6e252", "value": "6144:n0kLkQiYF7H8rMZvdrr6nR0IwT26Z06wRpB39Ganw3Mzgy:0V/YF7H8qNenWI80bGa7gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625685348, "uuid": "776468e1-2b9e-47a8-94de-d33212984920", "value": 546496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625685348, "uuid": "73dcc75a-c8b2-492c-9650-f078909b5ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685348, "uuid": "4a191cb8-7444-4286-9dd6-2776b768d6bb", "value": "130c909d30c236c21cd4caca4566cc983f4a379d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a553fe-df5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625686380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686380, "uuid": "242f12f1-0280-49fe-8bf3-46acc3886083", "comment": "Malware payload (RemcosRAT)", "value": "649e264be8f3e82828fb5e84466afedd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686380, "uuid": "6ceed57c-8a8e-4791-9813-09a2d3620f30", "comment": "Malware payload (RemcosRAT)", "value": "79861a10fcfaf967d54382b93d84ed03e5d5202cd3dfdcb599a535520360017e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686380, "uuid": "b021ad73-e765-4f4d-8556-20624572910b", "comment": "Malware payload (RemcosRAT)", "value": "abaf0dfc2f573bddacef5c578e5c5d85f8217e1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625686380, "uuid": "a6535c1b-99a6-422f-bd9e-2f4230cf6711", "comment": "Malware payload (RemcosRAT)", "value": "c48d9ff6ebd106a3132e9724af0bd1c4650b804322afb773a81a715f4dcd3e83f4aa1cd96df43c331b6dbe2a33204df1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686380, "uuid": "271a1b52-452d-4ec8-b2df-0d924c9916bd", "value": "T143C423762240E6A5E0891F76A5BF88984330B5DDFC74CE7D184E216FB8337A74B0B646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686380, "uuid": "1d6318c8-2b92-4cfc-8306-2bc75aeae81d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686380, "uuid": "874bccff-b464-419a-8f74-81f261f52cf7", "value": "12288:HvZrAKLL54AEy7zAshveBtMSW3XshVv0mNdknz:PVLL9EuXyo8Pv08kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625686380, "uuid": "eac29626-3ff5-48bd-a8c1-2dc4219afe45", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625686380, "uuid": "ff585d06-fb72-41a6-9291-8d5cb00e1ec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625686380, "uuid": "621f3464-707b-460a-bd0b-546c4078760e", "value": "649e264be8f3e82828fb5e84466afedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89822e3f-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625637588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637588, "uuid": "684af544-7c72-4295-99ec-30b0cf746755", "comment": "Malware payload", "value": "04028f8012abfcb75b1847d1e8880e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637588, "uuid": "ee9a568f-8e37-4e12-a851-16bccf876e8f", "comment": "Malware payload", "value": "7995f469ec0df7564c20d520a5169d6d9a93e47e13911d7a20264c058997b5e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637588, "uuid": "91066f76-0f96-4f90-9919-31369ea38c10", "comment": "Malware payload", "value": "c8013260e6ba2258108e8357c5a72973f2e1f09a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637588, "uuid": "e583acad-1d4e-4619-9368-5e982185f020", "comment": "Malware payload", "value": "4368092f297e57460f25934032ab291ebd27c9b3b0f05d6650f5fb9b25937c5bb83f596b6900ada2c45c80bd1704f515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637588, "uuid": "2f5e4385-8043-4809-8096-3d7a9f31bbe9", "value": "23F37C713A90C432D39605345835D3A16AFBF8B229368A4BF6443B6E5E332D1A6F7317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637588, "uuid": "b63e0751-0fd2-4b8e-b6b7-ab37219eb47a", "value": "1032a46fd4e2ff5ee27353305df6f8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637588, "uuid": "90ad56de-0fbc-400b-bbaf-0e682a6e124f", "value": "1536:bZWPEUsT91kStI3LpDj1TMj0q7cIqsWp7PP5pJ59aaaaaaaa4uHOsxfs1GUD6rVT:bkPZmsLfIc3sWpzJ5BxSDE28mBIOkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637588, "uuid": "1ec7b484-82b6-499d-b6cd-43430a469fc1", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637588, "uuid": "4c78542f-9eea-4440-b65d-a8b8da16170b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637588, "uuid": "56db4980-65b2-438d-a294-17a5027c7b45", "value": "04028f8012abfcb75b1847d1e8880e28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f09e87-df70-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625696079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696079, "uuid": "288dacca-9bb6-481d-8893-2207c0526124", "comment": "Malware payload", "value": "af0f46d75cec678c150b6f57f8b64750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696079, "uuid": "0b7162d6-c24d-444b-840c-6930a56dd43d", "comment": "Malware payload", "value": "7a7f77fc4dd808cf0bc818fb9a05c0c1a9a9a21cd06e9982b014b8e4e3824562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696079, "uuid": "cf959264-ec19-498f-a293-46b543c75217", "comment": "Malware payload", "value": "e694b95562c87d0ee820220b39128933f5a65e9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696079, "uuid": "e402246a-5e83-4edf-acb5-6e37e360bca0", "comment": "Malware payload", "value": "7039c40a20c9f7712abf325a01f02040f50eafdc723e3f2b4db99fcc3cd832e55571e41b0e47735fd9249ad29aed7c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696079, "uuid": "9d8f4553-3f60-4e17-93c3-38a2c0a43da5", "value": "T173557CB16871466ADC6FCE34C3326E3C0FA77E75FD4EA6396984714B31A76830A22513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696079, "uuid": "651a7da2-4572-4fea-aaa2-024608734cce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696079, "uuid": "d4d8b22e-4c67-4f47-bf70-cb5a67bca256", "value": "12288:W0N+6NsBhOaDaDaQXy7qsWs9LUmga7KTG2XyZa3aC:Wh6NyOaDaDaQXy7NZ4k7XZa3aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625696079, "uuid": "d7fd1876-1887-4706-a46c-a57f7d28b361", "value": 1288704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625696079, "uuid": "070252de-9e82-44a4-a1ef-862613e067ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696079, "uuid": "4d3cf1e9-62f1-4e1b-8d49-13d96b2d27c6", "value": "eDyKVOUhJs6eJfg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a2cf2e-deff-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625647591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647591, "uuid": "a329073a-078d-4f1f-a309-ba61efae92cd", "comment": "Malware payload (SnakeKeylogger)", "value": "7361226cc65f81e9491d51951229afc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647591, "uuid": "81dc5641-b517-4a19-8c32-7dc68cd9706e", "comment": "Malware payload (SnakeKeylogger)", "value": "7a8d14b8df58a67a03169eca5d78508b4caf79af1bd4bd7bd10f34f4c89235a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647591, "uuid": "61acd3bd-9188-4a39-9738-7fbcf8e0112e", "comment": "Malware payload (SnakeKeylogger)", "value": "154c32de8e09c50db2b144aa381f078dd26aebf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647591, "uuid": "6a491217-f674-42ac-a78f-67f11bd83e05", "comment": "Malware payload (SnakeKeylogger)", "value": "f7361759b9d1c128d327b93a35b9c0b87b97eaa217a797ad329548ab6a34de0623f0f401e55a9e6b3f3705184d01a036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647591, "uuid": "e1e1d12a-91c0-4811-963a-db726545994f", "value": "7745CF7A20338A52DEAFC7F98B71561E4F6DAFFE904BB6741885707800F0B5D0A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647591, "uuid": "3421f831-afc7-425d-bd33-2db8ae764e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647591, "uuid": "6e803eae-83b7-4854-b4cc-ebc1923559dc", "value": "24576:VeuNg9jnXjqGerF9tUC/kAuw+AFSQy0biYuWOBfWlB:VeuNgtuGeR9tUXAuw+AoQ1biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647591, "uuid": "39ed937f-3698-4a6b-92cb-b2703cc72298", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647591, "uuid": "58058df7-3d08-47dc-8d1b-4f3766351f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647591, "uuid": "0cc694ed-a11a-4014-9140-2c40d8adfedc", "value": "tMAfN344rmHC9Zi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb3ea37-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625672923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672923, "uuid": "6a20d485-7768-41c3-a2a7-646fab79a094", "comment": "Malware payload (Formbook)", "value": "39453ce51d1dc56cff9dd7cc97963fb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672923, "uuid": "cfbd4c97-4b5d-457d-ad0e-609b36ad9ac5", "comment": "Malware payload (Formbook)", "value": "7b30aa9e1a8c042a0aeabf69e60854f650c2c8ba016f732d5fe44ac80e250fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672923, "uuid": "6c91da20-68d7-4faf-a2c9-5cc7fc62783d", "comment": "Malware payload (Formbook)", "value": "429807f98c018d1c76026fc9c7194730b73f37e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672923, "uuid": "75c83bdc-fee3-47ed-8e37-5ee9786c5855", "comment": "Malware payload (Formbook)", "value": "03c918b5274c3eb9483a323b9b3bb0ef334352f11764e4809c417c2e7b4a6d55b585b8fab187369163c1f2b8ad644119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672923, "uuid": "88d65267-82ee-40b7-a434-b3a1d5087761", "value": "T1A845CF7930328A92CEAFC7F94771661E4F6DAFFEA047B6741898707400F0B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672923, "uuid": "e64aef47-f685-4a15-a7a9-056a0ec067d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672923, "uuid": "c033e6c1-c451-4313-9a1d-08f4050ac988", "value": "24576:0b+yhyMOnGfRNFxMqk9gO/XN2FPbM5+ivvPdW+0biYuWOBfWlB:0b+CDyGfvFqd7vNkjM5+iv4biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672923, "uuid": "f705018e-0b4c-4cc6-b350-ce19940685ae", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672923, "uuid": "c5e58860-aeb1-485e-ac13-294a11141c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672923, "uuid": "0f88c5a0-f6b8-4ccc-9889-2196f3536db4", "value": "39453ce51d1dc56cff9dd7cc97963fb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ed2e4b-ded7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625630094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630094, "uuid": "5bc510e6-ed1f-4f94-91e6-cbcf32d2ab09", "comment": "Malware payload", "value": "d885db1ad58bf621bfce465a9aabc5a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630094, "uuid": "8758d885-5696-4d06-8805-5e40a728b31c", "comment": "Malware payload", "value": "7c07fbd06c9c5f6cd9f124641c2ec7af04e69e7b94ec9a4fc4c1c9ff3e058ddf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630094, "uuid": "de2e63fd-58fb-4b9e-8e27-f66714bc50ba", "comment": "Malware payload", "value": "5fd69ae1cd43ec7a0db053417a8cf4ee9e708ce8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630094, "uuid": "94caf37c-1aa7-47cf-b5e2-60197fa8213a", "comment": "Malware payload", "value": "42c0162752e4ee8758838b62849b9c80fa3bed69d5b29b8e54bc54e23bc9dd22994ee077a50c87aa479383a5e691157f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630094, "uuid": "8149e7e3-90dd-4b01-87b3-a2f6785ec22f", "value": "FA42B376B93B8EF8FD6A0235DB834239496E714001E147E77E8A8B529F84146BC7B2D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630094, "uuid": "094792c9-40dc-424f-9275-26dbfe75bcdd", "value": "befd011f90184d7406f46fd7bf9ac681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630094, "uuid": "1edb2fd5-1d6f-4ae1-b520-9bf6455a8ebb", "value": "96:K9rZK3gx7mj9654GmDz0VRTle1oZgfUuFzxrpodmBdmmRQo9z5eMUa04TFEvi9vv:oFlSzqXZgf1zxqdGdveMUa06Evi9sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625630094, "uuid": "0beb8ec9-7b55-4dc9-a124-3f13521f4704", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625630094, "uuid": "2fefeb1b-d7db-41ac-9469-3cfb0edd8e63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630094, "uuid": "17137f56-7b7c-40d2-8865-f16fe28def52", "value": "SecuriteInfo.com.Variant.Barys.126731.29736.30535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaa3acd-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634181, "uuid": "93b81a52-ab29-4a0e-a88e-e5e59183b370", "comment": "Malware payload (AgentTesla)", "value": "6dfd3f441cba3bff01eb967ebab0e8ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634181, "uuid": "8a41234e-1e4c-40ff-8143-14b216e91068", "comment": "Malware payload (AgentTesla)", "value": "7c4503efb86aa0f5f353c73a94b14a3e8bf54f3964327f9ef51e6862ca9a8258", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634181, "uuid": "760449be-1da3-4e22-8eb9-dc50084c30bd", "comment": "Malware payload (AgentTesla)", "value": "f84f663cf1bae7a13d991f4eebf4977dd6488c7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634181, "uuid": "12b44a5b-2044-4420-b446-db8116f3fbe2", "comment": "Malware payload (AgentTesla)", "value": "11ed5d7cc977707545b5633cd60ced7b3a1560fb750b16175a78178598f9abd2b99477a932a6876639e9ce4f25387eb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634181, "uuid": "39f7e688-20e5-434d-8970-dad1ce8fe444", "value": "46153330286608C429C41A9583B04E4FECCE8C7D28DADCFE7D58578AF2E48FA5E10E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634181, "uuid": "c038dc16-0e1d-40ee-ad98-f918dd44ccf2", "value": "24576:52qxmbBXGAyUfaBpvbZkdggSQpTHuW0L49S3KiQETPdhfE6Huy:QFBXGAXEpvbZkhpTIUhETPdhpHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634181, "uuid": "14481280-4d6a-477d-8419-7b01743daab7", "value": 942093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634181, "uuid": "c7de75e5-e1bb-4de8-9ef8-a68bbc8d423f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634181, "uuid": "aa77dbbe-9d11-4460-b95b-9cf7eca40fce", "value": "New Order.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69418ad-dece-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625626604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626604, "uuid": "93926dcf-ad0d-4431-b14b-982e5c0e73bb", "comment": "Malware payload (AgentTesla)", "value": "a4f91f83fcf3a9f5993fddce1ab9c9fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626604, "uuid": "4acbbc25-2a13-4acf-993e-c848a6d54690", "comment": "Malware payload (AgentTesla)", "value": "7c7cb087d17e076e94ee76d0dd915b6c5dfff4a32e99a4945d3d715f94ea3fb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626604, "uuid": "bebc0040-eb0a-4b5c-9a3e-e658f48746e9", "comment": "Malware payload (AgentTesla)", "value": "53d4433305295d18448a73425c5a99c9610402df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625626604, "uuid": "b7471b37-bb60-4571-b357-ddd774869907", "comment": "Malware payload (AgentTesla)", "value": "090a4445f3319b6cdefc5a9d688c2cfe4cf30bd30dff63b29df34c29da94cfb1a0a76412c74c1353345eb7bfa4670f2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626604, "uuid": "e13f8e06-5dbd-487d-aec3-5085109005f0", "value": "4C84F15222114936D6280DFF40A433C92E6EDE530726E4C8687FBEB9BDB624487F5787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626604, "uuid": "c8fd1a4c-92be-4412-971b-6a561e1abb7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626604, "uuid": "5c9d4e59-b111-4745-b424-c2078e68a2cc", "value": "6144:igf4Bf0kbPw/Oq5OwqATrYaNf06AoKt1+bSI/kRdM0HhHgvZkHVjD:nwlZsOOSAnY006XKt0xyM0pgvZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625626604, "uuid": "ca0e78ec-1a0f-4a19-a17e-ad63d97983b6", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625626604, "uuid": "995d1311-eeb3-4fad-9be7-a70b953c791f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625626604, "uuid": "07d2628a-9f33-424b-9096-c132ea03b957", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.21204.30312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b5a182-df08-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625651143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651143, "uuid": "f422270d-7e1d-47d3-95cd-03395da8b047", "comment": "Malware payload (NanoCore)", "value": "56abbff4aa4a870159bce26b20f8864d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651143, "uuid": "c480832c-d335-402d-96d6-d519d6ad4f2d", "comment": "Malware payload (NanoCore)", "value": "7d76fb62faf91c778b9ea198bfa8e4c5c016f537a4c3821e1a53fa67b4b78111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651143, "uuid": "ce6144c5-ab87-4b13-8875-56152baef003", "comment": "Malware payload (NanoCore)", "value": "f4612de85493ffe66b692b46f35750ad5dd84055", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651143, "uuid": "aee0e8b9-2f12-4a82-b953-12f221bb3167", "comment": "Malware payload (NanoCore)", "value": "4f282aed9a094f7e7d43bc5c02c4bdf4ad8e83e76daeb18d3ecbf2c51c70d31921c323b38af2be88ed687541600ea428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651143, "uuid": "91e1bbfc-59df-44af-969b-1ad251a47755", "value": "3125A068B6D1D09DF0324578FA169EF09503BE11D50AA90F90EA3ED7773B3C289A185F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651143, "uuid": "e667672c-7998-4113-bf54-24303684dc4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651143, "uuid": "978933bd-e914-4030-adce-0ce3a1f847e0", "value": "12288:k4TAGBIXIqJ1xQcEWkn8xC2m0eg/lFKWJe/vkQqppYlUmNf4IuKO2IzdLA5QA:k2vnqJqn8xCGeOK4IUppY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625651143, "uuid": "7ee0117a-826c-4f47-aca3-2ac8e0c26578", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625651143, "uuid": "5a03d00e-06e1-463d-9235-511da19177c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651143, "uuid": "500d5b21-d0a1-44b8-a34f-1ece22f23c1e", "value": "HSBC Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee45fc30-df3c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625673835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673835, "uuid": "7b91ec0e-f5ef-4816-a6af-2f837cc2be09", "comment": "Malware payload (AgentTesla)", "value": "6a9ab0747843ef966cea99ba4ae4176d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673835, "uuid": "39e4e46c-327b-4a4f-aaf7-5eabfcde9a42", "comment": "Malware payload (AgentTesla)", "value": "7e238de9659253609e540c0eb5a60c3221aea8019bce929a65c185d29d4c2291", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673835, "uuid": "324bd048-eec0-4cb2-9218-5e0fae9d9868", "comment": "Malware payload (AgentTesla)", "value": "f8fd526835fff97f788ebc74932bfb51ed5279b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673835, "uuid": "08f6bca9-9dc8-4548-80db-53b3898db700", "comment": "Malware payload (AgentTesla)", "value": "e29c87d61bfb5f71fe0768b1a34ce7654b88c5450e7968d3ec7f9f5999b1c8dc59db71de7c2639605990235d740405d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673835, "uuid": "037352bd-9d04-4f50-8ec2-e6833d22ebab", "value": "T1B245BEB960338A92DEAFC7F90731251E4F6DAFFE904BB6781844B47900F4B4D4A61927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673835, "uuid": "b5d9a384-7da9-426e-8cb6-6486c9773edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673835, "uuid": "63485824-cc9a-4d5c-9b17-1093b9670e7a", "value": "24576:Lk+HCwPbK4GxRFZK53QCga4k9p0biYuWOBfWlB:Lk6PbKdx43b4mqbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625673835, "uuid": "32b4b052-98ae-4aa0-bdc7-bc67072dc4fc", "value": 1226240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625673835, "uuid": "0321e3cf-6ddb-408a-a2a2-3a0ce28e5ad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673835, "uuid": "fe1b0b40-8698-4a9a-b5be-860b01c7fc73", "value": "6a9ab0747843ef966cea99ba4ae4176d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1435088-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634192, "uuid": "e8d883b3-d587-4a02-a510-554064799bf9", "comment": "Malware payload (AgentTesla)", "value": "7919ac803a27e1783af3c71e50f2690f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634192, "uuid": "5959e391-c2f7-4df2-bc42-abe770f7a397", "comment": "Malware payload (AgentTesla)", "value": "7e8a3a6800429de4f4a827dda3218caa09d65e5c3e0d52ad30ed0ba208ee281e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634192, "uuid": "581bc669-ea8b-4ef2-976d-b44077c1501a", "comment": "Malware payload (AgentTesla)", "value": "58346b5858ea45517b5bc11f4fb97db639189da5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634192, "uuid": "019de4bf-7cef-40b0-935f-d6a97b8c604b", "comment": "Malware payload (AgentTesla)", "value": "fcde6e4a8210b7dc252955607fff682f575f27a10f3ce1ca0c32ea27f191924784762684e123c9caaae9ae9c9ce7c895", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634192, "uuid": "7dffbf2a-b5bd-4bf8-a6d3-72c08fbb713f", "value": "2435BFBA60338A92DEAFC7F90330651E4F6DAFFD914BB6741844B47900F4B4D4A61A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634192, "uuid": "eda15b2a-ef05-4599-aafc-3144b67917d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634192, "uuid": "2e9a8e82-8c5c-4610-b827-4c53258928d9", "value": "24576:dl+H+MpCvaDpN3ONiNzEUCHjPEsw0biYuWOBfWlB:dlOhpdkDPEmbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634192, "uuid": "02e2d57d-5312-4431-aaed-4ad423f25a0b", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634192, "uuid": "0f314d7a-40c5-4713-8e58-cbf9054a90ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634192, "uuid": "dfb049d0-d83e-44cb-a097-70c0af761b1d", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f816ecb5-df52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683300, "uuid": "6d30480a-f213-439d-84f5-2ed1f7e7e95f", "comment": "Malware payload", "value": "0efd03fb65c3f92d9af87e4caf667f8e", "object_relation": "md5", "Tag": [ { "name": "1.6.1", "colour": "#71258A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Milum", "colour": "#69D429", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683300, "uuid": "0ab76716-eaa5-407a-a8b9-d20400c6179e", "comment": "Malware payload", "value": "7eafb957c2e715e06489a979a185f75d7a9d502223c8aba36e7b6b8ead7d03b2", "object_relation": "sha256", "Tag": [ { "name": "1.6.1", "colour": "#71258A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Milum", "colour": "#69D429", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683300, "uuid": "e14d200f-a645-4fed-8cf3-2449e2b174c4", "comment": "Malware payload", "value": "008e2dbde51bac6ed007de0c2fc47fdd222ce817", "object_relation": "sha1", "Tag": [ { "name": "1.6.1", "colour": "#71258A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Milum", "colour": "#69D429", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683300, "uuid": "192281ba-7a48-4ab1-ba1e-11b40ec60009", "comment": "Malware payload", "value": "754c9c7062c172e0837b5df62d041a7141f3853906add2862035d1863f056f8b4794cdbe78feff63944c57ad300c206b", "object_relation": "sha3-384", "Tag": [ { "name": "1.6.1", "colour": "#71258A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Milum", "colour": "#69D429", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683300, "uuid": "b76717ba-31ad-46ce-a966-11d5b499e896", "value": "T18D847B20B281D432D59311B6DFB9DB6F592DB661072608CBB3C80EAE6F242D15E3175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683300, "uuid": "98dfde7d-1ae3-4d3f-ad9f-fb92c4e7bc63", "value": "dc6d60982f93c546bbf36536dd549b1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683300, "uuid": "b3de1416-2009-490c-9857-915c81a19911", "value": "12288:XkLk5iKn/CSabc96EDMSQsxxlO4sy8totD6Tl3If:L9RQEFxxlO4s2V6T6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683300, "uuid": "e6b20088-d9fb-4228-87c4-f744c2139478", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683300, "uuid": "e9dcf078-eb48-4e06-b595-722494681a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683300, "uuid": "256f5ee7-6756-4871-9a57-3f26db5433c4", "value": "7eafb957c2e715e06489a979a185f75d7a9d502223c8aba36e7b6b8ead7d03b2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6f5912-decb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625331, "uuid": "66d50fc8-d1dc-4d43-9931-a66a9ab1236a", "comment": "Malware payload (Mirai)", "value": "bb7ceb23424bac9fbe22774b54c6ee61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625331, "uuid": "8aa3af7a-441e-4d4c-af51-6c1c459cc0d7", "comment": "Malware payload (Mirai)", "value": "80401998ea1c6b0e8ec0302788b399ef06e65b641054378dc5a4f9f4bebbee6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625331, "uuid": "5f71ca00-2037-4195-8301-b32c4c5cf7f3", "comment": "Malware payload (Mirai)", "value": "241da5d61c2d58adf11f0ebb215a4d43fd56414a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625331, "uuid": "e712fd7a-c05c-43cd-90e2-5f09c7bf7935", "comment": "Malware payload (Mirai)", "value": "db970d8ca2547f27603a2c637c8df75d37833cc1553ca1a37c26c30c5d1dcc0fb57e6b2ba99a80736abb790249bdbb74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625331, "uuid": "ad30dc02-c830-4747-913f-d80d54a62606", "value": "A143023C2603BD129D718DB1DEE6DB5505EC5FB8B13BF0B146B846792DC2D8029A409F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625331, "uuid": "146a910a-645a-477b-9ed2-1e2ccd8dbf3b", "value": "768:AUp+tV2jefwtobs6ItuI40HRFCKr2ZaEr9q3UELF4dvBt7k3nXVbpdXXde:AUItVYtJ6c4yFC02ZwLevwnJXde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625331, "uuid": "f30225da-f827-4a73-a6c1-11b7106c771e", "value": 55676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625331, "uuid": "c0f7069e-0d75-4d42-91e5-1fda9397ec8d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625331, "uuid": "1eed14fe-9c6f-4f24-be40-ddb7a1e8707a", "value": "bb7ceb23424bac9fbe22774b54c6ee61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531fb5a6-df1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660260, "uuid": "0dd6a2a1-10a8-49c1-b9b0-154241dc62e5", "comment": "Malware payload (AgentTesla)", "value": "9dd7832f1179fa2f544c2bdb4f923850", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660260, "uuid": "27c95cc4-ad6d-4267-a3ea-f233eb3b1e8e", "comment": "Malware payload (AgentTesla)", "value": "8202b073d7c7c216d3e000a0523233986667eff3777620fde47d74c0e0e06565", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660260, "uuid": "e1d2ae07-d4cb-4b0e-bfa4-25cee8cf3fe0", "comment": "Malware payload (AgentTesla)", "value": "96b4a13e8879c592d9c489ef5f3be798cf6df430", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660260, "uuid": "fe3aae1b-6a68-49df-8f32-9bdff99fe403", "comment": "Malware payload (AgentTesla)", "value": "8e80f33a6e425e309a65198ca5fa7f51b312d64414cbb98cfbdc234e6dd1b7ce78745ed9d24ea20f5cea998b933e8605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660260, "uuid": "a99aa095-997f-4b94-a3b3-7268ae442037", "value": "9BF423760577899D11D61C396E3AF32EF9053009C80AF283DB400EAD164B6B5DEAFCAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660260, "uuid": "d3502964-0489-43c4-9d3d-a1e3e3b85ad2", "value": "12288:ksqk880H0eEosCkGxOgMFq+oYpJoxkWyMAf2TgxemQiIO4/nE8YtLhKnYWXRRv:kJk8hUeEos7GcgM1JoxktMVF3iIvnUBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660260, "uuid": "57d052a2-d042-4840-a5b9-4ca2b6fdbc23", "value": 737163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660260, "uuid": "68d666e0-0a58-4cf7-8ccd-cbe4abaebd81", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660260, "uuid": "52451ee5-0260-4005-8812-a7a09714faed", "value": "Cape Tallin - 21002.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cefd0bd-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625637486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637486, "uuid": "539e0d31-cd33-426d-835a-d36f1160cee2", "comment": "Malware payload (Loki)", "value": "4ca1ad18feda08e8b63af40d2614a0d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637486, "uuid": "b4acedeb-3c1d-41b9-bee0-86bec2e11fb4", "comment": "Malware payload (Loki)", "value": "822c7b5b3b56f0826494e8d4490f141f5dfd34dad0201699acc797d93efe577e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637486, "uuid": "d05dfaa5-9214-4345-be7c-1ed2fc0995bb", "comment": "Malware payload (Loki)", "value": "28f1a4661b4fce9b320b257f4d695636f9f26264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637486, "uuid": "531e1dd7-7cb3-4438-a889-490ff87ab9bd", "comment": "Malware payload (Loki)", "value": "13b0fbe1f99ad4d82a54c91d4e4802e1eb949c366b66d79520e6c2e3a2cfc23da1b69323bbe03198754845b76c7a75da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637486, "uuid": "c8d7de8d-0017-431a-8b9a-692583654b3f", "value": "68057D7651768F92EEBFCB384335251C4FE9B377D24BF6B92C94609904C0F844A62A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637486, "uuid": "e3f93337-b32f-496e-918c-27a45e7fed4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637486, "uuid": "26ac3e1a-db57-4942-9884-32c3a9a6d7ca", "value": "12288:IdxqyECM6NsBDD/F08SxyeNMB1qKSBJvP1nAU34niutnwul/Ex5D547Ib:IdoXCM6NWY9MBQKE1AU3hut185FS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637486, "uuid": "ddbe2a2e-aed1-4ffc-ba8a-fe93ee075d8d", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637486, "uuid": "c0b027e9-5c73-413a-95ae-d2dc7618d012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637486, "uuid": "07beebec-be0a-4bb5-aa28-4b1aba30f191", "value": "4ca1ad18feda08e8b63af40d2614a0d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678ad113-dee2-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625634954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634954, "uuid": "3c94b18b-dd64-4fd2-899b-46761f03e1df", "comment": "Malware payload (IcedID)", "value": "b40a98f99870bf4c224cdc13723036b2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634954, "uuid": "b64a2162-2bf5-45f8-bc2c-48f926119ec1", "comment": "Malware payload (IcedID)", "value": "82575ae0f67ac99e2df780eb524fe05219fae0e3d308308f14d48cdbd5016071", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634954, "uuid": "92bc2d9d-21df-4c97-b028-5abf19709e5b", "comment": "Malware payload (IcedID)", "value": "a09442b14c9993758f5e3221f087a956a716afa1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634954, "uuid": "2bd1413e-c1fe-40bb-bdf4-de427782438c", "comment": "Malware payload (IcedID)", "value": "6f8deddbd6c4ae885b3ca05f2f1a2114e7966a6f12d73c531eaecc3d85d94c1def6528d6f1a1397584e450341c11304d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634954, "uuid": "0f8f9567-7cf1-47a3-8e01-e55284c7ce25", "value": "FF040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634954, "uuid": "8ad2e0d6-8c80-4508-9a84-c9227104a003", "value": "3072:CDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:wRcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634954, "uuid": "41131c61-f20e-48d2-8bd9-3bef37c94ba3", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634954, "uuid": "00fe359e-bafd-42ab-9569-9c1c7dc3c53d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634954, "uuid": "6baf8756-94c6-4e50-a6d4-6a313ce74ae1", "value": "Outfordelivery-787848.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab42d89-df1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660622, "uuid": "9c779d8f-f807-4621-81ce-e7c091e81712", "comment": "Malware payload (AgentTesla)", "value": "10be05a41e91b207148e575a59ab3081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660622, "uuid": "31200e25-7b87-46c0-93cf-84685195297e", "comment": "Malware payload (AgentTesla)", "value": "82e807d1ea280e220a5340a2a1530d244ddd6f985b519a8717ed8f21be3dd63b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660622, "uuid": "37b96a08-3b31-4093-80d3-1127dea20ca3", "comment": "Malware payload (AgentTesla)", "value": "204a66f29262f423d38a369a90a6f83d3ff51be1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660622, "uuid": "abf2d85e-b959-4af4-926c-fe49fac817d0", "comment": "Malware payload (AgentTesla)", "value": "34d754ae1fb9c54fb3882353fb3e1416c99872edab312d7cb1426c970fa8f0087433f71a044696d882f76352509e65b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660622, "uuid": "5a68de87-53fa-457d-a374-d69300744a23", "value": "2845DF7630328A92CEAFC7F94731211E4F6DAFFE914BB6741885B17800F4B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660622, "uuid": "ab37a0e4-48a2-4ba1-8524-450e1fecafdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660622, "uuid": "789606c3-a549-4884-aeed-fabda913774a", "value": "24576:RpxWH1VV/V072ww0zTbL/P/UClgUOpX0biYuWOBfWlB:HG/OnwezP/UClgU3biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660622, "uuid": "b5f4a84b-68a7-4c96-82f2-9b1c5b2f74e1", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660622, "uuid": "ac89dadc-f047-431d-8b19-a99971333879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660622, "uuid": "6671e83f-7ade-4e52-8916-ae97b467b336", "value": "12-17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2078414-dedf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625633844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633844, "uuid": "6b647aaf-e700-4678-afab-db65e650a6b7", "comment": "Malware payload (AgentTesla)", "value": "1d1dcc5646b028d46968d6fbcd2bd747", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633844, "uuid": "ca57f7ab-0a3a-4f65-a045-e58924902dbe", "comment": "Malware payload (AgentTesla)", "value": "835072bb77faa9d142e5ab3e77b10a6f22f6a4d15277f28928dc5d09f87adbdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633844, "uuid": "02cb93ed-9ed8-4d39-9aa1-2e85046d1790", "comment": "Malware payload (AgentTesla)", "value": "a3fb9022201c198fd55ecc3e04bc2efbbc2d12ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625633844, "uuid": "fc5265bc-2b71-4433-b128-072974fcca38", "comment": "Malware payload (AgentTesla)", "value": "565aaccaf7e3d7dd412459c0687457a710e3fd42dd6801489e4fd8b4736c788da4c24b3cb98f2b11387eccd02ca03b1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625633844, "uuid": "3281808a-e8df-4ecd-ba0e-ddc5f0b2ee57", "value": "6AA423FC5043EA07DB7EB37D917ADE060C2604C7CB4DA931821BF6129566098FAD97E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625633844, "uuid": "a2255070-bee1-4e4c-be16-ba109d24b67e", "value": "12288:JZGrfWn5yMqpsgGnhFBCoVxNIDHUVso4hGMXIkh0Yrp/gdT:jGrf45kXMjBCU21hGMXIkhhrhmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625633844, "uuid": "a11e257f-9ccb-487e-bf0c-707510535f7b", "value": 484793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625633844, "uuid": "567514b6-8032-4a31-8566-494780278e0a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625633844, "uuid": "2f8e8145-9157-46a1-b100-0f36029f6e61", "value": "PAYMENT INSTRUCTIONS COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe33bcf-def1-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625641625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641625, "uuid": "f2bd49a7-e60d-453e-92ca-ab77b1c3cb6e", "comment": "Malware payload (GuLoader)", "value": "775632e90c7efbdf87f1e2eba502461c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641625, "uuid": "f3c6333a-5599-4a18-8d33-911f3d5524f2", "comment": "Malware payload (GuLoader)", "value": "8448b9b28eef1e7564e3f16ebe1067e56d5e2c4d9f2f76edd8c2d72b62a3f049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641625, "uuid": "31737df2-1aa3-4840-a255-4525eb8dbc4e", "comment": "Malware payload (GuLoader)", "value": "c2422d3ae0e22a0af423e50e0acf4299b1cb2645", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641625, "uuid": "77c9aa29-03b4-404d-9f77-c65e6e30ab7a", "comment": "Malware payload (GuLoader)", "value": "a19e78230622b38d31540936f331b15785a368e6ab1845fa2940384ba33f54c75f230572ec2eabd18447a8192e953aa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641625, "uuid": "2f970065-ccea-4d0e-bea5-69d6ab2c73ca", "value": "6AC35B63F6E56C61EFE14B702572D835752BBC31B8939D5A3302BAADB83051362B061F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641625, "uuid": "54eb95e6-6cb1-4191-8813-6fb1658535d5", "value": "773df40b486ba5eea01d9fbfa70abb4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641625, "uuid": "35116890-70c8-4639-832a-ad048e4e4bb3", "value": "3072:yGFqrsiwQDLTgOHwWVr5CEmZGD6q30UpAdz:ywrO/MZGDznp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625641625, "uuid": "15488831-e6b5-4eee-aa45-0745d98788ee", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625641625, "uuid": "f11d07c0-49ac-4133-b9a2-411995ceb6fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641625, "uuid": "4027610b-34a6-47e4-a987-5e9ec97868dd", "value": "775632e90c7efbdf87f1e2eba502461c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9073109-def3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625642500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642500, "uuid": "f29c379b-1af3-4994-a5d5-21a6c5136e30", "comment": "Malware payload (NanoCore)", "value": "420c1816a78b07364329c368397f73e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642500, "uuid": "df894456-5328-4684-9405-143660a87c22", "comment": "Malware payload (NanoCore)", "value": "86273044f8b3979076ad359b8cc29cec4a70a2273ff8e4dfea63f0ebb41cc705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642500, "uuid": "67be9a3e-1548-423e-b04d-4150d099f617", "comment": "Malware payload (NanoCore)", "value": "37ec406966dc90b6104e3949d7f23f99e438b168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625642500, "uuid": "76fae749-a354-4349-82b7-eff988a98962", "comment": "Malware payload (NanoCore)", "value": "e2eef2d62964697f619034b4a34859f9b11797a328855672f62333e9b7f16da0c3d3fcef49c5c502cefb72d7dea08240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642500, "uuid": "0ed4814f-b555-4d1e-b5f5-5c90e15ef4d4", "value": "E9F46B983352709EF4168836B957DCF0E6207E665B0B920360C33F9BB91F5D6CF950AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642500, "uuid": "a1c7ee8c-41df-4c0a-89d9-13afd4198428", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642500, "uuid": "6d915f70-9b18-4873-a744-170111ff4574", "value": "12288:ITAXj/KWSeFTB8qy/MaQu0BspQaAiQyEhhTNDWYs7vWec2HD7Wvqqq7ns/ddhcPW:IcseFN8/lQ/aAxFhThWtvlcqivZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625642500, "uuid": "0754f098-f0b2-495d-baba-3cfa0ef65a6e", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625642500, "uuid": "cf331f87-fcbc-4cc4-8736-5ed7b1523504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625642500, "uuid": "9e48fe3e-cb4e-4207-ae4c-4966fedaab62", "value": "Ord30083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9db1aa9-df43-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625676753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676753, "uuid": "a828f0e6-bcdd-40fe-9aa2-0f956fc4ec2e", "comment": "Malware payload", "value": "400b6bea8dd38cfbc5551111c86fd60a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676753, "uuid": "1456da60-5856-4f2a-b401-a83b432a29b4", "comment": "Malware payload", "value": "863d58e6caefc21983064b88074b1f1606201bbd15a01541f6224a6becf6b15a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676753, "uuid": "a9fa8fd8-5429-457b-987e-e2db25c0e001", "comment": "Malware payload", "value": "ecfef95ff8c0a0183cce6a802161d6240fa56697", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676753, "uuid": "e99eb32c-d433-4791-b878-fc66205b8019", "comment": "Malware payload", "value": "81917529a9fb19443102f5eb9db491e975241c31436543e756f34899eb4c340c663f7984003b812ff6bd454f0b0a5b23", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676753, "uuid": "9c79ce7d-6111-494e-a4a0-2b107812932f", "value": "T11272F91F03E3D35FC69409305C56A2DA2674A221E3BD84EB2B590E3E5ED353B90537AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676753, "uuid": "e7bc68c2-0e66-4ef5-ab61-d0888bfcf2bd", "value": "4489be442daa16ad36f0c0376a9a5aa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676753, "uuid": "8f986f3f-2e3c-4f7e-8c80-c52e40898114", "value": "384:cTs0j2T0ifMT+nVVFzmdnEXlrZIxYw2ZW1Wy:+sX0ifMT+XZZI9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676753, "uuid": "9b0352f2-1913-46e0-a705-5a5eff671b43", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676753, "uuid": "ef7de618-c948-41da-8a26-7e7eb752efd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676753, "uuid": "2171d886-1062-4fda-a30b-bdaa76a02842", "value": "SecuriteInfo.com.Variant.Barys.126731.27046.17477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fb6432-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634228, "uuid": "7f325590-1488-458c-ab77-ed146892db40", "comment": "Malware payload (AgentTesla)", "value": "effe206578237d6f5a8f00f4a67db4cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634228, "uuid": "3d0a3ed6-9fd9-4604-8ff9-1af222ba9a2d", "comment": "Malware payload (AgentTesla)", "value": "867f65eceabe8913a49b397bc8c874dc42b6b76608cd5fe0e2c9b3ac2f165bd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634228, "uuid": "6f7f106d-ee01-409b-98fa-b35f450d263e", "comment": "Malware payload (AgentTesla)", "value": "6f1119fb4b7b7dbc621c6f4ce2aaaf333a97e236", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634228, "uuid": "4a63be16-cc5a-4ab0-bb00-d4d03b0e3d3b", "comment": "Malware payload (AgentTesla)", "value": "7081356b084f597ef15e0ec2016d8524212ff530b88a223ea54eef5959422ec3c2a071f3c97b0246af0643a36d5a0db2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634228, "uuid": "a8479f8e-40c8-4ca4-b6fe-e678b9217683", "value": "66F45A983312719EF426C872B957DCF0EA107E664A0B820350D33F9BB91F5D6CF951AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634228, "uuid": "ad244353-352e-42b2-ba47-ec7013e711d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634228, "uuid": "bba76e16-9cfe-4247-891b-3b615505233b", "value": "12288:Ar4puKf9c9yg9L+pgBmboBeYX73aGEr6nPUPyii0pELWQf0KBj2Lp6Ig1026h:64pNf9EyqQcEYr326PUPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634228, "uuid": "75fc37eb-a757-44f4-ad81-460fe3a0e4ef", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634228, "uuid": "32a615e5-fdf2-44cb-80ce-eb51dcc0e350", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634228, "uuid": "66697a9c-1f24-43ca-9777-a2c3f793aaae", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114da6ae-df02-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625648553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648553, "uuid": "973fba31-a445-47d5-811f-1c35b2f655cd", "comment": "Malware payload (Formbook)", "value": "62e81757c91e95b854fd4e45e78c5623", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648553, "uuid": "195652e4-237b-4e90-9a53-3fd4ddbb8656", "comment": "Malware payload (Formbook)", "value": "86c06644b47777703101a6d8e81852435600ad193b72c2d44c2be067cbebb0f7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648553, "uuid": "294c3ff5-866f-4435-9019-a95aa0861288", "comment": "Malware payload (Formbook)", "value": "1a7e2024e2ebe65adc80037c0ef2205bde418143", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648553, "uuid": "ad05752b-0144-4a00-83b1-cc1367c3f4e5", "comment": "Malware payload (Formbook)", "value": "f67150e7c4d90e610646229532daa6237a993bb82c6824a80649c8531e5e85641d26a96f6e6feac8062859b035c23f73", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648553, "uuid": "90411f0d-6805-43d4-a16b-b08c3403fbff", "value": "FC95128E70A11682C3CBD5F0FE6EB24C925DF86D2CC404494815CAD97CA59E6CB6ECDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648553, "uuid": "f341b4e9-86d9-4cec-823f-c543a923d6c5", "value": "1536:180Gz06Ynnnnnnnnn82nn1nM28YI28kDVnMTb802ZbM28YI28kDVnnnonXnnnMTy:aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625648553, "uuid": "e2e68839-09bd-4e77-a5e3-fde9cca9201a", "value": 1880812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625648553, "uuid": "0982d760-d0b4-4b5d-b6cf-08a18507065c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648553, "uuid": "f5ad1808-f350-4517-8b5b-8281ba73332b", "value": "RFQ# ETS Project-070721B3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3af3d7a7-ded7-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625630155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630155, "uuid": "fd96b4f2-0401-42f4-81af-e6b181c1f21a", "comment": "Malware payload (Hancitor)", "value": "87be3d105d5fbedf462b487b7d4befe2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630155, "uuid": "c56eb867-c5e0-4f42-8653-79e02749a02e", "comment": "Malware payload (Hancitor)", "value": "877d5a80877f51ef34f8ca86e5cd0d20a52a515dccc945a040fe1d89c5986c84", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630155, "uuid": "a8cece15-2ae7-4350-911a-eef172fedaa5", "comment": "Malware payload (Hancitor)", "value": "893074a803a99428588584a78804ee903f870b75", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630155, "uuid": "6aff0f1e-ff72-4546-8a67-b93a943ac349", "comment": "Malware payload (Hancitor)", "value": "b43605fe194fa86457c05332b3309e3e89610a2edfbfbffabbbe87b1d7d020817d9a77b9ce15d5a676730e50fcc22eb7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630155, "uuid": "1a28094e-645e-4867-b505-ca07c0784643", "value": "9415D000B980EA71D5A352764F76E685033CBD214B64CECB339C374E5F3A5E26A357A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630155, "uuid": "b88f88c8-be50-429a-aedd-be765f73332b", "value": "24576:tEIZ4wA74D4SQKxZcy8gthDWr+pAmUI+:t+wJD4QZh/qS2mUI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625630155, "uuid": "3a35ac11-1647-49a6-a7d6-33ccc69f23b0", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625630155, "uuid": "83faaa4c-ef2b-484c-b5ff-e824dd7c29d2", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630155, "uuid": "1d006db6-7f83-4c70-8b4e-0426d8666bbb", "value": "0706_1050501748839.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3678ad1-df73-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625697332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697332, "uuid": "1e95483b-5cb8-4acf-abdc-98dcc35ceff5", "comment": "Malware payload", "value": "b1efc6dfcd06d38c14ef65905bb0f334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697332, "uuid": "7c7b6fa6-c48d-404e-a100-ba5bb73430a1", "comment": "Malware payload", "value": "89bcd550675db1d436ba87a266a86b237c3c13338a15b060b1ccbc498f99fd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697332, "uuid": "15697307-3642-466e-8fa0-4457e37c46c9", "comment": "Malware payload", "value": "c7e8a8aaf03a8429dec00a24595cd0e4b4a02fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697332, "uuid": "d9064af4-d14e-414f-aac9-9dd46401a689", "comment": "Malware payload", "value": "f50366a0801cbcc6ca9d60530fa90622db5d4b370d1bcfc4daec1e7eea13a99059ff6fc41e06ce660bfe3971910cac0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697332, "uuid": "e847978d-1ef0-4f52-b966-b132cbf41f69", "value": "T1C005F12A3654DA52C36A1432D9DF401887F9DC423AB3EF747E8932ED59027A3EE064DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697332, "uuid": "a1220088-f73e-4c70-8fd9-fb15d9347b0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697332, "uuid": "f4ceeebd-eea6-4664-9517-cab1042f61b3", "value": "24576:nvm+UVYtXiZRu0TCU9NyF7RhRzMJAPZRI/F6:JUYtXiZpTU7NPZa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625697332, "uuid": "a990df9d-f6da-4543-8442-6fb739f682e3", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625697332, "uuid": "122b5d97-44b3-4ddb-9761-a75ff3541a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697332, "uuid": "1d050f08-7f62-4f4a-849d-1653f0fac1ae", "value": "g3e0z08ubeZuOUJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e81c90c-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625661434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661434, "uuid": "c616a719-e207-4887-b86b-234ae542fc6e", "comment": "Malware payload (Mirai)", "value": "dcd2f0f9fdf641876d8b8b0ce607a20e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661434, "uuid": "e09b0d35-0fa3-4fdc-9dda-1dc65c19609c", "comment": "Malware payload (Mirai)", "value": "89bd4974bf40b6da9d8faa04785834f2de155fcea748d13442c59f0bf59fe9e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661434, "uuid": "68bdb9f6-848a-497f-ada5-6aecff19e48d", "comment": "Malware payload (Mirai)", "value": "a4600d7ebdc7c4fffe998ed90ed85001e7406f59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661434, "uuid": "a7a6f903-7ed8-4d5f-b98c-5ed5d90593cd", "comment": "Malware payload (Mirai)", "value": "eee724be17a7582353c39332303db9447ec9720a620be651aea8da2756ccd4a68f518b0506de3364d440177e3d8cb432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661434, "uuid": "97538adf-b207-48a1-891e-c55ce5a59c82", "value": "A1431AC5B941A626CBC15677FF0F0289371A878CE1EA33039D2D5FA477CB9570E2A216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661434, "uuid": "b14bf063-68f0-4a83-a980-18657d9286db", "value": "1536:YWnitjvBjwPFoJLZXG5/R46YSSnevFfb:zilMo5ZXG5zXZBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661434, "uuid": "9a01654c-c6c4-4133-8778-e37e1293011f", "value": 58868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661434, "uuid": "4b908719-7a42-4bb0-b5d0-e58f85c0b294", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661434, "uuid": "73923d81-3796-4910-9321-4eae2d81dfb6", "value": "dcd2f0f9fdf641876d8b8b0ce607a20e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4164738-df4b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625680260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680260, "uuid": "1094858e-619c-4940-a103-6703c99f4923", "comment": "Malware payload (RedLineStealer)", "value": "e81ac429f20501efe68db7c916f9ce0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680260, "uuid": "1f10790c-1a10-471c-8725-1cc54926a15e", "comment": "Malware payload (RedLineStealer)", "value": "89dcc4523e746eacf819e76012ef13e46cb98e261ebb233c964d415d6827de44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680260, "uuid": "481967e7-3354-4539-b159-4ed980753f5f", "comment": "Malware payload (RedLineStealer)", "value": "e86f2fa4d0eca435ccdeef491727e46096093003", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680260, "uuid": "20b7a86a-64a6-460c-96ca-0f1016b76f7b", "comment": "Malware payload (RedLineStealer)", "value": "43e4d1a13f08992e5baf03b3e482760f9e38abd7864280f6f8269761f31cfad2741d4ebed95c595a3618a9eaff120cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680260, "uuid": "5d63501d-a26d-4c05-a274-1ad81fba5d29", "value": "T17F84839E14B509C1E315FC367B312696EFA29D5BC8F296AE1FB37F05A610924C3824DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680260, "uuid": "08673052-f737-4860-9888-9ad907871134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680260, "uuid": "f7aa08ee-1afb-4c2d-a7d6-fad397d6e9e5", "value": "3072:YcWshJa8A6TCox0bTyRdiF1dmo2QjId5ze6m4dHujjX3VA6sJRTdouuR:TD4rqayC1dmoS5JdHujh8TdojR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625680260, "uuid": "4c8bc64c-1505-430f-87d8-e84ccd93140e", "value": 374152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625680260, "uuid": "c7bc1e48-a2e0-4d47-825f-d05a0dd13a0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680260, "uuid": "53b0b07a-bedd-43f9-89af-7e971b340c49", "value": "e81ac429f20501efe68db7c916f9ce0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01c00cc-df42-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625676281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676281, "uuid": "cbce795d-2022-4860-8e1f-4aa37de29962", "comment": "Malware payload (AgentTesla)", "value": "78e53609d9dd91e65998cd09cdcb5fa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676281, "uuid": "a18fa2a1-b039-4261-a7c7-c34c70a5756d", "comment": "Malware payload (AgentTesla)", "value": "8a4534e0f4a997c47122a1f3f689ec22234099b2807711d925727895bdc4d554", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676281, "uuid": "e74cb111-0d5f-4665-9c7a-f98851daae9c", "comment": "Malware payload (AgentTesla)", "value": "bb996da4dc10d058a634d4679509dc52ee5fac76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676281, "uuid": "f8886518-a9ea-4122-a86e-e491f11aa204", "comment": "Malware payload (AgentTesla)", "value": "ea7c599a64c9ba9a85df5724cac8c66349f9f13c918ff387da5df28dadac4b15603cd86cb8955fe6ed3a506c9a3e3a4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676281, "uuid": "a0c9a30f-e537-4ba8-9c11-8c8f925b6afa", "value": "T12845DF7930328A92CEAFC7F94B71551E4F6DAFFE904BB6741885B07800F0B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676281, "uuid": "e1ffbf1f-6300-47ef-bf6b-28210255f0d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676281, "uuid": "7a0e1c32-6fbe-408b-8174-13472452fdc1", "value": "24576:NSfyGm5YHlcPptgEnnz7MXakUqOOovUAMP8jr/mRrvkbcl0biYuWOBfWlB:TmcPpSE7MXakvOxvxC+mRrvkbNbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676281, "uuid": "3b8213e2-3d07-420c-92f2-09914c0d798e", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676281, "uuid": "e4c3bbe7-b8d9-4fdc-bbfa-dfec9af8d3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676281, "uuid": "849d90e0-fb7c-4fa2-930f-f78e5f14c53a", "value": "zam\u00f3w 1536625_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53287ade-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622894, "uuid": "1f222d51-aadb-4cca-86f8-06528774337d", "comment": "Malware payload (Mirai)", "value": "a87aee4cc22bd37f09833ccdc12407a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622894, "uuid": "95766871-36f1-4ae7-b3f6-641f3531000a", "comment": "Malware payload (Mirai)", "value": "8b7137e61a773ad3cc421653e4de30ec56082f7004b7a3a94f03607cb4fc8bf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622894, "uuid": "925253e3-ceec-42fa-ad72-b78197890bed", "comment": "Malware payload (Mirai)", "value": "1c81d268228894c43c566c56dc4ff25da0df5664", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622894, "uuid": "80a989ed-a17b-4080-9478-402525ecf98e", "comment": "Malware payload (Mirai)", "value": "e17228daa1ef33124c522573eaed72add0d1ec4eb4558bc136059587cc5e9c828aa488fb2854638413b8df9f50a85852", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622894, "uuid": "780bb56b-d6cf-41c5-85ba-98a6b62bd0fe", "value": "75E2D060D5E2DD6AD9D06A3BDE74814269935EBDA0BA30140D7089BC5CD1242FBFEB13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622894, "uuid": "367edbd0-7102-4194-b5eb-da83b03eb335", "value": "768:UuL5Iqme+cnSxf8fU7O9gjntdXTQod7MSIeVpQLB9q3UELEW:UIycSxf8fUBb175NLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622894, "uuid": "f2f93407-ea45-46f3-98e9-4e24644cc62a", "value": 34156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622894, "uuid": "4be0edb4-300c-4fee-a4e5-b332d67e90af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622894, "uuid": "1906aad6-6ee8-48c0-a8ec-856ebe92eee4", "value": "a87aee4cc22bd37f09833ccdc12407a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df885aff-df5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625687125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625687125, "uuid": "d70f5196-5ca4-443f-8f50-b8f4068cd094", "comment": "Malware payload", "value": "6809bebf3f48d95904d3f4b9c215fccd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625687125, "uuid": "b2d2f060-85b8-4bfb-943b-f7469330fddd", "comment": "Malware payload", "value": "8c03797e9f34652fb44639e8866b27429b4cab6248e62e0ddd957ab79ab6f7be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625687125, "uuid": "263731e0-580c-498e-bd58-cc30057db30f", "comment": "Malware payload", "value": "ed94da48c6c75e06d08bccba0d9f0f3fdcd5cf04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625687125, "uuid": "31cd6171-9b77-4ed0-ae66-ca10fe9564c3", "comment": "Malware payload", "value": "244d094dd436c3f81d44da2ac3d0ba1f6eaa5888ab2800a84a6e722ba75d99736f621e1c0824ea9eb8bfe2252e0ee186", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625687125, "uuid": "1904a64f-782e-4d58-b9c8-371b2ad7dc3b", "value": "T196D633213E6BD0E4F80381765DD566FE4AD32C22965A4E53F698BEC6D3322C2311E772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625687125, "uuid": "c5af3446-268e-457d-9e94-53cff291a25b", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625687125, "uuid": "15093592-5464-4f6c-81bc-0ec244a6c45f", "value": "393216:OSzoELQJW8MBFo9ORiNSdqJOjca4neIt7XX:Jhn8MU9PNTUTNwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625687125, "uuid": "3669bb82-69e1-496b-9065-6847bc9293d8", "value": 13092540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625687125, "uuid": "5929fd1b-e26d-4ca6-a8fa-fb91ad2f5203", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625687125, "uuid": "aee9e703-d585-4b03-83c9-39bea30c259b", "value": "6809bebf3f48d95904d3f4b9c215fccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b42ddc4-df5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625688728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688728, "uuid": "8ec0d0b8-cac2-401a-8fd7-9e6a87ca1b47", "comment": "Malware payload", "value": "ad73e76810068706e20ac22ea900e8c4", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688728, "uuid": "63556c8c-c470-4877-acb3-449158844e3e", "comment": "Malware payload", "value": "8c4241b4717467876eb2b12d3f8edd3e68c4fde335a8d83f29eec8827661ecc0", "object_relation": "sha256", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688728, "uuid": "7d7dfcab-21a1-4d9b-a4eb-a7aa50b81184", "comment": "Malware payload", "value": "e4ce23ce3c70d91a8b20eaa287892d66049aee8b", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688728, "uuid": "95c0e3ef-0480-4a51-ac3d-0c6fd66a8527", "comment": "Malware payload", "value": "ec60592714e4c1c604efd0aa75b1cd8993be4daef0aa7e947ec7ebc8d50fda707701d5e768432d3ee3345c6c6a848831", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688728, "uuid": "b9dcd655-75a7-454d-9b78-1c3d8b7d1a47", "value": "T1D3E31215DB56F07AF0A3DB78BDB720258A29DD2E11057269FCD8FBBF58BA4308911231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688728, "uuid": "2be1d3e9-27b9-4a2d-917e-83b4e90c3c52", "value": "3072:0JFKWPe7I8yXVXm4S86iN/fw5+foHfqN+Qe8jSd0Y+NOpT:0JFrP0SXtVCUOkufHi+dauT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625688728, "uuid": "cbd1af2a-e47e-4339-b6c5-b62dc1e7b102", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625688728, "uuid": "836508e6-e69e-441e-9f79-bf0b76db14e3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688728, "uuid": "21ea66d9-38bd-4bee-8ffa-5605770917e0", "value": "493146005-773.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c00750f-df28-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625664973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664973, "uuid": "4df5bf4b-d590-4359-9820-7276ed2fff24", "comment": "Malware payload (Formbook)", "value": "4b0a00c5800ed763afe4d87d315f791e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664973, "uuid": "3585cf58-1868-4210-8e9c-4bea78334420", "comment": "Malware payload (Formbook)", "value": "8ea636d851faf7ce0769fbbe7856659d0eb6638353df90e0c93f461ac3a932be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664973, "uuid": "6a6f1297-8f8a-4745-8f94-f342ab38a270", "comment": "Malware payload (Formbook)", "value": "4a018068636b7cc035e4188842a36dae9e01f634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664973, "uuid": "fe65360a-2870-4d18-ae4e-363baa390088", "comment": "Malware payload (Formbook)", "value": "1b188c05287287159d670c32f894d45a9c16c7bc6f71fd1f3729d282458079be4d71c8b5417dbef504f3714e0f5183fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664973, "uuid": "c2b43705-16d0-464f-bc28-bd2797e69b26", "value": "3145CF7630328A92CEAFC7F94775661E4F6CAFFE904BB6741885B07400F4B5E4A5182B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664973, "uuid": "34f3a771-92b5-43df-9413-dd03286c0efb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664973, "uuid": "209d23e4-e342-45aa-9f40-bcaed9c0a7f0", "value": "24576:rpBt4Lr4voNVtyhkp55Uj8t7pvAfXhhWVgp6QNLmZx0biYuWOBfWlB:rpBSLr4SGkVA8tBAfXhhLp6QNLuybiBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625664973, "uuid": "47b5adb5-44cc-46b0-b3a9-19673964acd4", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625664973, "uuid": "7327f6a4-9ad1-46bf-999b-e8bf452a4537", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664973, "uuid": "77c0d782-5771-475b-8bf1-9e075204b71d", "value": "Order_1537-25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254b4e19-df27-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625664478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664478, "uuid": "4d990118-2a96-407d-8695-038293acfc79", "comment": "Malware payload", "value": "c5abec8c7c276d286238343595323fde", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664478, "uuid": "07adf188-15db-4b8e-ae34-c7eb5612e34b", "comment": "Malware payload", "value": "9165b9f24866c71b77654ac1c7667d93c30bbc29905e9469eb7e48f08104720c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664478, "uuid": "9853b29f-7637-4476-9db1-7b46993d4b30", "comment": "Malware payload", "value": "bf8300ae12f120d1c74b57c15bf1b0131a727f24", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664478, "uuid": "dc3113d5-b924-4b9d-9de3-55b7e8046a31", "comment": "Malware payload", "value": "8840ee68ff3d92e63a91bcd80c9eef6c81f328e59b4948f786226bbbcaccab1190fd7e4a6bcf676bfae23bbed611ff39", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664478, "uuid": "ca654e70-aa98-4325-801e-d4f009431f86", "value": "3DD3E85A36C58B01C9585DB9C1EB5A3417E3FAC723B7D3893E4556CA0E013E9DC8ABC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664478, "uuid": "26438468-de44-475c-9fa2-46d24ca9839a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664478, "uuid": "8a0739b9-f692-4417-8cfb-338150da836c", "value": "3072:88W3ZVQj1bSToqWUBw1APr8gw0JTSURY:LW3ZVQpLqTAcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625664478, "uuid": "08a3b4f6-0f27-4f88-aa5b-1e0b4dcb4ccf", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625664478, "uuid": "eca92b37-003a-45a7-b26a-3cf4643ca807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664478, "uuid": "7f5f2f0b-519a-4def-8a0b-1a021207d4ae", "value": "HB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dceb9d0-df17-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625657621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657621, "uuid": "4ea9de78-5186-4ab5-a0b4-76ee59255a6a", "comment": "Malware payload (Formbook)", "value": "3c2a2030b37abcf39f1ad1af970360cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657621, "uuid": "c7d76baf-388c-4676-bde4-5499872e8f34", "comment": "Malware payload (Formbook)", "value": "91677aa9196e065f40cebb6b50c95524f24161a45436469568954d2bc5d9903c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657621, "uuid": "f424a68b-f3da-4ae7-b48f-b258bc2fcaf9", "comment": "Malware payload (Formbook)", "value": "ffd578bea2b7361954b4176b725343ad5b7740f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625657621, "uuid": "5efcd0a7-fb03-47e0-8407-8afaf6cf9a8b", "comment": "Malware payload (Formbook)", "value": "aef1ffd2822b9f8ec4315851f7dea399feae9f4bff32af36e9fa69a20f87acec27904c48f471d78615225c6729d2fd9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657621, "uuid": "ce5d18a9-1741-4d48-947b-646f2f16b2cc", "value": "76F48C9C3650B6DFC85BC977CAA81C24EB60B4B7930BD253A05712AD9D0E69BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657621, "uuid": "6a334025-973a-47ed-93d9-3eab677b6b1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657621, "uuid": "112a16ac-bb87-4a01-8c3c-7af7fc9d2e2a", "value": "12288:yXN13jUWOOaKYww0hb+Phi9iq6pgYRqZZ3QzKDUJrdZW98QkK3TUY/ludKman/gj:wrUWI0wZJplqZu2gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625657621, "uuid": "2c46e43d-5b72-4b71-b6cf-5bf2d9cbc755", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625657621, "uuid": "40cb881e-f8da-4fb7-ade5-b207152f1a79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625657621, "uuid": "ac352ac2-e8aa-4c49-9a9b-6420aa05d4fe", "value": "SOA-456612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e59075f-df35-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625670560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670560, "uuid": "808b8d37-a230-4c6a-86be-28eb155e0e71", "comment": "Malware payload", "value": "2170db67a79ca3231702ad868bb71fd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670560, "uuid": "15963a21-1bda-4159-a255-273df4eb21ad", "comment": "Malware payload", "value": "9199d0a6bcbf2c69fffdcb84e02b798a321367963e8c8021808a2096931d4c99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670560, "uuid": "b927ef56-d366-46e2-8545-390e9be2ec62", "comment": "Malware payload", "value": "09487dbd363f56b628f253478a57ebcfe07221a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670560, "uuid": "c1ec4998-eab5-4d99-a168-e516ef3b5eda", "comment": "Malware payload", "value": "a35e6a88ab3d65fcb381e449bc04b3db64ad9010d81988aa15bcb4d6d3f4f582f03deacbf762ad6a6031a9982055b0c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670560, "uuid": "ed4d1bf7-ac65-4dad-ada8-196ceb9cc866", "value": "T140E2E05350715B88D5E73078889FBF265E79721E04614E37AE9033BB98E2F307638667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670560, "uuid": "772a5923-a209-42fc-b27f-9d24983957a7", "value": "768:7yIuM3LXhwY2Xylm9lohk1pzgbo/YK3Zvux2mcwmWLyCPnbcuyD7Uryqm:+m3LRZSyOCC8UQKJc2m/nLyunouy8mqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670560, "uuid": "25f94021-518a-4c47-a684-ca18cd7285f4", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670560, "uuid": "7f2ee1df-da47-43b1-b9b2-53ad819df99b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670560, "uuid": "add8a5b7-d193-4820-ba90-d2a5d962a240", "value": "2170db67a79ca3231702ad868bb71fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f199c00e-df39-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625672552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672552, "uuid": "bcdfcc67-78c0-4c5e-8a52-c3141793ecc5", "comment": "Malware payload (AgentTesla)", "value": "3c62e5a26f27bdac648e9a57ea924ddf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672552, "uuid": "a4640392-21bb-4410-bc8d-2276a260a2fe", "comment": "Malware payload (AgentTesla)", "value": "923fa80da84e45636a62f779913559a07420a1c6e21f093d87ddfe04bda683c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672552, "uuid": "ce7849d7-d823-44cb-9c9a-0d4d739dc7ee", "comment": "Malware payload (AgentTesla)", "value": "dfd5173c33da33dfc6c85a8eb46f85901a0b0a34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672552, "uuid": "56479519-9b6a-4c55-a73b-a37cb36686b0", "comment": "Malware payload (AgentTesla)", "value": "c76dbd1872546b2a782d8925d7061ceb771311becb805f5e8299adb316f1fbe2e52a6afdf1a863157b6315296b81db84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672552, "uuid": "7347608c-4ed6-4489-9e93-ecf682f301fd", "value": "T13945CF7620338A92CEAFC7FA4732161E4F6DAFFE914BB6741884747800F4B5D4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672552, "uuid": "63279e87-0fca-4d80-a56b-54145b44b5dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672552, "uuid": "7911eb04-9ff1-4559-99b5-644267e2a90d", "value": "24576:ESjUOOw2A2NFnDTXRzQjyJMLTxS0FiV0biYuWOBfWlB:i62dpTXxQmsTxS0FiGbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672552, "uuid": "df26c936-6c46-4e88-941e-362aa7f9d4e2", "value": 1232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672552, "uuid": "1d17e5f8-501e-4711-bf15-05a9d4621afe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672552, "uuid": "3ec29e9c-0b97-4d0a-8ad6-7d5533e8a98d", "value": "bank report pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d928e2-df2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625667439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667439, "uuid": "be8072e2-c650-44d7-a5b3-36e2201b755b", "comment": "Malware payload", "value": "4c8a8b667f04e8cef02ba2478994b3a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667439, "uuid": "eb75ff03-6ef2-40b5-9e4f-23f240620633", "comment": "Malware payload", "value": "9255737c9e50e048b474ba4a394a2f4c805b8541033330d94ab3654c404378ad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667439, "uuid": "cd0d3f2a-ed9c-4605-98d9-91eb299fd699", "comment": "Malware payload", "value": "42b3c51ca132a25d0d94fe235d47022c875e7cdc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667439, "uuid": "90f32180-2e94-40ac-875a-fb786262874a", "comment": "Malware payload", "value": "c54ba96d0b43bddad38991432bee6a45159e83e35ae68d1e2a5e5431e4c76142302ae14795359c9416a4e6ffc9cb4ad6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667439, "uuid": "00aa5704-921d-4c54-86d1-4d2585656ee6", "value": "C8539E41B64040B7DF671AF06D643A5737FEDB210238DA8BA35CC8D579A4A03EA6F10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667439, "uuid": "853fe2f4-c9e2-4dc2-8740-15444555fbe5", "value": "1536:CmIQeKGas4Ucklf71FVDW4tkkw0TWBuwC2:CmzerasHckR5F5xt7w0TUC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625667439, "uuid": "d3d56e1f-b575-489d-8faa-1df5a19c5c96", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625667439, "uuid": "8c390e42-884a-47e9-8b9b-5526214b0cc4", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667439, "uuid": "55b176bf-d48e-4679-a538-c5e9d21e25e4", "value": "34b0000.shc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b86996-df32-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625669302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669302, "uuid": "bd980828-6d18-4b83-afe1-f198e0172f79", "comment": "Malware payload (NanoCore)", "value": "e1a82fe3cf9e58602d5b4f25cd79830b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669302, "uuid": "1fb77cff-f2ad-4073-a96b-d57d2f7951d3", "comment": "Malware payload (NanoCore)", "value": "933cf944912dd0de4c1e3ad74a181c1c266139e0fad634a2ca0b5ab4e087da31", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669302, "uuid": "1c6f0601-6e70-4020-8373-f5b6063759cb", "comment": "Malware payload (NanoCore)", "value": "28bf1f32af2a38499757faec0e6712b93ce92b7a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669302, "uuid": "1677ef5b-5343-437c-b94c-c44a2aeb5f83", "comment": "Malware payload (NanoCore)", "value": "bad34a038ac63dc931153f9b568024aa07a7553727a48aa5e5cb937b2956755c8e4cb2460a60946bee4a42e23c39fb7d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669302, "uuid": "a85b2878-98a7-4509-805b-abf0de52aaf9", "value": "5C84449411CB82B2E6885E4D35C0B1895A35FE9630CACC2A63AECA71DF557F62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669302, "uuid": "701201f8-792b-4008-b7f6-da4c323dd02a", "value": "3072:90BrB2BrBxhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHrto3Dd+4bNQLHepY7/TmTlP:MVcVxtt5dzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669302, "uuid": "b49cbacd-4e1c-435b-b76d-3a68981db400", "value": 377854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669302, "uuid": "3a46a238-8f89-43c7-b5ce-1f62b1b8f8da", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669302, "uuid": "ab8febfe-6bb5-4d6a-bbdf-389b24157086", "value": "P O 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90a970d-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634312, "uuid": "4bc80c46-985a-4e26-9096-f4af4288d766", "comment": "Malware payload (AgentTesla)", "value": "59fd37d3409280d9a1f14186d336863d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634312, "uuid": "8f20f8a2-f456-4653-bc8a-bbdebd3cebb4", "comment": "Malware payload (AgentTesla)", "value": "9627f98b6a50fed8620dae19198edfce38b9ac6e405431ef3b02f90a3904aaa2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634312, "uuid": "4a4ea124-ef42-4627-bea0-c6a929594022", "comment": "Malware payload (AgentTesla)", "value": "7495f5b4b702bf8b35689d6d620ed98954e556d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634312, "uuid": "4d5d7219-4396-4d0b-be20-b00433952455", "comment": "Malware payload (AgentTesla)", "value": "3e5a19f235f25232bec9b74e9f1dc5786e88a312331fa9c30880614c46b278e14e88ab90de22f36a882a0b4c0e100b26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634312, "uuid": "0c79883a-59fc-46b8-9d26-5eef7caf07d3", "value": "B32533F7356326EDAE425144D2477C9B8BE7A0706F27ECD5DA9CA1E16634A338C2012F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634312, "uuid": "52ad59cb-360c-43f4-b220-80df3b1e7364", "value": "24576:ecPROaBS/+B71cCJhB9EjTX1ebApN2lfuP/+rQX:jRM+BuCJhwjTX1eEWlmXsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634312, "uuid": "819ab987-1823-4563-9714-240b10398029", "value": 1004840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634312, "uuid": "f59f38f4-a6c6-4b0e-a68a-8470999fcc43", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634312, "uuid": "ba95c854-b81f-4e54-accb-9c64341ac77b", "value": "PI.7.7.2021.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8aeb82-df3d-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1625674240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674240, "uuid": "d8ed89ef-85bd-4b83-9d28-3eebe956f0b5", "comment": "Malware payload (Stop)", "value": "b66204eff102db67bd94ec3096c765c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674240, "uuid": "8c74c5c3-ffa8-4693-82d4-215f8a439e88", "comment": "Malware payload (Stop)", "value": "9634e7bbda11d42ed7eda4f7cc1965dea16ab45877cb425d322e830cf63a0657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674240, "uuid": "3b6ab40a-84ec-4990-9176-7650da1e1f98", "comment": "Malware payload (Stop)", "value": "10e29764f0182cb7362460f6d925a88b9d772780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674240, "uuid": "84d23efb-e6cb-4d7a-910c-9078adf7e08e", "comment": "Malware payload (Stop)", "value": "643c045bd1d4cb2faecc39193dc977df42dfe5f2d7110cb24bd357e3ce7c937100a6bf7ad329638449dbcf9f83172009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674240, "uuid": "4e10423f-68fa-4545-b21a-60358d0cfca4", "value": "T18205F11076A0D034E6F32AF55A7A53A9643E7EB25B3051CF52D06AEE6B34AD0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674240, "uuid": "bdc89572-119a-40ce-98d1-ffc71f4f047b", "value": "0c9b4a6ea51ade86685cc7cb33cacbc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674240, "uuid": "7c451110-8bbe-4aea-a0eb-e925da8e5a52", "value": "24576:jEEhx2jeV2PvB3dbNoJ7LMB150FzhK9kAfj9:oKV2LGLMmT2fj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625674240, "uuid": "7aeb3dae-b9a2-4644-ae11-7b9cc7126837", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625674240, "uuid": "76b757c8-38aa-4cf9-ab6a-7a9aeb7b105b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674240, "uuid": "e8bdb8af-3f5c-4e9f-a712-d1c987a54872", "value": "b66204eff102db67bd94ec3096c765c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a2abf4-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625634308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634308, "uuid": "2c5e8a96-e3a1-410a-bf16-80452b59144f", "comment": "Malware payload (Mirai)", "value": "a1201c531b4743e83cbd438a3acd9c62", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634308, "uuid": "ad211600-785c-443e-a304-f823f44dbbd6", "comment": "Malware payload (Mirai)", "value": "980824aa72919cdd6e391527adc8306cc1077464ea67dcc25b40fac3c58ded93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634308, "uuid": "4a943c0c-fd09-410c-b0f4-37cec85530ba", "comment": "Malware payload (Mirai)", "value": "6aea203618d18bf5f9b2099514759e956ad18028", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634308, "uuid": "4a398744-71b6-4cf4-8e31-7dfc89093b70", "comment": "Malware payload (Mirai)", "value": "811f9013e4148c9d169dc16b79b5e44b8ff5ce9f2cb8221fcbf956a850d2c4b1a978555113bb4550681ef6face759482", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634308, "uuid": "9f82579e-5f65-4703-b189-53b56ee66580", "value": "6864F1CAEF01AD3AE9C007767A9F074DB3759FA9D3C3B150F250C61A399A1899F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634308, "uuid": "31e259df-250e-4e09-add4-53e9e7b4340e", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioAsKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSi5sKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634308, "uuid": "bb9ff2ec-5131-4560-98fd-0c8926465d6d", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634308, "uuid": "8ce3d881-1443-4c0c-b416-5be3a341e02a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634308, "uuid": "a29a64e6-c475-4beb-aafa-adb98a9e65a6", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf57cf8-df46-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1625678017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678017, "uuid": "2502486f-a2e1-46fd-800a-75db3a248bdf", "comment": "Malware payload (CoinMiner)", "value": "67b7bcd5350e0c5885555ba17698eaa2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678017, "uuid": "3d12c048-f810-4196-a83d-824447f9c4c5", "comment": "Malware payload (CoinMiner)", "value": "995ab2c020f8d8ac61c6c5e2bfdd383f2134a6463ea2ba218337b80b639e13cd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678017, "uuid": "758efbd4-4dcd-4ddd-b34d-358c552ddff7", "comment": "Malware payload (CoinMiner)", "value": "97bbccd67bb3030742f8f807bbb9c0d352da9060", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678017, "uuid": "517181ff-8d3c-4049-9827-69fffaad7bc6", "comment": "Malware payload (CoinMiner)", "value": "2aab23edfd84e4e4a50f1c01cf8be5f4f28e8bff5670612ce87a64b5fd9e96152ae5ff80d8a3c1ce186d2057386bb7bb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678017, "uuid": "d13ce233-04d0-41fc-a2a9-3a501048b677", "value": "T197F35C1D5E8BB8DBE4250AB558B6E7D1072DEFA5F1E1469C30E9BE3CB7924708500FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678017, "uuid": "374d5c4e-237a-4b1e-864d-026f5ce4147e", "value": "3072:atFZXP6XsTQsVHlKJvtNK/Iqr3ZbgMwxHHUtoGO2SDt:QnLFUjK/3DOfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625678017, "uuid": "2fb69797-e760-409f-808b-071db496a3d3", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625678017, "uuid": "f0bafa2f-1a30-4d54-baf2-f9c1f7bf6cce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678017, "uuid": "b26056d4-c089-415e-847f-8d790bfd27a6", "value": "67b7bcd5350e0c5885555ba17698eaa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a5a00-df09-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625651587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651587, "uuid": "d1e0c7f6-b25d-4c62-886b-e7117b35da0b", "comment": "Malware payload", "value": "f6f8fd8341644a431c1874a4cb8cf162", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651587, "uuid": "a31d7599-1d68-4a7f-8c50-d6105a492b45", "comment": "Malware payload", "value": "99b1d442aef32def62565ab43cfb6f10c593493b26f2a44e60f606ea132f573a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651587, "uuid": "3f643bcd-6580-48e1-bfcf-d4879581bcb9", "comment": "Malware payload", "value": "5467e5db2a650b47de67bb6b13f08f99cf410543", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651587, "uuid": "49ae8b69-baf7-462d-8666-8fb34dcf9686", "comment": "Malware payload", "value": "10172909ed1b30d9673cc097f340cc03d6abc2ecd8f79a8213d883f05493aa38eceb1abecd9810cced0f9ecce34f7806", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651587, "uuid": "8f0d6802-bd1c-4352-97bc-1b110b1baba1", "value": "91620AA1221D3C65DE575BF6CE12EB891F6B4D3A03001EA4329E9485AF2FF11DA20F35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651587, "uuid": "bb869e4e-b8f6-4e93-9817-ba15167ab789", "value": "befd011f90184d7406f46fd7bf9ac681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651587, "uuid": "9970ab8d-1e55-4693-9b05-d5edfe61402a", "value": "192:Di7EF/pUrRJ5i3pw72hejW2msOU3h4y93jD3FNGNbPR9zR7jMYMJNIfCC:m7EZarjUwCejWvsfLTDCGYaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625651587, "uuid": "a6481e41-9f90-4507-8f79-096dd362448c", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625651587, "uuid": "2bbbaae4-b38f-48fb-8054-ef6cc4256022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651587, "uuid": "17e8e578-ca7b-4fe2-b248-92f0810e0ec6", "value": "SecuriteInfo.com.Variant.Barys.126731.16597.26980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda2c154-defe-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625647205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647205, "uuid": "009c8ef1-330e-4640-9793-0070132b2ec6", "comment": "Malware payload (Vjw0rm)", "value": "b5e34472d72474569a2332ce317f4cc1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647205, "uuid": "08798754-a963-4e3c-a2cb-91ca15b0e359", "comment": "Malware payload (Vjw0rm)", "value": "99d7b67e0d011b22fe3e491445fe0a6dab5e6999d8f7fb99ec505d434255d712", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647205, "uuid": "9dfe1689-eb8e-4229-b86f-0506d1dcf6da", "comment": "Malware payload (Vjw0rm)", "value": "209017707d1e40faa9ec527e2128ef25de4b76ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647205, "uuid": "1a094681-b624-49bf-bf04-70d32d7a6b8e", "comment": "Malware payload (Vjw0rm)", "value": "d9a2d5f07c8a56152736b4f3796ea14594a59057b2f40825697927e04e5d6d5f9cf2f7368bb1894339a384381c27d0fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647205, "uuid": "9107c311-15e6-48c7-b8cc-38f61b6ab911", "value": "0F12AEC2CAC0B59A9A0291C31F3E097D67FF7946014BEE195847C68A6CC9B576F410E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647205, "uuid": "ea147f12-af7c-4e7b-946e-11b72da0623e", "value": "192:QevlNbOhzXyTuFHXxWybodL6Y2nuS1ljzwkbHDpRoagNZ:Qe7bOpXyYHXxW0odmxlnDrDpR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647205, "uuid": "684af3cc-b994-44cd-b1fb-9194e4ff96d1", "value": 9505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647205, "uuid": "51653713-952d-4ecd-a190-b9a6df6f554f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647205, "uuid": "de38120c-685a-467d-821d-d61b3d894403", "value": "4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6613f-def1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625641620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641620, "uuid": "3ab735dd-bd90-41a9-ab62-8d297768df75", "comment": "Malware payload (Loki)", "value": "fb7b2bec96a0b729f4fa0c0034d133e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641620, "uuid": "f61bdbd1-1a55-462c-8322-1c7dc68154a1", "comment": "Malware payload (Loki)", "value": "9a3b8a078a8584c23d59b49712998c0166d0d34596ac2f1b2901bdc2ffab9e15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641620, "uuid": "09ad1688-2f9f-4e83-bbe8-2f30c2f34e2e", "comment": "Malware payload (Loki)", "value": "18634bea6817dfdd352faa5956f1669e9a5f3782", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625641620, "uuid": "baf8e482-5d1c-4342-b20a-d18b9eb43252", "comment": "Malware payload (Loki)", "value": "c9f3b96979889d4db41746409548a33379d8e330c6ff6b1e470e4557f226f3f95cb7d657b391e714616a63d7b58bc8dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641620, "uuid": "2c2f6f3c-2c42-43b6-a651-44236b759128", "value": "4935BE7A60338B92DEAFC7F90731262E4F6DAFFD904A76741884B47900F4B4D4A61927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641620, "uuid": "76dec37b-4848-4802-92d6-7bc9f5f4a50b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641620, "uuid": "e8593483-e226-4123-afde-2a6b55a12287", "value": "24576:46+HiOmkAXL5eXhke9K2Ud8KLHi5yQO0biYuWOBfWlB:46UmkAFeXhhH28XFbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625641620, "uuid": "b117ca7f-174b-4093-80b5-45bd92be166e", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625641620, "uuid": "f819fa2f-c21b-4f08-99f7-afb039b336ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625641620, "uuid": "a198ae77-ea45-4397-a600-294861fe81b8", "value": "fb7b2bec96a0b729f4fa0c0034d133e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb53b13-df09-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625651717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651717, "uuid": "ca76e2bb-2d85-43d2-9d49-2a7785907839", "comment": "Malware payload (OskiStealer)", "value": "1b744789533dee1e231fd8d997e997eb", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651717, "uuid": "22d5875f-7f9d-4609-bf1c-8f4b91456216", "comment": "Malware payload (OskiStealer)", "value": "9ab06dad5958032d92be8b54abfd84e4a7828df3accffca30a459ad3a87ff4ec", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651717, "uuid": "b3e783c7-be66-4776-a884-49e341eb9863", "comment": "Malware payload (OskiStealer)", "value": "f577719e9b25aa48f92d2cef8a0c22390b96dc86", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625651717, "uuid": "a2a893a2-b142-485e-b687-10cd1ea809c3", "comment": "Malware payload (OskiStealer)", "value": "31e686974376122c0bff5469aef7de50a0c1ac8c09b848805d6e4f0cfb95991168c7d510b2e6165dd643e38e58e4e9be", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651717, "uuid": "8bd003b5-03eb-4415-a8fc-305f1d6d06ec", "value": "1A2441197057C15FC6A80E354C9ADBF63B31BD029D8AA20731A47B6E7DBF640DB02687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651717, "uuid": "7356ee93-7981-4684-9e5b-ebb26e90a80a", "value": "1536:Dz7xxUvV7CqTMaciS0BC6/FO4mKdsIHeVPbsFmKNc9nH1V:73UvV7CqTMa1SIpNE47e9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625651717, "uuid": "e5507be1-7208-4d2e-b17d-835719fb125f", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625651717, "uuid": "92f828f8-11fb-4883-9f9e-5bcd26831c20", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625651717, "uuid": "f1c7e33d-366f-480d-b851-aea026396f59", "value": "Arabic letter .ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3259a348-df4f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625681680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681680, "uuid": "16e4f3ae-cdf5-44a8-a278-bcab4bc33027", "comment": "Malware payload (SnakeKeylogger)", "value": "5bb9bc779751fd004c3adce183d6df3a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681680, "uuid": "344ccd80-afbf-470e-8324-d5e6843b9d17", "comment": "Malware payload (SnakeKeylogger)", "value": "9b27d851a8b618d10568ffdfd635a08ee4ee29e7b8b915a4e9d1e26f001f3160", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681680, "uuid": "3ab0ce35-827c-43e6-b94c-999e6686943d", "comment": "Malware payload (SnakeKeylogger)", "value": "7d03f60e3580833b0384ad247b719ac44dd90797", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681680, "uuid": "75a24fcf-aa30-4634-be44-d8a3f85506a4", "comment": "Malware payload (SnakeKeylogger)", "value": "a9dc717716fa22ea064ae21d15d4eb325b93a2a106cbd35f0a67f94719a529375cf65b102dfd5486803ff6ce1ae55a6f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681680, "uuid": "c1eb035a-cae5-4ede-a24e-eb4692194725", "value": "T1C5127CC67AA1CC29DA09E2B355001700F0523A718232BBCEB7B9D918FEB72D64E57945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681680, "uuid": "5daa94e1-0794-444b-b046-1851b2dc11b5", "value": "192:OF+uFLoQBsRDhvI7kVJHRkqkDqjZGDZ5lvZ6K2:OFJLogsY7ap2ANiZDAK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625681680, "uuid": "ca7b200e-299b-4b98-b774-ec163f29c14b", "value": 9125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625681680, "uuid": "a6c85f59-2394-4f6d-8bfd-3d2106794655", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681680, "uuid": "5bfe4510-2771-4fd8-b533-2963b258c542", "value": "ETL_5100006278946.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29ae1b1-dee6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625636825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636825, "uuid": "0faaa3f2-6df1-402f-aa02-db767e9f05b6", "comment": "Malware payload (SnakeKeylogger)", "value": "609ead706c475222a158bdce64ae391d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636825, "uuid": "a2adb18b-54bc-4d7b-95d4-1b2c632d1cfe", "comment": "Malware payload (SnakeKeylogger)", "value": "9b4114e6fe6ba27e85c1a7c7300c7489971762781773fa86c604b501fd924a20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636825, "uuid": "00f272e1-a0c3-49de-af12-908eefa101c6", "comment": "Malware payload (SnakeKeylogger)", "value": "88c106eb331f2d442644028b520ab6d4367e6ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636825, "uuid": "f538fba6-89d8-493f-bfb3-1431448f8490", "comment": "Malware payload (SnakeKeylogger)", "value": "b0fefb76f8d74ed4637350ac96794cd4f2ff69d82c20125dd356a6b801c6321c7f5e99097eea4a4bca1319e3d4b5df7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636825, "uuid": "3c938655-af19-4231-93ff-202d17dab8ac", "value": "5FF46C593302609EF9268872B957CCF0E6507D768B0AC20350C73F9B7A7F5D6CE911AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636825, "uuid": "bd50a1f1-5ef5-4486-bd5f-5ddd0567132c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636825, "uuid": "62855504-9924-4c78-b7ba-38acb27ebb5c", "value": "12288:nlX7DJfFiioA7IlNud+FlvULKlbsvODl5w1ZkB5djMfvjqUS8OLurd:nlX7Dm3yUNg+zvQWDjlLurd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636825, "uuid": "e62232e7-2e23-4c3c-a492-5201fe5a83e8", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636825, "uuid": "aaae162a-9e18-4cb2-8ebc-a456e92c140c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636825, "uuid": "7d08571c-fffa-49a6-ab47-9b5946926980", "value": "Payment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3edb7c8-dec5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622654, "uuid": "e793c35f-1c2f-45c4-b241-3832d467e984", "comment": "Malware payload (Mirai)", "value": "1e1a1dc80ab3319658b63938bdd17f42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622654, "uuid": "cf2645cd-ebf7-4a63-bdf9-15d82b04cfb5", "comment": "Malware payload (Mirai)", "value": "9bf038033718e656ee32e39aa57137d1903a4e80eeb83f899342b31590808ddb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622654, "uuid": "de7cae64-845a-441a-a719-02b1eafbe9c0", "comment": "Malware payload (Mirai)", "value": "df9969d6b3595f46a6ae2f6203dfdf59f39e3aa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622654, "uuid": "a1060b99-dd64-460b-aad7-1565ca7211d5", "comment": "Malware payload (Mirai)", "value": "81b17e1a14ab3b336582127b64a28670b0e11df8464337d54969ba7e91ecdd4b981cb192fdff3bc84bafafb8f7ad7feb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622654, "uuid": "a987b8ec-4321-4328-a6e6-47633053b6ce", "value": "B0E2E0EDE899B99DC92C1DB2A1AD96F07D40959033060FC903114AC8FF28776B64E93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622654, "uuid": "f2b8ba60-30c4-427f-a0cb-6e6b005aceee", "value": "384:xuW3rIo2zjn/turYZEktrgcP6PMqf26bLFb46ZNZyEPg+WlxHeGRWGVCz0Nvde:IsIFzLlCLlcihHLFb4CZFg+WRWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622654, "uuid": "e896f9d0-ba80-4b71-8097-f74b4557e47b", "value": 31616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622654, "uuid": "282339d4-c79e-496c-92fd-9e8ad3eee5c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622654, "uuid": "9454081d-561a-4d8b-8013-cf596cbe7f25", "value": "1e1a1dc80ab3319658b63938bdd17f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8862d32-df42-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625676322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676322, "uuid": "9d914ae0-6cb5-4d7c-ab32-2660ca2c9fab", "comment": "Malware payload (AveMariaRAT)", "value": "37bd68222738539a950a881b9c8dd96a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676322, "uuid": "268d6bca-0472-496b-854e-c29a3f81d5a3", "comment": "Malware payload (AveMariaRAT)", "value": "9c10c6bc3fbd65d047e8bbd635e4bf18712c2a4f200c4fb838f1f868c0b2bc54", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676322, "uuid": "8fe35421-6b4c-471d-92a8-0ba46f9bbc1f", "comment": "Malware payload (AveMariaRAT)", "value": "3c91491f61bd21cbb3c5a8fdac91cd03ff24c40f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676322, "uuid": "8505c5cb-b2bf-4bb1-913e-6ef1a0f71ffb", "comment": "Malware payload (AveMariaRAT)", "value": "71510add15d4398dafc8933ac922d3418ae6c45ca31f2563b3c84e388e3f5b6dbc5b1e27760db96f8664ff0e2b5e8ecf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676322, "uuid": "672b3bf3-efb7-4f92-b975-821d84f335f5", "value": "T12BB39E13F7E54835F3B201B01ABD7E6ACBADF9701628C49FA394854A2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676322, "uuid": "8621c8bd-7f17-4c8c-b783-b26921c60499", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676322, "uuid": "4bfaf9f6-981d-4ed5-8508-9f2f7f96ef99", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01A:K1VmhaH8EFvW+0OVE0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676322, "uuid": "5e6eed43-3d1e-417e-8d7d-f2c0863b0e95", "value": 112314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676322, "uuid": "c72f1ede-9dc1-4b87-a3e7-c8877e174115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676322, "uuid": "27a1862f-07a9-477f-ada7-8b02ef64f7ff", "value": "37bd68222738539a950a881b9c8dd96a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756ff96a-df4a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625679645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679645, "uuid": "fa59611d-0086-4767-a8fb-b95c39ce04f6", "comment": "Malware payload (RedLineStealer)", "value": "f476fd152a5d6a53f297517f9ffca28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679645, "uuid": "6c42047f-f47b-4d90-9edb-bdebc194693a", "comment": "Malware payload (RedLineStealer)", "value": "9c2554e79b717eca531348c6e0430944ab7288bc46a8d56e2e49898c4b0e59a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679645, "uuid": "8ed0a24f-18c5-489e-987d-13bd14882f1c", "comment": "Malware payload (RedLineStealer)", "value": "a0bc4cb4763de9f540fca4f97835522620087e17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625679645, "uuid": "ca729990-5f5b-486a-8ed0-b6f4ce5f9f2f", "comment": "Malware payload (RedLineStealer)", "value": "6a68f3596c0948a839355851295ab5041869a14fdeb4d3bee4af216837c00294e9aae100dd69a2856564d0524ae9c7da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679645, "uuid": "f3c819e0-8f51-42fa-88b8-ca7480e5e06b", "value": "T1C074042864BFC01985E3EEA12EDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679645, "uuid": "f4b0f62d-f87d-4730-8422-6fd0fb6cb5cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679645, "uuid": "1dc84065-14f8-45fd-a649-55ee765493ff", "value": "6144:2IN5Yqofb4MI1XfPpnvTGLkZ96Tvu2fHk+:2C5Y3fb4MINfPpnvCLkZ96TvffHk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625679645, "uuid": "3720a947-f659-412b-a45c-a321f2a5f6a5", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625679645, "uuid": "6db6f27f-a8e3-4c30-b134-ab06fe798efc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625679645, "uuid": "56f56869-d8b3-4cd3-985e-01b3ba632fa1", "value": "F476FD152A5D6A53F297517F9FFCA28E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd92f6e6-df33-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625669995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669995, "uuid": "41010db7-de73-4cb5-ab82-5e015789e2f0", "comment": "Malware payload (RedLineStealer)", "value": "af42e89b8f540434cf710976e8991058", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669995, "uuid": "3c1de7ba-65f2-447b-abd1-e44755b61666", "comment": "Malware payload (RedLineStealer)", "value": "9cda98989c3b49da5566c23722e52231ecf25934e12e81c09bc845312f6a86d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669995, "uuid": "53aebe6d-a014-4986-8960-5d589707ba55", "comment": "Malware payload (RedLineStealer)", "value": "33244efb0b3eb482b1bd97f70f6d9f4a258b3b81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669995, "uuid": "272d13a0-c14c-4b62-a2de-db988b2ca4d1", "comment": "Malware payload (RedLineStealer)", "value": "12b39ab433e0ba82a7848f9e964e9934f8afc68b7498ed57f5f9fec4658c82e987b553545f535b4d8b3ef7a3ab6769a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669995, "uuid": "8930852d-2750-4ae2-b236-b6e898d0a32d", "value": "73849E11FBA0C039F2F366F45A7A93A9653E7AE15B2490CB52D02AED1B356D0ED31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669995, "uuid": "2fb62bcf-4b88-482e-9543-097100084823", "value": "0c9b4a6ea51ade86685cc7cb33cacbc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669995, "uuid": "78b2b8b2-1693-4e99-b727-1a6af1db9e78", "value": "6144:nhTlosCVUXUbL0GHgkZqFZGzz5lISEm3d381xveYXypwMM+zP98xdYFh4:nh2iUv0GHgkZqFZI5iC0zKwM1T9+dOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669995, "uuid": "abe21899-8356-4faf-b5e3-88bc2e70e409", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669995, "uuid": "4a277a05-e052-4a18-9b1b-4fe12509d972", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669995, "uuid": "07ab537b-6613-4c7e-bfd5-ffe608f8311b", "value": "af42e89b8f540434cf710976e8991058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36466d8b-defa-11eb-875b-42010a9c0053", "comment": "Malware payload (Lucifer)", "timestamp": 1625645179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645179, "uuid": "39ecc46d-99d6-45de-bd63-6b20cf044078", "comment": "Malware payload (Lucifer)", "value": "fcdd36fea59663dd97eb71087a061ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645179, "uuid": "38ed1175-c150-4767-aafc-93b1492f8bde", "comment": "Malware payload (Lucifer)", "value": "9d88e62b7da45ea1be4c02dec30b6a31b53d42c31d1785f4a992e55c0147d825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645179, "uuid": "233600df-d20f-42de-878a-8034bfa9c9f1", "comment": "Malware payload (Lucifer)", "value": "6feb62df029b7857db90f5d722eb390e7ffe0f52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645179, "uuid": "48e6502d-12e0-435a-9a64-4bf65b7be9e8", "comment": "Malware payload (Lucifer)", "value": "be4f4d437d6f1149cd5e01a5e43ec2e2c283ebd1cde1b6de320c845c2cfbcf54222b8c84952d7366ea665c5347eb93fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645179, "uuid": "5ceba0be-6475-4a0a-8f62-444854840591", "value": "88841203F3A68186D4055970AA6B43256F78FEEE3EC14414735AB3DE9DB2702DF3A216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645179, "uuid": "d40268e3-6620-4d9a-9b69-c9e049e982ef", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645179, "uuid": "487b6908-e3e1-48d6-84d0-f8e1523c368e", "value": "12288:OoXW6nQZdzoRvaTp6Vle9ds81W7zoSlExB:OoHnikokvgd11Wov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625645179, "uuid": "339e3e8f-68a9-4a12-980f-b99b03506300", "value": 400792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625645179, "uuid": "b8b63c54-6607-45b3-a798-12831d4a7ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645179, "uuid": "a897baa9-0fb4-41d1-9ef7-eb9aa3c52e2f", "value": "fcdd36fea59663dd97eb71087a061ce8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06fe47ac-df2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625667434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667434, "uuid": "40b0d5d1-b585-4db5-8e84-e8c01ffa2d35", "comment": "Malware payload", "value": "0d6098d060f1cc8c373814fbb1a1bc8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667434, "uuid": "4f2040fa-65de-4ad3-8c6c-cc169fa628fd", "comment": "Malware payload", "value": "9d997c341f5a170c5d0b94539dff6fd3ed57bd0c4badb91116e1e72ea222ea11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667434, "uuid": "39260792-b0f4-413f-b8b4-020943b3624e", "comment": "Malware payload", "value": "333c147c2e7ed130b9e34b470092d36272faf88e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625667434, "uuid": "bbb2356a-f13e-4022-9741-06aae9cd5eb1", "comment": "Malware payload", "value": "409a6e457265f5c44718b18518442cda2e0ed731bd97a85a40ab86cf28c6ff9199d2161b22d917500802de005691bc38", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667434, "uuid": "e97f476c-38dd-4964-ae8a-5e9fa6c52d4c", "value": "F0837D97A3F512D5D99AC279CA315727EEF0744E2A18830F13A4DEE52F93272D61C312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667434, "uuid": "8bc62574-355d-42e8-b485-3544e65b0f55", "value": "768:5rSQVIxpjPQ536t3VQtJha10+AQAIia6k7S35JO1tK8BXKArX5NCN7abcNsACaz9:5rdSZ+JC587kT1haa/Ozf4e/UIkAS11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625667434, "uuid": "c07e9e0d-e4c8-4055-b364-d91015f3e98e", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625667434, "uuid": "112f5c61-a51e-49dc-abc0-e21973d7e917", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625667434, "uuid": "69fef03d-3a88-45f7-a241-191227ee108f", "value": "2ea1d4b0000.shc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e9ad1c-df4b-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1625680043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680043, "uuid": "5c3e4ea2-2970-488e-97c7-93edda839607", "comment": "Malware payload (ArkeiStealer)", "value": "d93befb933caaf737d83b0aee9577449", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680043, "uuid": "42bc06ac-5fff-459b-8ab8-dcadc11694e1", "comment": "Malware payload (ArkeiStealer)", "value": "9dc2aee4b65b09658a4412e9cd10aaf655faeb9b5500241455c0183150581e1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680043, "uuid": "c386ec1d-2d61-407d-b7f5-c9505ed8437b", "comment": "Malware payload (ArkeiStealer)", "value": "2524f6afd33f0b787db7251d78c4ef5b7961913a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680043, "uuid": "ebe1f70f-7548-461c-8b91-31bf6ce245b6", "comment": "Malware payload (ArkeiStealer)", "value": "2d9fff964999133de081ba4ce449a5d14ec6dde86dd2b5d5cbc8990ed52e51bfe75b552d9347885d3a416767768c2f86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680043, "uuid": "e8e8eb70-5f7f-435f-a0f1-4d5512a430bf", "value": "T134E5E552A605AECBD4C916B4C417CE816E5DCFAB0F2088C3A959BCF97D728CD35A5C2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680043, "uuid": "a38322fc-09ee-4d9a-ae24-ae4911594d2f", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680043, "uuid": "a695c7dc-39bd-4179-8201-c37b717c5c5f", "value": "49152:6HBtF/t2Tm+ruKtEJ1O1S+2b7g/+L0RZmZvgy4ux37wVfnFGBb:6Hqi+ruEEnO1S+2pLTNgyxB0V2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625680043, "uuid": "ccbd4fad-88f0-44c8-ba37-c6551a463030", "value": 3317232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625680043, "uuid": "152b5c78-cef9-4b1b-aa28-3890aa2a0c71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680043, "uuid": "d9e87541-5327-48a0-a3cd-d14be5c87b68", "value": "d93befb933caaf737d83b0aee9577449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e86324-df56-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625684604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684604, "uuid": "17c7cecf-4f60-4760-a8be-f3436398bfdc", "comment": "Malware payload (Gozi)", "value": "b53ed71b3c7a18f70d693a137b5adc5c", "object_relation": "md5", "Tag": [ { "name": "202106221", "colour": "#A321FB", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684604, "uuid": "b99764ae-52f5-45fe-81da-88d33011ea33", "comment": "Malware payload (Gozi)", "value": "9e05cd392d9c1334c404ceb8fe28d6bc179d9844569bced9d2d1c057de538dee", "object_relation": "sha256", "Tag": [ { "name": "202106221", "colour": "#A321FB", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684604, "uuid": "163044f1-82e4-400e-8c2b-f95dcb17d63c", "comment": "Malware payload (Gozi)", "value": "a31f1a98ea227e331303ec0c6ee226a711427998", "object_relation": "sha1", "Tag": [ { "name": "202106221", "colour": "#A321FB", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684604, "uuid": "2cc49199-8019-4781-858c-d169c6509b4e", "comment": "Malware payload (Gozi)", "value": "6317934326d7cfd2ef3a7d3daa77df372518c290acf2a98cf6a4666a0e9290feb540123b842cdb580776d7d717632afc", "object_relation": "sha3-384", "Tag": [ { "name": "202106221", "colour": "#A321FB", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684604, "uuid": "17303cdd-4790-4075-9b39-371e4e8c9930", "value": "T14E9423CABC90F815C2B70A30E3B85CEDE15937E2260255B7AC4C5B65774A9D28F360DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684604, "uuid": "fcdb6d45-7d36-422e-934f-90bb0b425ad5", "value": "12288:6EtZp/w4fvVUUcXGS2qBhQbdOM2lCLtTWAUrbIqjx9E59:6ExoYVUrb2NOQtTWAUvrj3C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625684604, "uuid": "45100737-f01c-40e8-aa69-4d7e439ea022", "value": 437796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625684604, "uuid": "a2c81d32-105b-4a8c-8ea4-46e84ce87495", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684604, "uuid": "9e75ff8c-c945-4024-88a1-af6cf4fc00db", "value": "b53ed71b3c7a18f70d693a137b5adc5c.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b80e93-def0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625640857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640857, "uuid": "8cc0401c-7f7f-4f20-87c0-13125f231b7c", "comment": "Malware payload (AgentTesla)", "value": "33212e204f9f7a75a6dde03743141935", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640857, "uuid": "944bbef3-5bb6-44aa-a291-6bef1736937d", "comment": "Malware payload (AgentTesla)", "value": "9f143bf39ca7cdcecad8e85a8ac378fffc74e9a269d501c85f608c8c4602c626", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640857, "uuid": "6fe76fee-e80b-44fb-a6f3-771d23fc7be3", "comment": "Malware payload (AgentTesla)", "value": "fba12898bcd98965ca57226105e79d5c7b3e42a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625640857, "uuid": "309d3f77-c792-4bfb-ab82-0b341e822a19", "comment": "Malware payload (AgentTesla)", "value": "4f2512a4cba81a48dc3ade87a4c51d0cd122d86263c93294d79bd6ed2ceea6ae334a1dd142dce5a4f507d238d9c4a385", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640857, "uuid": "74bfb8a8-1a06-4899-94e3-bd605474727f", "value": "34F45A583302759EF4168832B957DCF0EA207E665B0BC20390D73F9BB91E5D6CF950AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640857, "uuid": "72b86177-d3af-41fd-8ac8-28e3d68fb9f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640857, "uuid": "2653e998-fa0b-4cd6-9ebf-628c66a5f4c6", "value": "12288:6K2HVfjIIewNEe/4KTX9T3AsPyZmMWGuSLIjrBb25maxUY3WkOCPe5t33hMhbwM:6KQjVSCX97VyZrWxTPBC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625640857, "uuid": "abc7e932-6629-4971-a8b9-18a9887fe59f", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625640857, "uuid": "b4edc75c-c78d-477a-a11f-7e41b24f2d74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625640857, "uuid": "dc7fc482-506d-4617-8203-0b23a767eaf1", "value": "VaWkdIuZCZpMTyJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7755f3-dee6-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1625636838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636838, "uuid": "6d6506b5-acbf-49b1-82df-230b5677a3e9", "comment": "Malware payload (TeamBot)", "value": "9a4b68d515148c85f64ac25276af2dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636838, "uuid": "c642c4b2-ddb5-404f-b50b-e1028e88994b", "comment": "Malware payload (TeamBot)", "value": "a08affbf0b72b993cc827615ae916ae9eef32484c1252e3ab403ec091d28f5e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636838, "uuid": "b946597c-7642-4e7e-a08e-16ff1c35e5e4", "comment": "Malware payload (TeamBot)", "value": "3f7b82abaa94e79757b252bf60dd0548b0702740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636838, "uuid": "4126cbb7-29cc-4459-9f11-cf93c209ea46", "comment": "Malware payload (TeamBot)", "value": "4f36d445f8bc006e54308ae7e184af74e6225a1313c8a8f94edb85ffcb0cce425e87cf61054d45626eeeb92bfad43c65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636838, "uuid": "dbcedac8-b981-4180-ac83-739a02feaf80", "value": "72F422E17650CD76C24208303530C6B1EB7BBC726B724947F2893B6A9D771A1A6FA353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636838, "uuid": "73248557-6b81-4ed0-b806-7b63628284d0", "value": "1032a46fd4e2ff5ee27353305df6f8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636838, "uuid": "905326ee-1aad-4fd5-a7be-5e0500600f6c", "value": "12288:n0bGavFcOoREFvtgmYwRO8VXpL7KU69pP7cY6yrfDIx1m:OJtIibYYxBq9AYxPIxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636838, "uuid": "0e9973bd-9565-4b03-b56f-bda2358df8d0", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636838, "uuid": "a210d15a-3a45-4da7-b09d-3bbbf4fc682c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636838, "uuid": "9a4532ff-fe78-47b1-8b57-563244f7aa3d", "value": "9a4b68d515148c85f64ac25276af2dd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5ef6b8-df7c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625701054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701054, "uuid": "105b31d9-8989-4e12-9838-96e7eb19182b", "comment": "Malware payload", "value": "7fd675d7efee7367ff53887767b0a3cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701054, "uuid": "d556cfa2-2afe-4ceb-ac1c-54218673bfef", "comment": "Malware payload", "value": "a0b2a8b7117ccb50727e1353351b386c441c2aeb4b422375cdaaa8ea11e75f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701054, "uuid": "d3c3a133-035e-4a5d-a827-eeb6855d4eb4", "comment": "Malware payload", "value": "6da7c6a8f222e894b6b2a091b427de5f9b0149ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701054, "uuid": "f03d52d6-1266-42e6-8151-f7a98507d3fd", "comment": "Malware payload", "value": "4a32283a77fe7b10409d45f074ab1f572ec55e09a54b199723a99bd467da4a0aa90c3b505e907d2a9e7f0c49416512bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701054, "uuid": "d9350d0e-1520-45a2-9122-5733ec10ec2f", "value": "T18CD63346AC42D900FE4EDFB59E0A92FD8AC77C15A0401847EE5473F78D76A67A80FA31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701054, "uuid": "00bbd04a-1db7-4676-a04c-ae7c95ed3e83", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701054, "uuid": "26e8b9bd-591f-4c42-8abd-b6b19862f2a9", "value": "196608:Cu3HXZKDJ1zkq7ldwEuAc6mYMR8SLSU5E0u0Ka3MPTKksSdMi4OPS62sT:CEMfT2AiY1qSUE0NMrKwLnq6BT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625701054, "uuid": "4c94d428-9e27-4077-9f5c-3d38dae41a34", "value": 13095989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625701054, "uuid": "ee751936-c416-4f1d-a146-65e97419ca7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701054, "uuid": "4845ceb8-3cc3-495b-9bf2-ed63b887b002", "value": "SecuriteInfo.com.Trojan.Wdfload.508.15756.25486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44de79be-dee5-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1625636184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636184, "uuid": "2a98a2bc-1e45-438a-bc85-9e49a11b11a9", "comment": "Malware payload (Pony)", "value": "6f08f49fc602eb0c23fa23fff58671b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636184, "uuid": "b794b5c9-dfb2-4351-bdf0-3ff0097c7f51", "comment": "Malware payload (Pony)", "value": "a2294a1b6fc886b2150082727ffc9b8b0da044e85d08aa70d6638eae382d3fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636184, "uuid": "39ae6a79-8209-47cd-8a28-fdf1190d509f", "comment": "Malware payload (Pony)", "value": "9a7642ed6547353c117e63d263540d4e3eb8b1a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636184, "uuid": "f5ae70bc-2ad1-487d-bdf2-aed38903d529", "comment": "Malware payload (Pony)", "value": "403627fb2c9ced0259dbb09090efb3c640806e16d4feece39105737a74fe4b675ee04d299c7b886626d9b7a3eee52efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636184, "uuid": "40d5b643-a80c-488b-9c6a-0d2cf3f7d763", "value": "C3E4E4783222238EF4178C36F59EFCB8A5103E654A069143D1DF3B7BB59E5D6CE804A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636184, "uuid": "cb18f46e-c621-4165-9760-924d0c2e9530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636184, "uuid": "d8378d0e-caa0-4500-b74f-7a2e6fa80138", "value": "12288:5nUuoZhAFtRj6hAosJvjtAaMwkKo1Q6RKvfR+bR5LU2zn5Rk:5fgAFH6hayaWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636184, "uuid": "d23f9137-4206-4ba7-a83b-5968e66f9842", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636184, "uuid": "70793bfa-de6c-40a2-bc40-e5c074d7f887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636184, "uuid": "6e897316-337e-47e1-9b27-d79a0c298c6d", "value": "PreOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1036c476-deda-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625631372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625631372, "uuid": "bbfa972d-7a6c-42b9-b2c5-2c128ad52048", "comment": "Malware payload (RedLineStealer)", "value": "dfc04af136bc6a35d126c61ebf2037a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625631372, "uuid": "a4a2e02a-9529-4532-893d-c4fe83ffc21e", "comment": "Malware payload (RedLineStealer)", "value": "a4ba89389929db2c9baa52e9b858164dad161d53ba61a73712a2c3ba92b49ec5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625631372, "uuid": "24d9994e-a762-49ef-b53e-c54ffb216869", "comment": "Malware payload (RedLineStealer)", "value": "57ceccd672ba81834b356fa4a7201593506cf85e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625631372, "uuid": "afb35906-8045-476d-8592-179d29938a2f", "comment": "Malware payload (RedLineStealer)", "value": "679e9436040b2fc8a7bc3eb368f51391d0acf3d562612a72ebef5d171766241c3952fda258220ec29966c61c131319ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625631372, "uuid": "89865e94-395d-4f0d-b3c7-28795845f906", "value": "37F4E000B692C035F5F726F898759368643EB9F15F6851CBE2D47AEE1A392E09CB0707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625631372, "uuid": "9cd6afb9-ca44-48cf-8952-2ebb5e373ff4", "value": "1e8c0f829b104b9959a084b4dd191d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625631372, "uuid": "a0cbe09d-eb50-4630-b2c7-541c80e42470", "value": "12288:8fdDmByLjIS1oEMVzsZO+HbRSimjQEYQTYZydUfmb2DCf0CFvjTSwir5CZ:CDX4EQzU7RSiWJTDmukT8TSwircZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625631372, "uuid": "06e07f3a-296b-4729-8d73-04214dac95b2", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625631372, "uuid": "d370725c-401f-41c6-ac5a-12fa5ffe34ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625631372, "uuid": "e3bb39b7-49d3-49fb-a46d-33b37c493be9", "value": "dfc04af136bc6a35d126c61ebf2037a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fc8862-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1625661599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661599, "uuid": "b671afd1-79b4-4c12-9f28-01f2dfe5e67b", "comment": "Malware payload (CoinMiner)", "value": "8574986bc156f34e9092f11abd801ebd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661599, "uuid": "18588810-6e31-4425-acb6-f8b96be95afe", "comment": "Malware payload (CoinMiner)", "value": "a7d9d0484b759de68c00834d15fd55790f843ddc60f8e37fa875b4686b9c8335", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661599, "uuid": "6a97b162-98bc-465e-9d7f-b35796358ddf", "comment": "Malware payload (CoinMiner)", "value": "82b4166c965f457fdf3fe8b342630f61f630453b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661599, "uuid": "6c387512-5769-4847-b8d8-6c89bd190231", "comment": "Malware payload (CoinMiner)", "value": "5aa7bd12a6a35e90455123fd740edb450a1e704d224ff6c65308e8099145a97a9601c65e4d6d5f67a0f41ba9fe591c52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661599, "uuid": "8e7ad061-7a5c-4207-808d-6cb6cb20d46f", "value": "E8156B583306719EF45A9431BE67DCF0E6103E665A0B820360D33F9BBA5E5D7CE811BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661599, "uuid": "c0436e41-638a-4647-a922-b61283d3b039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661599, "uuid": "a7d65e08-d9af-4ce8-a52e-961d942e1505", "value": "12288:gdwyUKuF8c3y0n7lEKAx67/FOhVUqYgDKeKXh4LtSfpYVOZ+XOxI7cKzd/N1cu8u:gdwD8c3vBDAu6UqYEKXh4LsfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661599, "uuid": "615f9ce2-820b-4332-b284-2efa25e47066", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661599, "uuid": "4ab07114-70c8-42f6-bf58-3c6db93ee423", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661599, "uuid": "d8f16902-b853-420a-912b-5eb92375d2a0", "value": "PO 000365 MUN HEAN SINGAPORE PTE LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799d4db2-df23-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1625662902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662902, "uuid": "1adb3278-2433-4dcb-b98b-b1ff78df3115", "comment": "Malware payload (AZORult)", "value": "0c21787e1e39541449c4dbee0e7a26e0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662902, "uuid": "9285929c-90e1-487e-b1b6-4a9f0eb1c886", "comment": "Malware payload (AZORult)", "value": "a800f3aefe262ccf51d647a154e8db7195ff6e4a360ec3f84586f763abff19fd", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662902, "uuid": "de7ce757-0baa-49fc-bd16-634148126d4e", "comment": "Malware payload (AZORult)", "value": "052cd154f4689ccc921a2e00acb230f531ddfed7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662902, "uuid": "5e3e35f7-d1cd-4594-add9-6cfd9ce94559", "comment": "Malware payload (AZORult)", "value": "9bddd921b5e1c3059cc02377e72d44539d1f792c8e8e0edf39512515ffdac16d121e9f0e12b90691463d917519d266bd", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662902, "uuid": "a9bf5dc1-667c-4ffb-9874-4b19c1b79613", "value": "C704D11167508EB3CFF9CB71753F2A691EB78A3482D4420B23846EDEAE6E561881F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662902, "uuid": "a7d8ac79-0fcc-4333-806d-bf928d3f54f5", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662902, "uuid": "ded3edff-83eb-412d-a9b3-4b6f3450562c", "value": "3072:SDxaVzwmg4CSW8JSuNI+SvNI/CLPWgC+edyNB+yFiYbJ6TJ35Mphn3sHOZPRWre2:cMm4CCc+SvNqCzRC+edyNB+FaJcJ3onq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662902, "uuid": "fda74530-7c70-4428-b360-e62dddcf27d3", "value": 177381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662902, "uuid": "640d8bab-e842-4c8a-a4b8-9656387f9705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662902, "uuid": "c6ebc2b3-f42f-451c-ae07-f10bce3e93e3", "value": "Odeme plani.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc04cf7-deba-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625618026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625618026, "uuid": "11abb031-5c22-4d80-a8f7-3a59284e6f1c", "comment": "Malware payload (SnakeKeylogger)", "value": "e6965c0488519c6c1f984bf4af450cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625618026, "uuid": "94879bf2-c0af-473d-a4be-52dd02368d65", "comment": "Malware payload (SnakeKeylogger)", "value": "a82dfdfe72d758a1e5eb0b39df016eda8bba4953071d1324b987224bec58404a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625618026, "uuid": "3b61dd80-6376-4f5d-95e1-773e70e87f05", "comment": "Malware payload (SnakeKeylogger)", "value": "80de0c59c7c9c5b1e3d14a08960e0a2af4f931af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625618026, "uuid": "2e0b374d-e4ce-4f90-8582-3e5767ca57b8", "comment": "Malware payload (SnakeKeylogger)", "value": "474c237cdc19b772c6181bf79243236fe4b5cd64eed60a775a3e300c765f35d8b53d83620723f066d02592955a8e1a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625618026, "uuid": "78b4e06e-e400-4d48-8152-389490b1b78f", "value": "8BF4F17506142F97D6F881F9A095368083F5C3EF3226FBC93EE161E6C0C6A884F67659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625618026, "uuid": "82dd29c3-a74e-4ccd-917a-3ed8204015c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625618026, "uuid": "ba108cb9-2bc0-40ab-984f-15535c121ac3", "value": "12288:O1nQD/F08SxyexZxilnuNU2IYZAnkW1IKIKaKPGIeBao1Ttubdb0TnaZx2yw:ikYBZxilYU2+nbTsj18BIjaqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625618026, "uuid": "08a5f4f5-c55c-41ae-b83b-a93aa342951a", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625618026, "uuid": "014269b6-db1c-403f-9ccb-9cb50bf00f71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625618026, "uuid": "587d5ed4-4962-4ae3-876d-9817794430bd", "value": "cotizaci\u00f2n.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5448e15a-ded0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625627191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627191, "uuid": "32ab7d80-7a1b-4980-8e91-27a950941760", "comment": "Malware payload (Loki)", "value": "696faa93c874fa96017438f4724842dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627191, "uuid": "f1d189db-f983-4a31-9878-6f3d739a4dee", "comment": "Malware payload (Loki)", "value": "a8605caaa6eb9c728d1bdad21a87d5ab5091a223b28784d8402c4224099f6a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627191, "uuid": "2a481779-8780-475c-ace3-bd30b99a8f3b", "comment": "Malware payload (Loki)", "value": "218110ef6bfafeb22d35fac585375417248c4053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627191, "uuid": "b9a5f78f-3ace-40c3-8b31-8f83719c8295", "comment": "Malware payload (Loki)", "value": "dfce4ad58f002850e0702923b69460022be0c2c355491661bbc4b1034799824d26198b615dd332bf9abb2879920e85e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627191, "uuid": "00cce576-f01e-4b04-8d4a-8c62d2cfe210", "value": "30457C99325072DEC95BCBF289581C66E7586CEE530B9603A06331BD9A7D98FCF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627191, "uuid": "fa794ab9-6bc3-4cd2-bebb-8cd092721e97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627191, "uuid": "c3f777d8-052e-4ebb-a556-02d7d84f71ed", "value": "24576:jM4Bk536NBtIKDXbNc370biYuWOBfWlBu:Zi36NBxraIbiBBBEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625627191, "uuid": "d3ef7b79-57f8-4f17-a5d0-3632ba35bc32", "value": 1221120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625627191, "uuid": "103bd9eb-7527-4e26-ad16-aa4f7ea33300", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627191, "uuid": "c764a1e3-54b4-4cd2-bfef-9408dc6ad804", "value": "RFQ210707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd988a91-df1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660492, "uuid": "5deb29b8-cf19-4bed-80ad-23b648ddb6d6", "comment": "Malware payload (AgentTesla)", "value": "f5a7f8a31ebfd681addd1de849f0d1b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660492, "uuid": "a881edde-bb43-4da9-9453-c790de9bf850", "comment": "Malware payload (AgentTesla)", "value": "a9b03983f5a4ee070a257b4abceb58ad40100b0222d4a16b13eecdb376d9e119", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660492, "uuid": "abb36b5d-966c-441f-947b-eac2c71b75ac", "comment": "Malware payload (AgentTesla)", "value": "9a96777b1dc008a57f04ac3c93ab960891bfeba7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660492, "uuid": "5b053ecf-a3e8-4459-9d41-8d820d6c0bc1", "comment": "Malware payload (AgentTesla)", "value": "11036511b886cff3a33febd495bbee3d0c54720cf61797290ae1c98ba55afed149a676c26fcd3f56e7c02e1692f46c5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660492, "uuid": "16923805-a264-4aed-bccd-39de16a9a7ba", "value": "992533C628A4175DB029150AFECA3BBA68381465D47C6DD85F23FF3C356A150FB882DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660492, "uuid": "a88f6dd1-8edd-48e6-9e63-d654e5c151b7", "value": "24576:YTlIBr3xGm2vwt6qilNuKLe3G8iJ1qPLF0XREaOrF0qjJIg7cNAyqrKlPT:Eyr3x923qkNuKLHJ4faOp/4NzIKlPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660492, "uuid": "63177065-1139-4938-aef1-9635cb732e17", "value": 962873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660492, "uuid": "b4906f63-d290-49c0-a353-1c1312e770ca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660492, "uuid": "f1cfcddf-4ce6-4f55-ad75-33e136702a63", "value": "12-17.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb52432-df22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662638, "uuid": "565fde1e-2f9b-4ef8-8502-7efc78f0080c", "comment": "Malware payload (AgentTesla)", "value": "a6383b3b7cddc7e5cc05a2d7f566824c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662638, "uuid": "77a51e45-5cfc-48c5-ac9b-9ab4efb102ac", "comment": "Malware payload (AgentTesla)", "value": "abcd51c9f46e11dbfba0015c82365fcf207e15aa2e32ae9945affd9990b07e14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662638, "uuid": "902ac35a-fe77-43f4-acac-7200047b157d", "comment": "Malware payload (AgentTesla)", "value": "a4bca5f9bda03d9f1ed7b90342003261d47453ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662638, "uuid": "9df308a9-d53e-48c3-b51d-28e5d44f82e6", "comment": "Malware payload (AgentTesla)", "value": "382a719c384b0382d3e2d8e5c169cb456c5a824341632d56f285015aabd9ee88d1a611ffce49ece8fb3dfebb145ff1da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662638, "uuid": "ca9b4caa-9baf-4412-889e-06a22ffd50c6", "value": "CCE449987312759EF4178832B956DCF0EA203E665B0B820350D33F9BB91F5D6CF950AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662638, "uuid": "74f86ef2-5ab3-48d5-a35b-e0081d99cd32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662638, "uuid": "6ccf1564-f6f0-4b43-94eb-70026f37a0bc", "value": "12288:DSpbjv1FNqX5fg86OBk8KQY5J3qxSaUviq/ZhCInnnM0e4w7hE+1IzkPcL:4bb5qJo86OdKQO3qxSpviajC2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662638, "uuid": "d5a9c929-f3a0-4443-a8a7-f0e8ded31d88", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662638, "uuid": "9768a30b-5131-4480-a727-e7faa64d9e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662638, "uuid": "1b05ea2b-cbbd-4d64-b859-ffb938a6e537", "value": "PO 547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb8c3a1-df57-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625685351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685351, "uuid": "05657cbd-18cd-4cf3-9347-9071aa17e43c", "comment": "Malware payload (BitRAT)", "value": "ebb745c7b985164575cc76803f7bb46d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685351, "uuid": "db4a17ce-3697-4108-b74c-a486779da673", "comment": "Malware payload (BitRAT)", "value": "ade9445823ca1711a80264706d612f5815743d69352619df4c4505cbaf50c640", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685351, "uuid": "88e28563-1e3c-4557-af93-708cd8358dd3", "comment": "Malware payload (BitRAT)", "value": "3e00d015cd58cabdc9adf0c14c1ba26d8ee98608", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625685351, "uuid": "c0b63771-8767-4f61-8bb5-4f2ea13804fb", "comment": "Malware payload (BitRAT)", "value": "9520cc56f280c4f5cbf3fd61837ae6b88af6b2244570ef54d6238d1679b12e81c7b8b7ee05a0bbc08d7012c5e3938eb6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685351, "uuid": "8cbfaa4d-f2d8-44bc-9dc1-c729ff713e9a", "value": "T1D106CF02FA46C562D2170230E96E77BA053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685351, "uuid": "45640f42-81a1-4c52-93cf-8c5f56fa03b1", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685351, "uuid": "00cb2b6d-7577-413d-8826-5fe7b95440f9", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/UmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625685351, "uuid": "75148731-13a1-4f99-916d-730b9b64ccb2", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625685351, "uuid": "a1d7da56-9dd3-4f13-ab47-ff73d2bd9396", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625685351, "uuid": "a247c931-81fd-486f-b9e9-ca7d91523a45", "value": "EBB745C7B985164575CC76803F7BB46D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de094384-df01-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1625648467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648467, "uuid": "a8efdc12-809d-49fc-9bfc-13aa443f87f9", "comment": "Malware payload (WSHRAT)", "value": "ca10ec548003f9223a54454a91cee868", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648467, "uuid": "a44d58b7-eff8-4503-a0ee-e937acb4211a", "comment": "Malware payload (WSHRAT)", "value": "aea11364aeed95ab19fbab4719b7b3c1e47521a12c602fe74d1f0efaa4016999", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648467, "uuid": "61983d7b-53e6-4092-a04c-d68415c5ddc7", "comment": "Malware payload (WSHRAT)", "value": "805ec3707a515c27fbd518822ff9df0fc34c3cd6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648467, "uuid": "62bfa21c-5762-4905-8d66-f1f3d82dcf56", "comment": "Malware payload (WSHRAT)", "value": "f78604d860d620549819bd9428d3fcea177117b289dfaef4000f1ea1a79c74e8f633dffa0cbbfc63d9c87eeb4da9c9e0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648467, "uuid": "fa794d16-7095-43c6-b321-e8fc5aae5da0", "value": "DB25A0C2665DBA27BBA3EE06C25957132474C723091F3C11FAC23F88DF5A88469F99D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648467, "uuid": "ba1d250a-a20a-41f2-9bbc-c07cafde5ea9", "value": "3072:aMaq6zCbggueDnOUjOlHHV1eBqeLSQ1x0e+mobrUumVrY4Fs:Raq6zCbggueDn5jSm5+mhRrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625648467, "uuid": "20a2608b-1428-4ce6-8acc-a0466a74e55b", "value": 1017137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625648467, "uuid": "7b358405-1741-45c8-8d81-20228af07a97", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648467, "uuid": "dc144b19-f46a-4df5-8ccc-44c2dcbed4e4", "value": "scan002341.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85005371-df1e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625660773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660773, "uuid": "47531bca-047d-42df-8ded-fc715d88f07d", "comment": "Malware payload (SnakeKeylogger)", "value": "2502f4f12ed3be63430a55ef2ec85b18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660773, "uuid": "84268fc9-8f10-46c1-a8c4-de87c04539c5", "comment": "Malware payload (SnakeKeylogger)", "value": "afe6c126a77bf6e6c8036e2e88d28b7f26ad3df772d9ed2013c4270fdda3dc59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660773, "uuid": "69fb8d86-ea7c-41db-9d71-ca2fb6b5a9db", "comment": "Malware payload (SnakeKeylogger)", "value": "a87c2b3b47a970b72984852c398c143935d052b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660773, "uuid": "ab91b760-d182-4181-bd7e-9aa905e6ebf6", "comment": "Malware payload (SnakeKeylogger)", "value": "afcd394f8aa7a7b973d34a2fb8e6cf7ffbf263a8349bdba8b50cfd9e498bea818856b2befafdfcb032f13ebf4d8f802d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660773, "uuid": "428c3505-7698-49db-a24b-aa86b2aa9d9d", "value": "9845BE7660378A92DEAFC7F90330662F4F6DAFFD905AB6741844743900F4B4D4AA192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660773, "uuid": "8fccf514-5800-4ac5-81a2-104bb4e59d31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660773, "uuid": "f3603174-7d94-4424-8384-38554409922a", "value": "24576:nAB+HSS38J/y5hNtzn/B7PDStxd7kN4H0biYuWOBfWlB:ABJJ/4tzgtD7k2UbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660773, "uuid": "a6c660f4-c1de-4f16-b5a9-44ee20257b82", "value": 1164800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660773, "uuid": "6d3499e0-0c82-4f18-abdb-3a0e6c90d13f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660773, "uuid": "2597b80d-ee22-4299-aa78-eff08ffabbce", "value": "Machine Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93393697-dee6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625636745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636745, "uuid": "a7a9ce99-a8a0-4ca6-8196-61d593c48ab3", "comment": "Malware payload (RedLineStealer)", "value": "04cb46d6125f15997ecf1493221510c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636745, "uuid": "a0d23f73-6794-4731-9f1f-b36c344b224b", "comment": "Malware payload (RedLineStealer)", "value": "b1273f3d3f17881ba0b4119d888f69808b929d102fff9f3b8290a860790708e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636745, "uuid": "b8133362-4eea-4fba-ad8c-4bd7716be3da", "comment": "Malware payload (RedLineStealer)", "value": "f2904836376431a91b3879de31259629d2ccd0cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636745, "uuid": "d60e2282-6190-45e0-b83b-e21239a3a325", "comment": "Malware payload (RedLineStealer)", "value": "441d301af613cb1c9f11b74997b9f636c58b9a609c383d36287b60c9472d3ee55018e4577b3609dc0322e7e34d68a09a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636745, "uuid": "b6676b44-3554-4399-adf0-0debd3ecb8da", "value": "C254E0207AA2C432C397053574F5C6F0A63AFCE25A268547F2543B6B6E332A165FE317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636745, "uuid": "fdf7a900-57ae-4244-8927-2103b3391747", "value": "da5446b036e9ca50ec91ebae60e40a39", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636745, "uuid": "17f21cec-bbe5-48fa-aa89-ba7886ca8850", "value": "6144:iTbwgmENsflYW2Bwl4g8SfLngUxDxCLIe:i3wVtP2Bwl4gBTgUxDxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636745, "uuid": "a70bd926-b890-4ee6-9a9b-d6f13c54b9ce", "value": 283864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636745, "uuid": "64c78130-b465-4a57-91fb-6744cc93c2c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636745, "uuid": "5a690d42-07b2-4b52-b18b-f15f3463622f", "value": "04cb46d6125f15997ecf1493221510c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb0ee74-df63-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625690400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625690400, "uuid": "b1bbd5be-ffaa-47ec-85d8-0c3eaed9d3c2", "comment": "Malware payload", "value": "d2a3ae4486f637e7047376b1d4b51a7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625690400, "uuid": "a928ef7b-3020-472f-851d-21b5b4667c1f", "comment": "Malware payload", "value": "b218e68597d75962302a9ebc20c19d18666d687e90468e619a52d6763873e747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625690400, "uuid": "0d7f8109-8b65-4d05-b243-2a23fb1c56a9", "comment": "Malware payload", "value": "7507560dc6bda770ac369ef9c7aa53b4157ca72a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625690400, "uuid": "ff6ed93c-4a50-4d4a-82c0-b15ab742a65a", "comment": "Malware payload", "value": "bb4e989314e0701ec03356270a783ae6c036a21d6dd097c4499a7c466206797326ca3d5b5fd0106bd9681eb5985740a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625690400, "uuid": "d268e198-7251-4585-a0e2-f30df8353e40", "value": "T102440247CA4F73F4C15BA3319241A13F2E20258AAF18E8F7DA655C03CD8D5965A7B7B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625690400, "uuid": "8bb2b001-0746-4f4a-bf16-e7542854ec7b", "value": "4760b63b249352350fb67b805f5d8b2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625690400, "uuid": "69219cf7-d43e-403b-a788-7110ba975c5b", "value": "3072:IwEYUOZgqLerAZN43UFui/XhLh7keqwxncf8Pru6XZQPacsWZdA+juV05R7v+blo:pnUOZ3DPSUNXBFkwP0PacFdlW4Rn8g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625690400, "uuid": "6a62c583-7525-442e-a049-857858e28b4b", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625690400, "uuid": "47ae340a-b6bf-4e4f-90c3-c13931af10e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625690400, "uuid": "c850ac20-8db2-4cc0-a084-3b61987cef49", "value": "d2a3ae4486f637e7047376b1d4b51a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2e9f99-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634157, "uuid": "9ce9904d-4705-4462-8292-8ab3a61e344b", "comment": "Malware payload (AgentTesla)", "value": "ecd9624c1db90c4d37c9c13134e7b530", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634157, "uuid": "dfedc96e-ad21-4e28-95a1-e1f0aae6bf46", "comment": "Malware payload (AgentTesla)", "value": "b5a94ffe5202310edc5f0b2282060bdebfc81e0b1c384034e3a0865f21bd253b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634157, "uuid": "49d20bd4-fdc4-46d7-8f5d-3b238638a650", "comment": "Malware payload (AgentTesla)", "value": "d690042933245f70c433fedb325889465f796d78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634157, "uuid": "7ad05d0a-4343-468f-b421-af7c35ceb3eb", "comment": "Malware payload (AgentTesla)", "value": "9c58f28a2261f7beb0ff7faa028b25a96021617618dd2be12e90edf8cedc3c722649b950b6ea48c9ab80540e9c2bdda3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634157, "uuid": "448871c6-1596-4e80-a775-19858bef0acb", "value": "80C433F380D55982B63BB598B5A3EEA1DC131BB29700AB4787F92B51CF690097307B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634157, "uuid": "a87cbfa8-3a2b-4193-961c-f40c7f54d7cb", "value": "12288:luwts0YhfVfDpFg+0P0uReEAxtspOY7OrGAcN:vzEtbgUuMEit6KGAcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634157, "uuid": "9037e0f7-40f0-4717-9738-848b705b74e5", "value": 548984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634157, "uuid": "08a572ad-4fac-45e6-9e5b-5343b75287b6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634157, "uuid": "3c93c255-a612-4271-a08f-e573f85f73db", "value": "RFQ#17281651.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fe3696-df2f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625668175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668175, "uuid": "ecb3b03d-8ce1-4268-9214-70d529aa728b", "comment": "Malware payload (SnakeKeylogger)", "value": "055e97a735c5d9ba4ef71611badf8c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668175, "uuid": "b9686f2f-c4d7-428a-8739-e315d642de32", "comment": "Malware payload (SnakeKeylogger)", "value": "b714843003128fbb1f579c92ba69e28535994d462ea06068fe3f9909311f2902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668175, "uuid": "15c540f9-164b-41a3-9e95-da3bebaf8bf5", "comment": "Malware payload (SnakeKeylogger)", "value": "1dc6a06ed14745f8f62e49064043d6dffcfcf8bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625668175, "uuid": "4f82a5dd-016c-4cdc-a9fc-7c797bf80dac", "comment": "Malware payload (SnakeKeylogger)", "value": "2c2bd68f2ed3e3b7413cebf4f855c6be44872232e228f798b78182dabe3bedbbfc569591cfd4ae531a8d1746d80ed72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668175, "uuid": "1979e99a-7cde-41b3-b797-71f3334c43a3", "value": "6AA49D3EA955272BF37B91758A814055F5BC90EB36319DD783C7228C750E9023EEA32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668175, "uuid": "4ba6ab31-0e5b-4167-8546-c86e127a94ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668175, "uuid": "2da5595b-e6e7-4ef8-9aa4-7d6d18b18441", "value": "12288:6O8EKlXgFxY3wBeTP/eODzyT2Kf522/OUHjD4:OHHDKE22UH34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625668175, "uuid": "de123477-4d9e-4fa8-baf5-1f3d9dd03d21", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625668175, "uuid": "91e9b261-69cd-43de-9bb5-02b0ae4697d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625668175, "uuid": "be1faf99-4349-43f8-bf27-9f8ef5c523da", "value": "Shipping invoice&packinglist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b456a0-df3f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625674866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674866, "uuid": "9015ebb9-b9e1-4def-bcb9-8d9943db7021", "comment": "Malware payload (RedLineStealer)", "value": "e674a4c8ed7e081c892165a962397853", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674866, "uuid": "3802b78c-0627-4479-b786-f3b7edee78d1", "comment": "Malware payload (RedLineStealer)", "value": "b7a97e1942468a8632331ea66f3230597a66e75d95bd94efa2cf47e5be8f2197", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674866, "uuid": "61c16958-7272-4c55-bbc9-950030de357d", "comment": "Malware payload (RedLineStealer)", "value": "3adb55ae448f4575f38a303dca98782151273882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674866, "uuid": "3ad23ac6-63d7-4210-9d90-43ef6b280581", "comment": "Malware payload (RedLineStealer)", "value": "26cdc1cd953a0276d78ff100c63b90e27f43714f96121060918d028db09d5b2b2fd38ced85aefc665a64bb94b0e23421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674866, "uuid": "01923bc9-5ee2-4d08-8716-0923badde248", "value": "T129F4F1053FE892A5F1269FB521947400C73ABE1E651EE21E6DD83F8E35BEF809881357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674866, "uuid": "e451cdcd-2427-4899-af7c-14376f624e64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674866, "uuid": "9611a06f-4f9a-4a47-96c8-f44c9eda9964", "value": "12288:kGhiU0W7F5kLklPPK5MJ6OM0RsVHlSZj9rCTYtXRZsVjJ9U6CiIR2CbjU:XkU0sFqLpLe6HlSZj9+2uVNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625674866, "uuid": "53a2a17f-28aa-4531-a6cb-34f8f6a6cfc4", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625674866, "uuid": "1bdb4fa5-a99a-43e3-90ac-11a40898dbe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674866, "uuid": "62516fc8-1d18-4164-8356-9f4ae134caea", "value": "e674a4c8ed7e081c892165a962397853.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3faf354d-df35-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625670535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670535, "uuid": "709d0f1e-4dbe-42b7-ac4b-215bd04680e4", "comment": "Malware payload (SnakeKeylogger)", "value": "e289abe94d8bf97fc9d69e5e49b563d6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670535, "uuid": "13f0aba7-29b6-4bd4-967b-d58eaa3fc40c", "comment": "Malware payload (SnakeKeylogger)", "value": "b973d4a09eed24864c9805bee726c2e0440bd43cf0d8f665ca1d225ee2322cc9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670535, "uuid": "7121fefd-8be7-404d-adfb-dc04e266b834", "comment": "Malware payload (SnakeKeylogger)", "value": "706397e23ac12fc66a91d2565185898d84cd5603", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670535, "uuid": "dafad60e-a641-4830-8d73-aff2a719cb1e", "comment": "Malware payload (SnakeKeylogger)", "value": "0f66fc8c9618dc92fad7ec786c187e26c5b50e3061e8b00636f2b0594d6004a01c43119196935b54a83eb0e5b37f9d5f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670535, "uuid": "df56a55f-ed4a-4b26-9e9d-f3e04918f2f1", "value": "T1BAB42375B512CF3EF720A25F11CF365C5108E3604690EE2B146BB1FA2A7F1E94E68879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670535, "uuid": "b1a303a4-d322-405f-9288-ef2adf4d432d", "value": "12288:ttOYh8b+swOGMqEfGWz+Ww+AK8P9efOtMKaSBReg:fph8SsxDrJaP9VZaOReg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670535, "uuid": "af4fe9e3-5087-4f1a-b1ba-c5fb7bc303ea", "value": 513686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670535, "uuid": "5b1234d9-f782-4f5b-8534-93e69eae6129", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670535, "uuid": "127c710e-b3ba-4779-834b-8d23b89ec325", "value": "SWIFT COMMERCIAL DUTY 03142C.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3e41a4-df72-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625696890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696890, "uuid": "88eea16e-de18-4c3f-b544-72cad1a34c2e", "comment": "Malware payload", "value": "d6871a796d606ab3afbc7c0847910ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696890, "uuid": "019e10fd-992d-41d9-bef8-5b2eeb5d0b3b", "comment": "Malware payload", "value": "bb037304cfd0d902a0b498ec07ac1820b400f7741b6b6c4e9e823e9c4868f473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696890, "uuid": "f83adf26-1226-4fd6-be6c-297a8e43448c", "comment": "Malware payload", "value": "dd68081039d2815f3c178c4ee9820cffc27d8bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625696890, "uuid": "d077cb8f-8660-4228-b79a-42d50e1679a2", "comment": "Malware payload", "value": "7cd0efdcab636cb6ffbb7ef7bc67bad01ee20667f28e0a99111b6a6c41daa381d76d6f9ddacba56922fe7ad12a244782", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696890, "uuid": "2239c974-205b-402a-9a96-ee8be8dbb3b8", "value": "T16325E122330CDA05C0BE17BBC9DB41504BF8A603EB63D9697DA533A90F82797B51F589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696890, "uuid": "a7e520da-1adf-4c85-826a-0ae5dc995883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696890, "uuid": "c6fafde4-d08e-4e4b-9ba1-12d20fddffbf", "value": "24576:l4SoS2DKPENxRBho6ATJGIozJjsWS1YdkvAD9KL:mYfPqrB+6ATJ2z2F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625696890, "uuid": "43c1d2ea-0787-493e-a630-b087896b9efa", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625696890, "uuid": "1dfa8504-41b3-43fc-8922-9709f4091029", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625696890, "uuid": "025f036b-c3e4-4087-8baa-909374a5c2a5", "value": "Z4dU7sTJxc9Huxv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b3c50d-df56-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625684966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684966, "uuid": "065c4ae9-d279-4149-9c73-dfda211e4696", "comment": "Malware payload", "value": "a51f7dd71428c781b3be3b7b545a93ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684966, "uuid": "c9754db6-5b6d-497d-8ef4-566830137299", "comment": "Malware payload", "value": "bb8133a5a356cb977e5d83af55e4b0452e8b23566f46b9d03c5c7126a47ccd73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684966, "uuid": "328909ff-4127-472a-b189-761fb8b94bcf", "comment": "Malware payload", "value": "d898eed91fd89022a9c845d8cef1421eb6e19c0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625684966, "uuid": "47ff05c5-fc3a-41e0-93c7-6cf90b175781", "comment": "Malware payload", "value": "49b4a01b324964ef200b986991a531f564f076491d5d52fb194829c0e54d6ca5583d7cc782719ec5fed1fed285195c03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684966, "uuid": "9f4eab9e-3429-4730-b8cc-fa2188b2dd25", "value": "T139441247CA4F73F4C19BA3319251A13F2D20258AAF18E8FBDA651C03CD8D5959A7B7B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684966, "uuid": "6d214676-8998-49dd-9516-221cf64867db", "value": "4760b63b249352350fb67b805f5d8b2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684966, "uuid": "7406f0d8-5a6e-4a91-adc4-868c69405a1e", "value": "3072:JwEYUOZgqLerAZN43UFui/XhLh7keqwxncf8Pr76IZQPacsWZdA+juV05R7v+Jl2:enUOZ3DPSUNXBFkwPMPacFdlW4R58g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625684966, "uuid": "8176c2b6-0e01-4d3d-a861-8748dc851537", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625684966, "uuid": "f563ae35-5082-486e-af52-07122f56803a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625684966, "uuid": "d9a82820-b23a-480b-887d-8b329d4a3d3d", "value": "a51f7dd71428c781b3be3b7b545a93ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f447a7a0-df4b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625680287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680287, "uuid": "32df5abf-f0c9-45ae-b885-b645c320b7e1", "comment": "Malware payload (RaccoonStealer)", "value": "616ae69cbf101d5b170846c3fd63a930", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680287, "uuid": "ec8b2c9d-779d-47e0-90b5-25fcc7b7f05a", "comment": "Malware payload (RaccoonStealer)", "value": "be0d8928d4c9b226389bd2cfa04a6410aa9fe209aaaed24880e40b4e0a6cd7cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680287, "uuid": "8bf7c82d-44ed-4c66-aabe-f0f1859fda9c", "comment": "Malware payload (RaccoonStealer)", "value": "c91c3115e7f7f1e132e05bc303f7f29ca75830a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680287, "uuid": "7fc97caa-ff23-4531-80f0-459ac8e7392a", "comment": "Malware payload (RaccoonStealer)", "value": "d051fbd64bf3b2f6e59626dba4adab96675f0168168233b4ee8cf4067bc122baa78ce3177f56dcc53efc8cfe31e9399c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680287, "uuid": "a82806e0-9ab4-4066-9b67-553dfb2bcd74", "value": "T18955AB6930E82C81ACBB24754659D3F3D2EECB71CF0B38FC8162A554853961FA5B9C27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680287, "uuid": "2c40621b-9dff-4a60-b40d-241a811cb9d1", "value": "3c7cf310519cb6b2ae1650f9bdc35f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680287, "uuid": "0a41b480-5ebd-4159-8325-85fb225bc6a5", "value": "12288:CFPwV0BeiN7K2cQZebRiE0y4sziyXRXi0JMOfKSRdIwcYc7G+yAdtkfX4U4NjBiT:/jit8p4sOyXtJMOLvW79dQqjBiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625680287, "uuid": "53ff4458-6775-47f8-a1f1-687c4150e0e7", "value": 1317888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625680287, "uuid": "43c08085-86f1-4d91-ac4d-44e5c31dad31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680287, "uuid": "b1f36ebd-71b7-4b47-aa6f-0c1be515154b", "value": "616ae69cbf101d5b170846c3fd63a930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc23969e-df27-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625664731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664731, "uuid": "97addb45-5c6f-4f9b-bef6-8fdfe6a01d6f", "comment": "Malware payload (AgentTesla)", "value": "8c9f13296b6e3260d9ca9f7254bd46a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664731, "uuid": "510a6ff9-5318-4e14-b74f-6e5b1a3897ab", "comment": "Malware payload (AgentTesla)", "value": "beab19e796d64d3fb25a343dab92efc44fde8f34bc2398fa381c22763cb47cd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664731, "uuid": "5391e858-5045-4faf-a75d-0f6d342edd15", "comment": "Malware payload (AgentTesla)", "value": "4295081558bd2a608d8e9b2ce0e395de128abb78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664731, "uuid": "f729fae5-736b-474b-a47c-7df039dddfac", "comment": "Malware payload (AgentTesla)", "value": "7faad924086781a2e8652213fceb1825689eb4b1a2c94c8b1300fb83c14cb9876cde7bbbd5b7dd2ba7b1e3f29b3693f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664731, "uuid": "8d266a82-11c4-49e1-8086-e0e0d49ae0a7", "value": "75659E3576729F91DD7FC7384331D13C4FB4AE66E207E67968E8789B24B0B810A16623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664731, "uuid": "1792d9c1-4fbb-4b62-a62a-0bfdeee90ac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664731, "uuid": "1f433103-bec2-493e-b46d-e61df71adb75", "value": "12288:VPTDaIMVjLz7TkqiOcez3gVZsZZZsZEJsDsr5bx9Vpw7g3UAVHLFNMSF9WPl7k9d:aiOlaD4lcZArNM4IwxOsnpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625664731, "uuid": "255bf4bd-46d6-462e-92f3-f98a68d13192", "value": 1459200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625664731, "uuid": "62a0c2f9-eb00-4a0d-8886-85eed3befce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664731, "uuid": "4f802eeb-09cb-49c5-ab5d-a56686aef17c", "value": "Curriculum Vitae Rita Molina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c46124-df42-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625676267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676267, "uuid": "653db15e-4ec4-4dbf-9f5f-1718cdbb447d", "comment": "Malware payload (AgentTesla)", "value": "d5db50d449dcbbd2dae36410707c4103", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676267, "uuid": "c2ca5c44-dd6e-4600-b298-b43732693126", "comment": "Malware payload (AgentTesla)", "value": "bf0db33fa824c9d43e1b88c525cc921c1c65be0920faf1615ffce9324fe7df48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676267, "uuid": "7737732f-63e8-4445-94d6-a8628a9195eb", "comment": "Malware payload (AgentTesla)", "value": "391bc5e82b3d7f5e03289b961bca3170372b028b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676267, "uuid": "ecc1f217-3e89-486c-b6ee-f31a416b639f", "comment": "Malware payload (AgentTesla)", "value": "35ce7839cd030fdf116b8c56d06b6cd878b9867466c75600a7cda71583a5690723d6c4b05572d81d26a35dd85f363957", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676267, "uuid": "cd2c2858-20e1-4cc8-a403-2a1e565ea484", "value": "T129A48C3DAA94272BF77791758A814005F5BC90EB36319DDB86C3269C310E9027EEA33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676267, "uuid": "48c22c3f-b2ed-4183-8af5-fadf75ea9172", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676267, "uuid": "2c0453e3-1325-460f-be97-d45bc7a05c6d", "value": "12288:fKR8EKlXgFxY3wBeT/4cYoFJz+tn7kh68bDWkvcKvw5sxV+P9c8FlAl:Cq/Y0+B18bDWkkKvwrhlAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676267, "uuid": "ea0a7caf-9c41-485f-a7d5-21fdd664331e", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676267, "uuid": "2cfe3df7-6989-4403-8745-69fcd03f9223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676267, "uuid": "ddc85747-c605-4d84-98a5-dac3f46d60ed", "value": "Petroluem Hardware Shipment.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e2ed37-df1a-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1625659236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659236, "uuid": "5b2b2feb-b842-4ff4-9f7f-accf272492a0", "comment": "Malware payload (DiamondFox)", "value": "c65eae064ce5a26abb72dd304ecdf2e3", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659236, "uuid": "1decccc6-6387-4466-8f75-25b2f708b537", "comment": "Malware payload (DiamondFox)", "value": "bf86597d2d10ad8d82f0af8b53cf72757094322e79e92180092aa60341b90034", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659236, "uuid": "36bb91c2-e83e-463b-ad02-5a03601d2bab", "comment": "Malware payload (DiamondFox)", "value": "c196e6d2c701ce4669103ad2d82d23b08edb887e", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625659236, "uuid": "8560e87c-8588-4457-8fdd-9e4865e9053f", "comment": "Malware payload (DiamondFox)", "value": "9287d5efe16770dc9e6a7c5f13cffada612c0287b3ee8085f6f569adc180f18fa70991a3f347f6008d486829ef6595dc", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659236, "uuid": "5c7d9924-081b-4221-9203-a4161b6429f3", "value": "E71633906DD0D4B2D5771A755A796B22807DBC249F2CCAEF2364491EC932280B736BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659236, "uuid": "a61ce28e-033e-4263-8a2b-ca6781f2ee25", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659236, "uuid": "647501b3-7aff-423b-8c5d-2df28a6009ef", "value": "98304:UbnS1zX8GcizE4vTlNCoP0GjkyZ93mCJWtS:UTSF8GzooTlNF8GLj2CJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625659236, "uuid": "b56aeff0-f073-4d89-8a89-0a87c1be1e5f", "value": 4387292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625659236, "uuid": "5876b547-0319-4c36-bd1c-7885b226468f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625659236, "uuid": "d4e3e2df-24f2-410a-bbb2-30b6873aef47", "value": "C65EAE064CE5A26ABB72DD304ECDF2E3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7559763f-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625661606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661606, "uuid": "51b6d248-4444-45e8-a7ad-1d6d0a4e8aa6", "comment": "Malware payload (AgentTesla)", "value": "2e07efa71178f0d589464b1179c894f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661606, "uuid": "d9a1532e-6726-4470-9956-8a2e01483434", "comment": "Malware payload (AgentTesla)", "value": "c08e280570de9dc368e7fa90a6da1f047c059e70bff357ef99e4b3fac88b4b54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661606, "uuid": "15e20e92-cdc7-427a-a903-950b89b0b51f", "comment": "Malware payload (AgentTesla)", "value": "7b4113e2e4ae6e1d258042bd8b4be5792e52f2d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661606, "uuid": "f61a4f62-40a8-46c4-b3dd-f556b36829bc", "comment": "Malware payload (AgentTesla)", "value": "288ec17079343411354edcb57192961f0cfb6dd8a3b52ca1f48b1134525aa25ada4b9f2d6c4995e6223eb273dcdb6a93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661606, "uuid": "cf294185-8475-44a7-971d-6982065c7a66", "value": "B745DF7A20338A92CEAFC7F94775661E4F6DAFFE9047B6741884707800F0B5D4A6192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661606, "uuid": "14f6bed4-0bda-4dcb-85a8-e2e791ebd627", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661606, "uuid": "186d9670-53b3-4942-b524-23ae08562880", "value": "24576:epwQOq6wwtjvEYQGSpXZBJAwXXS0biYuWOBfWlB:eHDyEYOpXZBblbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661606, "uuid": "fdfa708b-f42e-4e56-83ba-19853d1a94ac", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661606, "uuid": "d6e8055a-6754-4900-9ee2-643a6edc6fbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661606, "uuid": "4504e870-a88f-4751-86ce-0a11b25a0f0f", "value": "NRPwo7uSCaLmXtV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcbf661-deb6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625616151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625616151, "uuid": "07fd935c-a0e9-47f6-baea-b6cdefa541ca", "comment": "Malware payload (Mirai)", "value": "7050b144682121499513cdbb4d61c89f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625616151, "uuid": "8755f2ef-dc0a-47f2-9798-43228b97ffb2", "comment": "Malware payload (Mirai)", "value": "c12ac09a22985fd9b6b298a0a6f876eaf6e3b40478b3238a3a4e6eed6ba700a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625616151, "uuid": "0a452ac9-63d8-4df2-947c-a2f310551362", "comment": "Malware payload (Mirai)", "value": "e66e2b94808608ee390f59a77ce9e6d252151c43", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625616151, "uuid": "8e4bf9c6-4f47-4252-8cd5-a65ce9bd2f58", "comment": "Malware payload (Mirai)", "value": "96777f591b67852918012a3dee0d043576a1336c72c849fc0eea530097b7108cbe10854238690706e105d9743a715e9f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625616151, "uuid": "71d79298-3a54-4904-8635-41eb54b612c7", "value": "6164F1CBEF11BC3AE944077125A70B5DB778DA9A82C3E090F2D4C55E3CA92C5BBA11D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625616151, "uuid": "5adcc103-3679-4a7a-84d2-5dd2bac7f34f", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioHa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSinPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625616151, "uuid": "29b26193-5b57-472b-aee1-e565eac03281", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625616151, "uuid": "dc24fb2e-930d-46f8-86ea-b270f2968e34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625616151, "uuid": "3cdd1fac-3df3-45cc-ad22-18feaa0aa92d", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbd397e-df53-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625683738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683738, "uuid": "765b9d3c-f69c-417b-8777-7cc09add65da", "comment": "Malware payload (Formbook)", "value": "c2a9f9afa108921e0ddbe5b4d116ef04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683738, "uuid": "6caf85f7-37e4-477f-a7a4-3ad874d3c96f", "comment": "Malware payload (Formbook)", "value": "c12e7acec0b72dcba1f25a432f95959c20c586ae278418c44f8aa610326fb34f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683738, "uuid": "f4b51937-5da7-4703-8161-7062640eace4", "comment": "Malware payload (Formbook)", "value": "f925def6deda55aed64d198157a0f78bc6ab4506", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683738, "uuid": "2baecbe1-c5bd-414f-97bd-989e9c6f75b4", "comment": "Malware payload (Formbook)", "value": "df3bc221f9656d3c1e75ae679c532b6cbf1cd4e2761ae20340b503f8ba5f1a591858262522c62da00fc665c9dcb6af04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683738, "uuid": "65f236b8-7877-4408-b190-87f353df1a89", "value": "T198842352BA7ECCB2D03639382C40B6548F9ACD115D96E8CA36983F4B78F17993D0583E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683738, "uuid": "77ecb9be-c5d0-400f-b44e-69d144f632e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683738, "uuid": "20793a16-2faa-4f00-83d0-2c090ed399b1", "value": "6144:9HsCk/bhng6tCdZAboD8+4DvEpLNFqpvj9tO+bqwhke/rLvf4EMLNIxCxLk:9MR1gVdUoD8+42LNFqXQlAH/DxCxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683738, "uuid": "f4ea645f-70e7-4634-8c19-4e9d8ce8af89", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683738, "uuid": "0b9585aa-53f1-4764-af3f-98041a89eb68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683738, "uuid": "b18465f9-3ad5-4a2e-81a3-97fc36593cdb", "value": "c2a9f9afa108921e0ddbe5b4d116ef04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387b78b7-df53-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683408, "uuid": "4fbb285b-e026-48ce-bf83-228b3e808c2c", "comment": "Malware payload", "value": "92a11f0dcb973d1a58d45c995993d854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683408, "uuid": "22568418-94d6-41a5-8ea9-62c5326d5cc6", "comment": "Malware payload", "value": "c13203272b03669a69689fe3e5e1432d2734da3b277f17af20d59bd9ca7d01b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683408, "uuid": "640c9eea-4d75-4291-bd06-c75a199121c8", "comment": "Malware payload", "value": "872fc1d91e078f0a274ca604785117beb261b870", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683408, "uuid": "998cf5d2-364b-4abc-9342-adcf05319e8c", "comment": "Malware payload", "value": "3e4e4dc576570d2872a13257269f274650be69ce85a2c4ecbf403e602c4f8a01e2807fa929278a38d631a13880856f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "WildPressure", "colour": "#DF1461", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683408, "uuid": "9bc1bea8-0255-463e-8425-e61f045b9c13", "value": "T1E5F5331BFC0829F3E6BB027A1C63E6BB787554378B256879CFCD8522D131B3B9128546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683408, "uuid": "7a39d8c6-ceee-4f97-840d-87ee677a4bc1", "value": "c8968748bf6183e3c66062912a824b6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683408, "uuid": "a7facbbc-d02d-4d4a-881f-ac2af57b5375", "value": "98304:i/O2NHKQOBOilnrqoeCEnQ5+QCvVHsmaJ:BvlrqTC9CvVM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683408, "uuid": "0fe30119-c311-4ffe-97a5-99a153bfde75", "value": 3415365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683408, "uuid": "04d811c5-ac69-4e4e-b56a-aed2d64aa30c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683408, "uuid": "d1174fae-01f4-4176-aa99-4db05ed5c34a", "value": "c13203272b03669a69689fe3e5e1432d2734da3b277f17af20d59bd9ca7d01b8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f780d824-ded7-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625630471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630471, "uuid": "45da7fed-da04-4d76-b7b4-0907369a34e7", "comment": "Malware payload (Hancitor)", "value": "e69349c3eb0bf6525cdcedf5cfebc0ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630471, "uuid": "87cb7932-b6e8-49dd-bb4a-912ec2580e0f", "comment": "Malware payload (Hancitor)", "value": "c15e72e486dc0dcca8d1394adc7d88ebba9da5e8f1a2a55c036982018df24e28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630471, "uuid": "9b8c7f67-9035-4d3b-969c-213f4e4022d2", "comment": "Malware payload (Hancitor)", "value": "0e283bec2da36115c180c414029d1c2854b960c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630471, "uuid": "f6774092-b760-48c1-b139-b7561cddf8bc", "comment": "Malware payload (Hancitor)", "value": "94274faa927d89eca3a2f3c23b70551c1d8cbb35077fd7bee3cc03be4d328424e37538e1e27826185b299576e11dbf11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630471, "uuid": "a46a35ec-20be-48a5-a41c-78747c0727f0", "value": "DB547C007940E570E6E322778F69E645437CB9200B619ACB33DC1A9F5F7B5E2663A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630471, "uuid": "b6191b2b-061e-44fe-810f-72f481118d6e", "value": "66ea5ae56a1ad0183ee81e788900c71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630471, "uuid": "dccc6010-1b62-47b1-bb98-0af1b6ead741", "value": "6144:FzU8/N+o/63h/1NcmZglxvDf7U9RG7yH+:mM+pAmWlhWQi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625630471, "uuid": "f9402aa8-7a7f-4668-81d2-eeada606c686", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625630471, "uuid": "aa9df171-9253-4473-bc64-44b3fb4d7d16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630471, "uuid": "e70bbb54-9d5a-42f2-9ed4-69fb83b174d7", "value": "nimb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3be8fb-df32-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625669268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669268, "uuid": "c3b99c2d-072c-4b0c-a9a3-87e451e9effb", "comment": "Malware payload (AgentTesla)", "value": "ce6c552a82b2f25757ae954dfab787ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669268, "uuid": "7f7bc37d-b072-4cee-a564-6e877c73971c", "comment": "Malware payload (AgentTesla)", "value": "c23a87b92c767faa2318b79b865e70e2c5d68b0e5f1917cae7633592a565e6d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669268, "uuid": "fae681fe-0bd4-4c69-80bc-fb6d31d1ae84", "comment": "Malware payload (AgentTesla)", "value": "f54f4f6710c522bd7e9be620f999e79dda2c2afc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669268, "uuid": "0681686b-e0fc-41ee-85e7-02b9a7cfd449", "comment": "Malware payload (AgentTesla)", "value": "ce0d01af5f1602bf8e0c61d7c9a17cbfd58634a017646e47f0c0e76d64e1fa8967faf61f92c82287c9b321a2a8c2837d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669268, "uuid": "5cb6da0b-2430-4bd8-a4be-c9268d2f7f45", "value": "5A83DA7DF1970A88CF8697B8171B2F42168CF51CF3D984B236A8DB3865C5D7A921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669268, "uuid": "84d6bf59-0dac-4795-9747-2985426bdb10", "value": "1536:nsGo/0duyBVaAYUtdngzmyPTpKzduhDwoVnjrKcZNOHfdg958:do/0duyBVaC9gzmyPMdubVn6eNOO9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669268, "uuid": "14b96eaa-ef46-423a-ac84-c95a2c80b11b", "value": 83715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669268, "uuid": "4df8bc54-e355-418e-917d-0e6015a092ee", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669268, "uuid": "24120fc7-981c-45fd-9040-b30bfa708ca8", "value": "invoice and payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80c2ec1-df18-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625658363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625658363, "uuid": "b81fc697-885e-4473-9a7f-84ce9294fa0d", "comment": "Malware payload (DCRat)", "value": "be5be85af4ddc5c71bdcb5ab8bd3c67d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625658363, "uuid": "cfe00d6f-1cce-4e0d-8950-5225ee7361c2", "comment": "Malware payload (DCRat)", "value": "c37b9479b2968218e9019296f1069b7ef6cc65abeb2b48cb34ac682a2c8c736e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625658363, "uuid": "58238dd2-5aee-4222-9b9c-dfa257023f3e", "comment": "Malware payload (DCRat)", "value": "e91aaada6ded0c902a43f64c6d71f37e53b02531", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625658363, "uuid": "c557e078-ab0d-4cf1-8780-39edb744d71a", "comment": "Malware payload (DCRat)", "value": "568b2ce3b68bdb23ce328335e0efec6e89757d0d42a17a955ea823e49c34ffcd1aa31b69dfe88ece775fd19db6c331f1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625658363, "uuid": "46f59fce-936c-4592-abd1-04a67a9fd8c6", "value": "B464128473E681C6E42280F08D62ED3CB8EEF8ADD1E45625FCE27B7514A55814E2E31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625658363, "uuid": "842f4486-9da6-43c1-89d3-ab49fe275703", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625658363, "uuid": "8b6b22f7-00e4-4022-8cf7-f678dbd0e190", "value": "6144:4V28oKd5ATFT0GmsAZLLm1Ht5gk9uCo+/khxZK7oPkDFvoSiJFxX:4oE76FT7sZLLmv5oJ+QKCqvoSiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625658363, "uuid": "50bd6d0f-5055-4a99-a9f0-e119dc504153", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625658363, "uuid": "a90bcec2-7658-4867-b380-3c4019945347", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625658363, "uuid": "8e7bd9b4-68c5-4856-aa05-c3580c5084cc", "value": "be5be85af4ddc5c71bdcb5ab8bd3c67d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1be23f-df22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625662607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662607, "uuid": "d725b8eb-3709-45b6-9e00-d7565052d4b9", "comment": "Malware payload (AgentTesla)", "value": "806407c29c6ee1cc66a58303fe136c79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662607, "uuid": "b288ca4b-08ae-4497-b1e7-92b229c1daec", "comment": "Malware payload (AgentTesla)", "value": "c4a79dbc00e46e6c14993a6a86a2bd15fde5be993cadfd01df70e7997b27ea3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662607, "uuid": "3bd08288-2642-4bf4-b2f0-799615e730a9", "comment": "Malware payload (AgentTesla)", "value": "009e5f0d031712beae34defbd4721d95f1f1cf4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662607, "uuid": "f535d4a3-115e-42f9-9528-3531c59479b5", "comment": "Malware payload (AgentTesla)", "value": "49b9774dfcf4d86f1fb87766d3279313b12088e8b4a451f84d48ec9e5824a61ce6f7b44f933ac27433920c7160e59e5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662607, "uuid": "b300d826-bb5e-4318-b820-7490ee3ea2df", "value": "FD45BEB960338A92DEAFC7FA0730655E4F6DAFFE904BB2741844B47500F4B4D4AA1927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662607, "uuid": "fa0124f7-e985-4581-99de-e1da4f14dfae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662607, "uuid": "14fadeb1-62bd-4ca8-9beb-03ebbf01b86d", "value": "24576:JJ+Hkki85pQXUPbp5tF9EEGA7ZfpvO0biYuWOBfWlB:JJki8UkPXGEG8Z/biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662607, "uuid": "79234ad0-ca13-4692-bda9-d06ec10e578c", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662607, "uuid": "362f0655-2708-4386-bd87-8ba1e5911481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662607, "uuid": "169df848-cfcb-4f6f-8127-6773d2613fa2", "value": "swift copy pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19f04ba-defe-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625647212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647212, "uuid": "068183d2-0a30-479c-9d5d-499a4e4ac1ad", "comment": "Malware payload (Gozi)", "value": "fceb6a51be4205d11be1491f6e263cae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647212, "uuid": "bcfc12bd-2ef4-4a60-80f6-3fef15d1add0", "comment": "Malware payload (Gozi)", "value": "c521dd937ce9b2e8bda2fa915bae5b5be0e150a8b82e3b2bfb1cdbc60a8326c4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647212, "uuid": "7a31c452-c419-4572-9ba1-b780e8009cd8", "comment": "Malware payload (Gozi)", "value": "0abb60d37fac49912172c5385ff58e049520eb53", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647212, "uuid": "d731334b-f2e4-4153-90e7-4ec944d20f1f", "comment": "Malware payload (Gozi)", "value": "cce450e0a1209e9ee5cd8f9d11853bc37323c56a0d48439a67be6363c9fc1e09094fb6e02f7862721f6da0ee0241ef6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647212, "uuid": "57bb5a08-9e5a-4da3-9574-fa8279a9e18a", "value": "142412DAEBA5C551C6F7213C025768A288887D43A9FFF06DFD0990A7AF01E2C90274D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647212, "uuid": "032149e4-b0d2-4aa2-9cc0-77fbc211ab14", "value": "ea5307b4a63215686c0cdc83cff5fcba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647212, "uuid": "cbaaf744-2456-42ee-87b4-5e06a21b57c9", "value": "3072:Ndmt0uTpBxy1mXhKvuE3GThWccntEvAJjHPLpvLHMwsJyV/vl5PX8J/g9vN:N85ykhKWE3UhwmMjjpvjMwskD5f8JsvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647212, "uuid": "6e78268b-ec71-42ca-bfb3-5259d482e2c1", "value": 227342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647212, "uuid": "77fff14b-d52e-4475-a8ae-a73b9ab21b97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647212, "uuid": "08fd0950-2b2f-4eba-bdfc-f2eb3dc5df75", "value": "5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6387a557-defa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625645255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645255, "uuid": "459ecb29-1213-4094-a3fb-bae591308c38", "comment": "Malware payload", "value": "5f46303184d0f575dfc08f1bd71d9de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645255, "uuid": "c20b364c-1f14-43f1-98bc-2c598045bed0", "comment": "Malware payload", "value": "c69cbe7e4c2355f9d12f32761b8d1736b45179865eea58da540310c7d7b78c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645255, "uuid": "f75877cb-70cd-4e27-9cb1-f42c7b347306", "comment": "Malware payload", "value": "c42fa43deddcc6039e9b836abda4eae06d5b9af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625645255, "uuid": "6fde8fea-5f15-4223-b384-c1b62b772793", "comment": "Malware payload", "value": "f5a5713cc1941a27ee1ad91d73d7131eaf44e89573465453cde8223861b86c2c79bd4f0b1550a90737f3acf55e7a5d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645255, "uuid": "ab5089e9-b7c4-45d5-b26e-6c28a5d09572", "value": "E914D15076C2CCF0F4A319360CF5E37F5F3E79128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645255, "uuid": "4b274ec6-db25-4f18-b942-cdc9bb356655", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645255, "uuid": "2ed20d75-7ce9-4607-ac0f-a45dd36b8189", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjLpYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjOfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625645255, "uuid": "1bbe8380-b076-47dc-a6c3-c8c0dbd718ef", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625645255, "uuid": "6bfc1155-ba7a-4814-bb40-6be27dd1efdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625645255, "uuid": "0adf2851-ad26-4006-af5f-75db44165fcb", "value": "http___193.235.207.70_images_blackmoon.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7ea12f-decc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625351, "uuid": "172a64dd-517e-4d57-a47d-5352c2cac45c", "comment": "Malware payload (Mirai)", "value": "4d950f96a9ee54092c1dea2a2fb272be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625351, "uuid": "e17b0a07-b746-4fd6-abf8-e22e4396fe51", "comment": "Malware payload (Mirai)", "value": "c83e05300d842dcdb889c5d9331db0e7b34ab684d329001ef31ddc61a5821259", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625351, "uuid": "2776312e-3311-4c19-a2a4-bf1b36a78dd9", "comment": "Malware payload (Mirai)", "value": "47b960a20fb87c46bfbf5d0815d96ca4da5267b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625351, "uuid": "332b5ea6-c4d1-4152-a7df-1fe4558b388f", "comment": "Malware payload (Mirai)", "value": "459eda23489e91f8b9ee2c3f73046b2edb0617faa17d4ce222020eecac1f89eb7ee310bcaf7eaa7f056ef7b9b88dab07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625351, "uuid": "a3a6242b-d18d-4e09-946f-f924f227893e", "value": "14C2DF306EC8B9B0C3B6D8B8DB9C6111F3035766A4EA631700115A64949B58F7BFCEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625351, "uuid": "6274c65d-5900-42ed-a6fc-b37acaaa198d", "value": "768:SL7GgFP0x2J8ER4AIQYh8HM3Oy81eBges3Uoz9Gz:m+x2Jz4YHM+y81e6DzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625351, "uuid": "66559a30-a53b-4355-a164-146e7b844a06", "value": 28232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625351, "uuid": "2955e8b0-fe5f-454c-a00b-59cb60354368", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625351, "uuid": "7f53225b-a943-458f-a211-b748ba320a68", "value": "4d950f96a9ee54092c1dea2a2fb272be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9672bf8e-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625637610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637610, "uuid": "263a409d-7b14-46b0-8e52-05ad1bb9dc55", "comment": "Malware payload", "value": "3bf0546df20c3f3dbf1bf289cc6c8a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637610, "uuid": "344af3b3-be9e-4135-9a0e-dea51dab6d83", "comment": "Malware payload", "value": "c874896fe1cacb9b8ec6a8c773b22f978ef832d5713b1e07217023922ce6b2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637610, "uuid": "b5c622fb-8ece-450a-8a27-61224d021dc7", "comment": "Malware payload", "value": "30cfdd932f1ac01de6a273311564f596b5441a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637610, "uuid": "05c82800-21df-477f-9336-ccf46810ab87", "comment": "Malware payload", "value": "2c74aa4d0d456403a9af210b1d34e1fe3da1a2084bf97f09eb191d573cae35d30183c6cf1d9bb47f2c4fac5bb97d38ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637610, "uuid": "cd2ee406-a86c-462a-aa8f-60782d33f1e5", "value": "2CF39D513E91C432D4A605305835C3A06A7BBC72E9768A4BF358FB6E5E332D1A6F6307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637610, "uuid": "d93b6677-95cb-46ab-b406-b53c02e2c563", "value": "1032a46fd4e2ff5ee27353305df6f8f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637610, "uuid": "8b7ee51d-d121-4010-b6af-ca368a138464", "value": "1536:uerno8FbTts71kSFInLprj1TMj0q7kIqsGRTPK5pJ5waaaaaaaW4uHOsxfs6Okby:ucbzOMLnIk3sGRYJ5exLOkmTIOkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637610, "uuid": "9b8299f7-5f2e-4201-b417-6163261ba146", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637610, "uuid": "792dce0f-aec3-4ac6-b967-3728ce1746f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637610, "uuid": "1daeed35-2f61-46e6-a23a-031e386fc70d", "value": "3bf0546df20c3f3dbf1bf289cc6c8a32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde5fc9a-dee6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625636817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636817, "uuid": "775a0c7b-e0d0-4009-b125-6cb6dd5ff888", "comment": "Malware payload (SnakeKeylogger)", "value": "5b3f3d094c10b6aac465b3f6a7a6899a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636817, "uuid": "1be059ef-f4a3-4cea-a7b5-19da96fd8533", "comment": "Malware payload (SnakeKeylogger)", "value": "c8b2192f933e3b3124abbf20d43e8de51cfceea1469ef40413d3fc83d98c8d03", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636817, "uuid": "be3cd93c-35f9-437e-9282-f15c8678e72d", "comment": "Malware payload (SnakeKeylogger)", "value": "513f0295291ef1640fc5ead9379ba8cde19200c3", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636817, "uuid": "792c897f-5149-4722-b6fd-897e8aaf02f1", "comment": "Malware payload (SnakeKeylogger)", "value": "acb0e2d06398cc4b05628962b576c799d0dd04183ad36fe2a03f2d25c1da896db88dac6598fe0554a7393ef3a0151300", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636817, "uuid": "cb6e52f3-7bcd-42be-b37c-51c43800e2ba", "value": "0EB423693B41C22B7FDABE0F4607202D294995F3D7B942BA01406992D7EF2DD35F2E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636817, "uuid": "25cf4a5f-7af2-48cf-9527-bf9639cd6ffa", "value": "6144:Egi7Ogy3LKxMVoA08OsyHNsk/i+ycojqSRPF2RuWUJilolg/A2sCUsojDmdpvk2A:W8oA5yHNsX+dRtUJilVsHE/HixN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636817, "uuid": "5dd108e6-853f-4e4f-8c84-7006b5112d0b", "value": 532409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636817, "uuid": "52ceca9b-d1c0-4ff9-be79-618c2fedaa45", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636817, "uuid": "4b231b77-cdcd-4fff-b5cd-7eda7a47a143", "value": "Payment Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e784b42-decc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625597, "uuid": "9cea9bac-0cbf-49ea-9295-0cec1c201419", "comment": "Malware payload (Mirai)", "value": "1b3f92116d573958a5eb6602a7b953f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625597, "uuid": "40cb3b2e-5972-4e34-a21d-c6eb28d009ab", "comment": "Malware payload (Mirai)", "value": "c8b88ba02ccc22d9948e59d62174b07e74f06f3fc2506035ba1da716d14e10ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625597, "uuid": "3ee0d102-1c71-43f0-8850-5baffadcdcb9", "comment": "Malware payload (Mirai)", "value": "c41c741a401d0d39759013deedd84a0d1c16aa8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625597, "uuid": "d71fe689-16d9-4f65-9f2e-a6d288edbb62", "comment": "Malware payload (Mirai)", "value": "c310302fe082ef70850fef3a5da8319a431adc6689f2a21bd409cf1e5e4a8cf56278c1596cb7e661fe1d2b473e6f5406", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625597, "uuid": "2a253876-59bd-4d86-b34d-e10b42c0efa3", "value": "9ED2E1B4D5204A87EBBBDEB1DCC1C1A177E01F0A7BA642E261A7EE3147071477128DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625597, "uuid": "e6b6139c-e0a1-42a8-a7ed-4c2ba5e63c98", "value": "768:TbA9JpZrXVBnr8kw94UIwotDwW/ijyy4uVcqgw093:HA9bZrlBr8kw944ZVjyy4u+qgw093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625597, "uuid": "e0f64eff-ed3c-4203-8277-8a13978ef223", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625597, "uuid": "4c12be89-7d06-4e04-bc59-8d7ec811677f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625597, "uuid": "310dc920-c3d6-4a6f-b91c-993e29242e9e", "value": "1b3f92116d573958a5eb6602a7b953f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc663bb7-df53-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625683683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683683, "uuid": "67cf26c7-86b4-4258-90f9-a626066900ff", "comment": "Malware payload (BazaLoader)", "value": "7c8cc8001a343ce62d261f34b1630abc", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683683, "uuid": "4f687914-6487-40e4-a65e-35bab7fbadcb", "comment": "Malware payload (BazaLoader)", "value": "c96712411982bc3a66b5bbf1a777c7b944dccb49c1bbedc57087d7897713a579", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683683, "uuid": "81dfbf73-c788-403d-8ee4-afa648def8fa", "comment": "Malware payload (BazaLoader)", "value": "01192281be4f75838b7c2712a4e8aa2e9fabc0ad", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683683, "uuid": "06892602-c72b-4634-b7f3-b81d2ae5598f", "comment": "Malware payload (BazaLoader)", "value": "26143d8c8aac6b345930996116e61a830635669b2a8215a1b408617bd7726c9c76d9273bd4d0ccfcb8072ff651528974", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683683, "uuid": "570eb1cd-3a25-4d79-babc-7ad5f854e352", "value": "T1AA14D15076C2CCF0F4A319360CF5E37F5F3E75128A10CEA7D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683683, "uuid": "39d9b362-8f1a-4f76-a142-c490958adced", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683683, "uuid": "8148d77a-6cfd-4072-873e-8ada81de3099", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjopYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjjfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683683, "uuid": "9eeca0f4-1c3c-45e8-a92d-269f7accf32d", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683683, "uuid": "3c30edef-0797-4c07-a202-f3dc4d816006", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683683, "uuid": "de3408c4-ee9a-41c8-a643-f3dc6bc245ea", "value": "7c8cc8001a343ce62d261f34b1630abc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03af44df-decc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625338, "uuid": "250f3df4-2970-49b0-9544-34d17c5d222f", "comment": "Malware payload (Mirai)", "value": "6c46715169aabdc12b219e8fe6d38196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625338, "uuid": "9ef07fa8-ffce-44e5-891e-3279d28372d0", "comment": "Malware payload (Mirai)", "value": "ca42f840411d38440f733948e4b51195a008a00a1f8756dc7f63e02b230c4127", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625338, "uuid": "ab091a64-c39b-45a1-8ab5-9061403699e2", "comment": "Malware payload (Mirai)", "value": "3ce6bb6de3f062c9765b461bfca4e2419d142ad4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625338, "uuid": "ad452c2e-c5bd-42fc-8a53-cda95fcb8458", "comment": "Malware payload (Mirai)", "value": "131e69ba0cf46c30adfb047171f3f2f93ac778dc0825ea36f80985f5fc3a40132801e9e1efe840cb2a9ed603a8c73b9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625338, "uuid": "ae7bff54-2329-464a-992e-86a0bcbebd25", "value": "1EE2E0B4E725AC70E5B00C37CDBFA6E759511E38D0FA3B16080C4699D22B2CA7935AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625338, "uuid": "c918d434-584c-496c-a42f-7fc3d9730efc", "value": "768:OL6y1JlHo+YXU1IxDqxNvkQC/oKfd2B9x16jNbJxwnsts3UozI:Ch5uhDqvvkX/oKsduazI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625338, "uuid": "6187fd03-92ce-4ba3-a9d1-9053e46c89b0", "value": 32016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625338, "uuid": "124c045f-bbdb-41fe-a16b-1b512d3c0295", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625338, "uuid": "6653a1fc-ab6c-4040-8209-0d01d0b67001", "value": "6c46715169aabdc12b219e8fe6d38196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9e7497-df53-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683742, "uuid": "928c28a9-6782-4781-8eb1-7e357a4e8bea", "comment": "Malware payload", "value": "0a696696f5ba6bc4a05a20ccddc03781", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683742, "uuid": "20cbbe9b-d7bb-415b-871b-d4a310f46928", "comment": "Malware payload", "value": "cb2db26b2423d7f15015b5476a6ae8768f8ce3fe99dfbcfa590c512688955a5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683742, "uuid": "9aff356c-c458-4ab5-a6b4-97c1306790cc", "comment": "Malware payload", "value": "5348642459e603eabc8649bc234ac7829d22c3cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683742, "uuid": "55a7e0a5-5079-4d1c-a2bc-40424291631c", "comment": "Malware payload", "value": "ec94f2dcecc89f1024dad27306fe0073d469075bda885da288514f74cf14b7011d5f04489245bb8956ee58e21dceda0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683742, "uuid": "0f9a9a27-f368-45ba-866e-91108eeec67f", "value": "T1299423182B2BC131E0587CF61C4290B1827DAD569C43AE5FA8867F2FF6B739446449FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683742, "uuid": "8aa7d0d8-5b83-41c5-9259-d08e15cd67a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683742, "uuid": "dd1df385-9c53-4fef-b67a-8c305eb0eb02", "value": "6144:gtn8roiSDADilK15NgdGVIEXo1TgLPUB0rVT0duFs4ucn2ul7lKp:gt80/DA+8rCGdXRPG0hT0duhNlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683742, "uuid": "1a18001b-56dd-4b3c-ab07-babf30c0551b", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683742, "uuid": "ecc95ae6-fb9e-4613-9fe8-0db5a650ae85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683742, "uuid": "6e52bc3c-9ef3-4868-b679-7d6277a49d3a", "value": "0a696696f5ba6bc4a05a20ccddc03781", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b25665-dee7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625637177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637177, "uuid": "75abb664-0283-4ba4-98dd-11f84f1d668e", "comment": "Malware payload (AgentTesla)", "value": "c2c553a525bbd44204667c033bcf03ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637177, "uuid": "b2cb37d8-75d5-4715-949e-b1e0dc470b9d", "comment": "Malware payload (AgentTesla)", "value": "cc2b2d64e3e70d9bf394caa50bc369daaacd7552f1e7d04ee74c3616ba6804f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637177, "uuid": "aed03107-453a-419d-b8f8-36d8cd38c625", "comment": "Malware payload (AgentTesla)", "value": "9681f346208091c97f7bd7c5f319b87f0643ac20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637177, "uuid": "0da103d8-2ac8-4c86-9b0c-ea0debf5d016", "comment": "Malware payload (AgentTesla)", "value": "d6f10ea7e1f272a4ca8c3cdf000606b1279832010986124d264a6e8cf9174015e95185079b9879ad7ab676d208ae2d5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637177, "uuid": "d3423930-272d-4ced-b547-b03dff38b84a", "value": "28F45A983312719EF417C832B957DCF0E6207E664A0B920390D73F9BB91E5D6CF950AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637177, "uuid": "0b325cfd-ca8a-4bab-8308-d2d258694d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637177, "uuid": "408ab93f-2567-47f2-882d-f5f1909deaa7", "value": "12288:/VFwodX8/l1N2zenZZdxQEGRu4h9xz+jNWfRFp0WlrOJ2EYTHNLmBJxtRz46WB2v:/bwGXe18zzTXijsf3pPlVHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637177, "uuid": "2919673c-e808-4adf-ba74-b187e9af137f", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637177, "uuid": "45fea3ab-e3d6-4f34-9226-2ace11915b91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637177, "uuid": "ef1d7b0e-adba-4788-91ff-1539e7739f27", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.20886.31080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebac8abe-dee9-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625638182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625638182, "uuid": "542e34d4-52fe-4ca1-80b7-8e6b8af03a0f", "comment": "Malware payload (DarkVNC)", "value": "b57cc379d667b09b7236e865061c8807", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625638182, "uuid": "90c218a9-802f-44c4-8196-ad20f7c854ae", "comment": "Malware payload (DarkVNC)", "value": "cd1f82c58a1ec2af80088987370226ea1d252d734b61fc9cdb2267fc0eb20540", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625638182, "uuid": "41995d35-97d4-4931-b89a-f0909cb8e005", "comment": "Malware payload (DarkVNC)", "value": "05455fb191c0511de97fb6ba85cfcf5bf42539de", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625638182, "uuid": "d6c80386-c156-4b1c-ba32-3665b10d6418", "comment": "Malware payload (DarkVNC)", "value": "6eb55f585e8ff10b7c4c1b68ba08940889cd286865898675ed4dcaa5b35a506e9cda975188f818ac644f481a9d4a2144", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625638182, "uuid": "9b10c4cf-5bc4-4eed-a743-3940ce192127", "value": "DA2523F03E81C473D04B09B0D835C3E2AAF6B8266937A906FA69375E5D3328595F6707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625638182, "uuid": "2e74c0f2-0ffc-4997-9d55-984f8f3c5732", "value": "7af39671cc2eb22da7e1e0036bba5fc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625638182, "uuid": "e0e2fbf5-625a-45bb-a86e-422e50e0c1ff", "value": "24576:XA8M1M/aO2e/xtGe6hCf7ahZrZjtj6y1Q9D+RFx:vM2/rp/DGEahZrZBj71Q4RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625638182, "uuid": "14bec3fd-6319-46ae-9e24-09411793a524", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625638182, "uuid": "a36f8f4f-bd36-41e3-bf55-5a4dc239a0ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625638182, "uuid": "a0531909-dd78-4ba7-80f0-0328d55ef62a", "value": "b57cc379d667b09b7236e865061c8807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9795d27d-dee7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625637182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637182, "uuid": "41e1b1fb-7889-44d9-8c00-38f697da2c0a", "comment": "Malware payload (SnakeKeylogger)", "value": "3a54b966538bd4a0f750db2aa38bfe3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637182, "uuid": "23e3eaf4-d7f7-4971-aee5-4f9c55a933df", "comment": "Malware payload (SnakeKeylogger)", "value": "cd1fd75a5fede73a1929bd8fdfe922521d379ab47db28bdbfaab0d390f633413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637182, "uuid": "e3785aa4-b59b-41b1-b8a7-db667d75528f", "comment": "Malware payload (SnakeKeylogger)", "value": "ca84d2bf9f0ea7bc9ba3cd2aeebf16d555b83fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637182, "uuid": "4949af5a-2d3e-4e39-8fdf-a2fddefa693d", "comment": "Malware payload (SnakeKeylogger)", "value": "29db110f484fbdf24629766c06a3fefe00ea706ee5053097dbf10a8a859ff0cbfa9b988babacd82a7a00188f52526270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637182, "uuid": "98f773ae-75a0-46bd-b20f-e69221cd6117", "value": "87D439983312709EF4168836B956DCF0EA107E665B0B820390D73F9FB91F5D6CF950AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637182, "uuid": "7ff538a3-50f7-4a2f-9541-a4717827418e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637182, "uuid": "271ff3f1-21f6-47c1-86f1-008eec0dfd9d", "value": "12288:2WBprGgAEyDQRZIZLIff1ccUS0fmlgg9J8+gPdNRTqZB4d0Sj:tBpiFtDQ0aff1PUS0fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637182, "uuid": "a4e11baf-0d21-4acd-895b-a293e8afd005", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637182, "uuid": "4ac9481d-3598-4444-b4bf-7c7da62eb058", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637182, "uuid": "9439e8a6-950b-431b-9cf7-26d18de2aeba", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.9623.31722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2786307-dee7-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625637281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637281, "uuid": "3455167e-4453-4a5f-9c46-d95ec7179f3d", "comment": "Malware payload (SystemBC)", "value": "20898d2a1ca2b9ceb0953c7a2cc4e0a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637281, "uuid": "c0e34658-218f-4fd6-90d4-0ced0eb0b469", "comment": "Malware payload (SystemBC)", "value": "cd6cca6f8ad176e1c42b19ad7b7d0c8fb2cb7735b4319fc14f868445affa0236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637281, "uuid": "45ab9fcc-afa6-4fcc-afc6-426e8d6a35e6", "comment": "Malware payload (SystemBC)", "value": "af0a15dd380ce076cdce5374e38d4739cc2de332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637281, "uuid": "f529c123-3ef9-4f1f-b69a-8c017de25ab0", "comment": "Malware payload (SystemBC)", "value": "f31e814ae36a0bde301b2428331c37a4200acd94f2aea809550beaf6ea1e306b87cab741ab1e1ab79b2a48c9d204c2f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637281, "uuid": "ab3984ec-3cfe-4b3e-8866-6423c17fe53e", "value": "71847E36F6D08437D2732678DC5B52989C39BE503E2D58472FD82E4C5F39B813AA6293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637281, "uuid": "d78b7f3b-d5f9-4d2e-bea2-e9a2e76822d1", "value": "99330628a6833d5db21e94c072c86e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637281, "uuid": "770a5fd1-23dd-4c49-9cff-e93bd5921c6a", "value": "12288:l7YLXsOq4s8Nzb8TiDxgBtM7+PRCE0/1tsN9kqpAnk096g4:KrsONNX8TiDxgBtMi0E0/1tsN9kqpHUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637281, "uuid": "dd0811ea-c891-491a-84f7-eddf5aae1fee", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637281, "uuid": "fdfcf2e8-6e1b-40d5-915a-2f26a4077761", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637281, "uuid": "0be00961-02c5-49eb-aa2c-389e6f306105", "value": "20898d2a1ca2b9ceb0953c7a2cc4e0a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15df01a-df1c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660069, "uuid": "1aea9733-d0a3-4694-8ab9-2d0aa65a0474", "comment": "Malware payload (AgentTesla)", "value": "6181b5d4ad9c8084baf365f03c8240f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660069, "uuid": "421eb47a-2057-481a-aa2c-d9230d43bb8f", "comment": "Malware payload (AgentTesla)", "value": "cec7b1dd6baab6a939ae1c069a7f57a5a1a5acbfe026c5ed3ceef19b905bdbab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660069, "uuid": "bdc9e64a-1f21-4188-b6e6-ced0d7ede43f", "comment": "Malware payload (AgentTesla)", "value": "6c5478b38fd4934fe2a40fedefb603b84c325c7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660069, "uuid": "0fd73f99-c3ae-4322-92db-989d963672f4", "comment": "Malware payload (AgentTesla)", "value": "dc1066ba21626b29fe4becb5ccd715f2be82cfadbb6ca6520707ff4472b2d00a932cf7646637073d52e2e4dca12b6389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660069, "uuid": "b7779497-bc32-43da-bfa7-c7e25f64822c", "value": "BA2533818D4E91F16854A3DAAA0B4AB1D2805FBBFFDFF0BB08E3962B10CD915758055F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660069, "uuid": "be71004c-5bb2-4946-a15b-05c345f6d436", "value": "24576:hQaA9iqW75Pe20qm/o9ebsfZzniEQLJSHR/RBI5I:aaGCPL0qm/okAzVXI5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660069, "uuid": "239dd680-93ce-464f-821b-bdfc43ecab64", "value": 1027556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660069, "uuid": "fac819d9-0e44-48a7-ae50-d1202f826c27", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660069, "uuid": "9daa21b4-32e5-4347-8993-e9c8ca628c9d", "value": "swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb18501-df7c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625701050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701050, "uuid": "5ea95986-0af3-4ff2-abbc-e332f8e5f064", "comment": "Malware payload", "value": "69726e759244b12617db6a7a18ce7cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701050, "uuid": "11d64066-69a7-4d44-86b1-dc1ebf1772bb", "comment": "Malware payload", "value": "cedfe7cc438b97be97ed3e6b6e4dc77dea2dc7616a600a47793f9852d42dc65e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701050, "uuid": "df0dbd04-0923-4f87-a0b8-5a4087854ffc", "comment": "Malware payload", "value": "3bb73ef4202f95925e62ec360666e67122f70164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625701050, "uuid": "976f4b50-e451-4b06-9d6c-6db92cc6bf60", "comment": "Malware payload", "value": "d1e187bd833a2b37cd88a9f515c76419c91ae48f4ef5b68544dce738058950d72e635964080389d563dfe9fa8a3c671a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701050, "uuid": "28102b0c-35ac-4be1-b9e8-1dc0eb2152d5", "value": "T1FBD63380CDF6DDD5FF09013C8A46A1F680D3BF5149248E6AD61673EAADB05C6788DBB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701050, "uuid": "a703f96e-f19a-4bd3-a661-f7cc0daf5251", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701050, "uuid": "a42c8776-86a3-4420-a9af-84a6162970dc", "value": "196608:PnXDxDglatEWWxeIG47PJoi4Oztp4D94g5CkbjI3kOiHSMQr/q+7BfNDZyz98Wxx:PnTmPk1Ez4D94g5FE0Oihyq+9jyaut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625701050, "uuid": "9ed1dd94-64e4-47ed-b1a3-5d8738404779", "value": 13096446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625701050, "uuid": "ca67d907-b54a-48b4-ae1b-65bf4ee5cee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625701050, "uuid": "706820ff-9ce7-4978-ac27-c96aff73cc58", "value": "SecuriteInfo.com.Trojan.Wdfload.508.27422.507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b11134a-df52-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683010, "uuid": "177b868b-7c0f-4162-8cca-e8a3157e9c41", "comment": "Malware payload", "value": "a4e97c3baa850ef56942a0dd40c9bd83", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683010, "uuid": "12335f7b-cbe5-45a5-a111-30e438bf08c8", "comment": "Malware payload", "value": "cf14b14227edbcb33555c665434d671ebbf4152711a227c185103a00b3aa6eae", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683010, "uuid": "b9e13b0f-6d57-4cc8-b028-c67c30fc5208", "comment": "Malware payload", "value": "4e64d88f96aa8eb52e049019b949b038cac0ac26", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683010, "uuid": "d01bd36d-d698-4fb5-a32e-66d4cca03441", "comment": "Malware payload", "value": "c24d1a2122cdd11fa0aecdc066a36f69793b46d3caa30c567a5f812ceadb73b87d5bae247df635d67179121d1c4c0060", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683010, "uuid": "691c1c4d-b74a-4350-89fa-6223c0807c12", "value": "T15D6394003381D126E0669A72CCEBD7EE7B75BD40EE25432B31D5731F2D796A09F26241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683010, "uuid": "eeb1827f-4611-494b-a146-8273f274703b", "value": "384:WiCxI+jFCaU7e4iHWDD7KeL7ah28hclFo39D:atB6hK526cjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683010, "uuid": "25dca965-46db-448e-bcc7-88ac675e0776", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683010, "uuid": "9e019264-61de-4233-8a80-c5b4173a6562", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683010, "uuid": "b785d4fd-d2ec-4bad-87a6-70081ca9a559", "value": "SecuriteInfo.com.VB.Trojan.Valyria.4923.9053.27019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132025d9-df4f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625681628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681628, "uuid": "8e90ae58-afff-4221-8b60-4bcc19b62131", "comment": "Malware payload (SnakeKeylogger)", "value": "73dbcf2a2e431b3a7ed84228153e900a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681628, "uuid": "26a9f885-5d48-41be-a0c4-969d886670fe", "comment": "Malware payload (SnakeKeylogger)", "value": "cfda2a790152c5b0be42dfdefb8ef21faaada6a88f143e1cf996e4a83e9a7237", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681628, "uuid": "c6a69efd-4fd6-49c5-bbd9-e7cbc81e6e45", "comment": "Malware payload (SnakeKeylogger)", "value": "0211b11b98033ff523c1a24dd4d9e46ef6d67e74", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625681628, "uuid": "d0e50b0a-828c-4b29-b117-c288f956311f", "comment": "Malware payload (SnakeKeylogger)", "value": "39418957ecdffd77ed9b4e7e0d6480d95c0504fe8d2d4265517cb7df5ff515d587924b7925153a85b09570a3d5199cce", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681628, "uuid": "8646386f-52dc-4b57-a73e-9038ab43968c", "value": "T1FC128F91F5679D2EC307DA7A50823D13DA06395241177D4E7AB0DF4C9E322E3465AB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681628, "uuid": "4edc4924-37b3-4b1f-8cf1-ab5cfb3b8880", "value": "192:oJqoFNoQBsRdhvI7kVJHR54qBq9Yaj7jplVyP:oJXNogsS7ap/JInj7JyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625681628, "uuid": "e2ec4fd4-b138-4874-8356-d4843e312914", "value": 9113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625681628, "uuid": "99602337-2bd0-439c-a4d7-d7d2a6650703", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625681628, "uuid": "64202e28-e227-4b55-8267-ecc7576e1003", "value": "01130100370.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d26e3b-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625672962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672962, "uuid": "bf5ea3a0-06b7-4c49-8953-4db4b229c74b", "comment": "Malware payload (RedLineStealer)", "value": "1af9f67ad6b43cf7836908005bba72da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672962, "uuid": "a4b97601-a7ca-4903-a935-cef02116e007", "comment": "Malware payload (RedLineStealer)", "value": "d1393748b163640113850583346ee301192def81a399142aa276691eecd4314a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672962, "uuid": "c6aa08f9-8592-4ccf-87b1-6675306f814f", "comment": "Malware payload (RedLineStealer)", "value": "cc27d1eb13d3d12f87f6a60c58b72a4016be5ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672962, "uuid": "f0c71aab-57e0-4c46-8a59-d938208e0cbc", "comment": "Malware payload (RedLineStealer)", "value": "fee15d7e8d7e72383c4dd6ceae985fa2c0e641b543f30f23afd7baae9305adb6a0373df2826558dd20c3aed4b035a8fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672962, "uuid": "6e03c0af-6e30-4683-baaa-8de978eeb68a", "value": "T170F4E010B692C035F5F726F498B99268653EBAB15F2851CBF2C466EE1B352E49CF0307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672962, "uuid": "2994135c-8080-4541-a7e2-53a4890ad9b5", "value": "1e8c0f829b104b9959a084b4dd191d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672962, "uuid": "17736ed8-3467-4133-9f36-f02fcf036ae9", "value": "12288:eiwDmBrLjISkoEMlPGfLRR0PM2AO/ATPiQRbRwK9aPwARsK0yzyCe/:IDWZEEGfLwP0WQRC4aIAqKrFe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672962, "uuid": "e137f296-c40e-4161-a725-1a337cb259e4", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672962, "uuid": "7bbdef6d-bc7e-4af4-998c-29710d746338", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672962, "uuid": "6721de12-4918-474b-9ed9-5cfe0190c0f9", "value": "1af9f67ad6b43cf7836908005bba72da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b12cb56-decc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625592, "uuid": "4620a4ee-73a2-4b91-a560-57e94feefb13", "comment": "Malware payload (Mirai)", "value": "cd0fb22eba75cbdce981ac386766e0af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625592, "uuid": "129d16d1-2545-4253-ad22-72de331a6fb1", "comment": "Malware payload (Mirai)", "value": "d16c3f8666fb24af778a60a4f0e28c18cf88ab9cab1f437e34e1efe90222fa2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625592, "uuid": "85c62c37-8c6c-4e2e-a860-07b5636364e7", "comment": "Malware payload (Mirai)", "value": "661b515996d8fb6aec1723a13f6c0b6af45eb7aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625592, "uuid": "cbacf023-b51d-4bf7-9e98-20f2f3593ce5", "comment": "Malware payload (Mirai)", "value": "71950f2b5fdf0abf6b4d86228b2a8b9dafc22df190f7bee12176a5921068a19924b1d0b541ecf30d3e48844c570aeef0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625592, "uuid": "ee287217-1f4e-4707-9682-9d00034aa32b", "value": "9AE2F11858500C58E52EE8F3663403E01E589FA162C21D6CF4A5E7EB5F952F4E9C76C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625592, "uuid": "c6e51e9b-b9b6-4398-818b-1aec5031432e", "value": "768:yaYSyYdklmrEdQ5PFeMzKUZygW3PbJtlLAhRmxekHMJgGlzDpbuR1J9r:HKmrEmPFeMzKzN3lzHEVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625592, "uuid": "c846a455-4f93-4250-9c8a-99ba90ef7963", "value": 32764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625592, "uuid": "77a81d77-675a-4dea-97db-1c6ba04bd061", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625592, "uuid": "b2b35979-08a6-4963-b583-b3c61ae490db", "value": "cd0fb22eba75cbdce981ac386766e0af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afebe80b-df3c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625673730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673730, "uuid": "2bde48aa-273b-4542-9ded-69e992459229", "comment": "Malware payload (AgentTesla)", "value": "e245c0cd830ce04087ee4338736df365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673730, "uuid": "fc113400-13aa-4fab-ab4f-0ce6202f07cd", "comment": "Malware payload (AgentTesla)", "value": "d20aff03dd6394b498b2c2cbb6696120e93595b8c8141e077566348faf251d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673730, "uuid": "5378cb23-daa8-4a07-a72a-f2f79daac6d5", "comment": "Malware payload (AgentTesla)", "value": "c0261455b594b13b8787a085f5a4c76f0b6afb67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625673730, "uuid": "779deb88-2dc5-431a-b4f2-328a647db533", "comment": "Malware payload (AgentTesla)", "value": "26191425276227d81690091c4454b00f20eeb0a017bfef20f59ba71970216c8f26c0a8ce59e81dea4d4d858cec7c190a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673730, "uuid": "fa4a0584-3451-4905-9914-8bd580767bf9", "value": "T17BF45A983312719EF416C832B956DCF0E6207E665B0BC20390D73F9BB91E5D6CF911AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673730, "uuid": "c7a503e0-a749-470e-b00c-aaffa1c63dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673730, "uuid": "4ed01953-26c7-45bd-b4f7-1b0d2b1bd66c", "value": "12288:lK9TgVhVWcUD4OrULGiWJkjPGpgPRJX8HJ0J4bVyG8ryXxjJxLVSvZeyaQqI:lK1qVqHqhWJkr4gPy0KL8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625673730, "uuid": "8b15b78a-119d-42b6-9091-0f6b82decea3", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625673730, "uuid": "05a4c6e5-f476-40e2-837a-aa7ae42f2075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625673730, "uuid": "1d60370a-ce81-4699-8f68-eccbd9eb090b", "value": "5795268743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0de2124-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625634621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634621, "uuid": "9b5cd7b6-019c-483c-9d07-bcaaf9037b9f", "comment": "Malware payload (RedLineStealer)", "value": "609e4a8b5f5df82b0dc47275db50f4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634621, "uuid": "bb2378bd-4b33-4dd6-b8e4-d72e141256d8", "comment": "Malware payload (RedLineStealer)", "value": "d22d7ec3a9db9edb88cd373986a8aee46fc90bcb1339b147880301351d5ee522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634621, "uuid": "ca496d35-99bb-4e69-a440-c5d1a110fe1b", "comment": "Malware payload (RedLineStealer)", "value": "91be8fa9a330fb3e842f9ab1ff2db5bc78f9eb5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634621, "uuid": "26832167-f5f7-47d5-a162-cd955ca6a101", "comment": "Malware payload (RedLineStealer)", "value": "2beacc77187e03c4456e839b8a0a312d487b6fb394e0173471ec605133f624993bd2bc5c92541dd731e840e3a87051ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634621, "uuid": "d3ae2007-5c9b-4400-923a-e8e510f2ba52", "value": "F174232864BFC01985E3EEA12DDCA8FBD99A55E3640D743301B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634621, "uuid": "0875a232-a5f2-4dee-9d40-6a989b85b221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634621, "uuid": "bdb3940f-f7ec-416b-8dac-02a5f1674453", "value": "3072:4WktotwKqovbRUmwgaA7JvyPc49O3L48UCmlpg0Gz7Alq2WwTWj3ygfu6noqOZBU:nwKqovbRZZ7h4ceO3ClpSnWNLTHWJKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634621, "uuid": "a6329d6a-3b93-47fc-95da-c7312e02e80d", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634621, "uuid": "248c2696-2de1-4998-9621-32275ce7764f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634621, "uuid": "5ebdb018-3e90-4751-8909-3a882c7325b9", "value": "609e4a8b5f5df82b0dc47275db50f4de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc80c22-dec5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622647, "uuid": "ae27563b-02c5-4951-ae30-aa13ceceabbf", "comment": "Malware payload (Mirai)", "value": "361abb8a0a4e6ed7a073a502bf66b18e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622647, "uuid": "a869a8ac-3dfc-4a4b-9f00-d761f7fea68f", "comment": "Malware payload (Mirai)", "value": "d3030254b7b25db2c126f17ce4a33036a53500861acc94f55b3328e18aa07b22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622647, "uuid": "5dd5290c-1bfc-4138-856b-16f0c6ccf58e", "comment": "Malware payload (Mirai)", "value": "7f16bc225dc203c725f5c0c25eb60fbf0994cb92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622647, "uuid": "d506f06d-a772-426c-b994-a75eb58b5aa6", "comment": "Malware payload (Mirai)", "value": "6d5557990ad157a9d63ab79ae5d157e9d1ec82f40093d4e1994f38ff1ecb2990c5caea260ebb04ccd42ff437a12aafc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622647, "uuid": "d2403035-a8f5-4840-b059-9e2940d91598", "value": "EED2E1F09A0AED7CC38670775594D8B6276B4490FB2B573913E2C923746B460B6B0F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622647, "uuid": "886c81ea-7317-4cec-ac4e-fb52d7a1be52", "value": "768:CwVJSg90VlP0rJmx9RdyS4fG6g6rMuoUF6GmXcOGPWVtJ0SD:CwVJSdM9MT8/fGSouoUF9N+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622647, "uuid": "068501f2-587e-4a98-af4a-d29572bca2f6", "value": 29604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622647, "uuid": "6849fa9f-354f-41d5-8830-072dd6bd52d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622647, "uuid": "f5f37d4e-d583-43b4-8e6d-3411052bf594", "value": "361abb8a0a4e6ed7a073a502bf66b18e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1413caff-deff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625647269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647269, "uuid": "7057e6e7-efea-4687-a449-48460bb31bf6", "comment": "Malware payload", "value": "c2534173e1fb41dd36e2d87208a740c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647269, "uuid": "5fe25169-8352-4503-b50a-2a2be57fe3d1", "comment": "Malware payload", "value": "d411ec78c86d960afd8a87553511bfe9e786290b309dde47fd6ba663e9ad2c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647269, "uuid": "fc23ec20-59bd-44cf-8961-a377a0eb88d0", "comment": "Malware payload", "value": "2b56880fb602d3173e2ca41bace9117d839d43f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647269, "uuid": "d099bba7-b266-469b-bced-f85acc0a9133", "comment": "Malware payload", "value": "0da2e8ac0fcb013f4cc167688b0518fba2e9382b2eecfcc2e0292347f7e307abe5998c9490c1dbb770b0517c02c6dea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647269, "uuid": "b465ceef-0987-43ae-a3f8-2d2896a2009f", "value": "9A930200B415BF73DDE293F1C4E4CF656612AE6EB3DA00501D7897D2A3625E81BAC725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647269, "uuid": "410d0dee-a541-4b43-9039-e54a06545266", "value": "1536:JM4GmJgzMgUH37QW5pblCxoQE7kVH9g5nQr5z5/7b14nWxr4K+CQEMEq74BM1usQ:JM4Gmg9C7QW5VoxZAmH9g69zX4n8r4z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647269, "uuid": "3e25d552-3418-4c95-a42a-003774eee648", "value": 96743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647269, "uuid": "ee9b6e7e-b082-4251-936a-978111b99d80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647269, "uuid": "0baf2ed2-f2c5-4619-ae27-741af466aa02", "value": "8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc535e29-dec5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622641, "uuid": "8308d007-c171-465f-99cc-c9801a7ab70a", "comment": "Malware payload (Mirai)", "value": "b11a8c813c7d02440612d1db284c4d4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622641, "uuid": "a905fb59-24d1-457f-832b-48c22b79da0c", "comment": "Malware payload (Mirai)", "value": "d421a1fdb6f7b6406abadc56b1fdcc6edb0c388be4e730330f1220cbb0c7b254", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622641, "uuid": "0d74229e-24ac-4594-b5d5-e75a522e1bd4", "comment": "Malware payload (Mirai)", "value": "6600cb090b672c813de46b8258c041af9d5566af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622641, "uuid": "5100143f-070d-4dd9-9540-3d784d64aa3f", "comment": "Malware payload (Mirai)", "value": "01d945bdde622a8f8d46d05ec4b5349a66ac7bf7517136ea51cb4b69c9f4a044aeac52eac2196e27b6bd0ba539f7183e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622641, "uuid": "66d252c2-5bbf-4046-ad57-47f624cb468d", "value": "45539EA1C5ACAD98C6698679BF00C9399723D00466E33EF6D642C797D017AECF049BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622641, "uuid": "504f4155-70bf-45aa-b088-3cf29a360bb5", "value": "1536:l/Up07qqwaxwtZgIObslgtBXxtfs3Ye5cW1tHCFsaeA:l8plLeZigtBHf+BX1tH0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622641, "uuid": "164c73b5-27e9-444e-a17b-1949bb510089", "value": 63740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622641, "uuid": "c47e5e29-684e-427b-b29c-e3ead618d04d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622641, "uuid": "ecbc9e75-07ea-4716-b5c0-7583baa68aeb", "value": "b11a8c813c7d02440612d1db284c4d4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92cb0e32-df54-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625683989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683989, "uuid": "e5d3855b-22dd-4e72-b9d9-3d3343ddf318", "comment": "Malware payload", "value": "3731136fbd99f34ad74f4f00b2d193dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683989, "uuid": "ee82e6b2-55ba-4090-845e-52bbfcda0857", "comment": "Malware payload", "value": "d4271b801339f70c67bd14850366b772a430b152803a33bc22a1d369b3a6e23f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683989, "uuid": "121a422c-cdce-434b-a987-de3f1da90ff0", "comment": "Malware payload", "value": "0a635d793af9271a4be36991520416eef239b93e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683989, "uuid": "58d6a8f8-c4b3-4a07-a604-9c895287be80", "comment": "Malware payload", "value": "2f72fc1fdab49cb2c6359d1f0a8b3b02d55f3ff95fdd3f503534436b6d323dd607006295cd3b95e595e002d22042f32d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683989, "uuid": "e6090a5a-772b-4ac9-8283-e0c128dbb4a7", "value": "T1E6A41210BC9DAA71C6843533CB91E5008BB85E1BA42DD80E35617FDB767B389DB41A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683989, "uuid": "bc2b9618-3b92-4688-9952-335ea506efc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683989, "uuid": "ca140117-0bc7-46b6-b98d-61ab34a12152", "value": "12288:5XqLrXXcaUxBNlhRjFzY66XNuNCCx5rS3CTMOVR3uQWG:5yrnctlX8FJM5rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683989, "uuid": "799aa44b-ab01-4939-b105-0c7ec94b1312", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683989, "uuid": "ab387dba-8e10-468e-b31f-291d74c7d049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683989, "uuid": "db802662-a8f9-4b47-8ded-82980eac72fc", "value": "3731136fbd99f34ad74f4f00b2d193dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15363732-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625634386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634386, "uuid": "acea93fb-5d3b-4a12-9ca7-29aa83d18a98", "comment": "Malware payload (SnakeKeylogger)", "value": "2e6d0e61cde02a90610274275ef681d3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634386, "uuid": "759ea1a4-e17c-4377-a2bc-b119224ba37a", "comment": "Malware payload (SnakeKeylogger)", "value": "d5686602a6cebb0686fdaf3622b496da827f92760b8c5638a27a46ec93208e20", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634386, "uuid": "bf617ce8-05c6-4841-ad0d-0258afc7210e", "comment": "Malware payload (SnakeKeylogger)", "value": "eb628dc0fc0e0264b186ae8e16610999ac488f2b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634386, "uuid": "deac0129-0e6f-4346-a1d7-afd49ed819eb", "comment": "Malware payload (SnakeKeylogger)", "value": "ee59bbb4c0e0c3dac9f3f45d1b8dd5f2e22b02f1916ddda85be0e7798d8a5a967ea24369c68344826e803f716c13c1b3", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634386, "uuid": "cfa9c564-812e-4d97-b687-2c1272eb1523", "value": "E715335918D2CF784B02DFBB1497FED0305A8D322716A9CB5C705E75CA9D2FE26A0B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634386, "uuid": "c6b26253-ddff-449b-8b01-594e4bb1220b", "value": "24576:854JMRw7Ogi2Y4+wMiivTiGo/ot5PVvZZE8m:8GJk+Ogi2Y4+4i7iGoQLFZZPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634386, "uuid": "ae304928-579e-4a15-9463-c464ca7853ce", "value": 912001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634386, "uuid": "56e7ea97-fb62-49a4-9f7c-38096f1c412a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634386, "uuid": "2186268e-6870-47e9-b998-e4cea52cd63f", "value": "RFQ No. ECOQI-MEC-001.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2899c7d0-ded4-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625628836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628836, "uuid": "41ddc219-d249-49ae-b566-e717b6998710", "comment": "Malware payload (RedLineStealer)", "value": "8aeb10b5de728b36985476ca1dcf576d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628836, "uuid": "e1a3c940-b83e-4272-89d8-0066cc6a5818", "comment": "Malware payload (RedLineStealer)", "value": "d59ae43affeee4773c89a3bddf6da80f88e86dc5c91184890864f97fc7cd5f5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628836, "uuid": "0d8cbb38-895a-4ed2-af32-2ec4fbffcede", "comment": "Malware payload (RedLineStealer)", "value": "b4a69401a085f2a8ce0443a75a884594e1bf6344", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625628836, "uuid": "3c7832ec-c023-4c96-8bea-fdc29afcc54d", "comment": "Malware payload (RedLineStealer)", "value": "dc9f21ba3e8bbe04f6690383e4710107f27e3f6cbd6303cd49be1621063d74f114c687df2100d1c8160c8788bc538b9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628836, "uuid": "b3822466-5901-4ce0-b1ee-5c8afd3bf1b7", "value": "3FF4E010B692C035F1F326B458B993A9653EBEB15F2854CBF2C466EE1A346D4ADF0307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628836, "uuid": "018c13a1-0e2e-4f1b-9d07-7df92bf12fe6", "value": "1e8c0f829b104b9959a084b4dd191d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628836, "uuid": "7ae329af-9b34-4b2a-9ecd-6dce690a1791", "value": "12288:zkDDmBiLjISloEML6XwaZbsfMD/ys0hkUlXnE5JeUK/G/8qj1Pr9TLCCx:YDHoEIxaBsf+yRkCXE5Mq/BBDNVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625628836, "uuid": "6d88eaf0-b0e6-42c2-9dee-6ee8e3b96708", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625628836, "uuid": "5dc030e4-f73a-4260-aad3-70c3cd3b5b77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625628836, "uuid": "0b714368-9cba-495d-a7ac-88ca4aa74962", "value": "8aeb10b5de728b36985476ca1dcf576d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb78c2c-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625672871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672871, "uuid": "94fffc38-2ba3-42a0-bd8b-b2ef883496a1", "comment": "Malware payload (AveMariaRAT)", "value": "a52d5d2cefa340e9c1c301d64f66235d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672871, "uuid": "2a3e555f-001d-4d69-937e-177c7fae6823", "comment": "Malware payload (AveMariaRAT)", "value": "d5b123b8863d26ab043baa02882741da8543f260028fe9b777ab87ac692497a6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672871, "uuid": "1fee1e59-46b9-4544-b00d-77ddf712aa58", "comment": "Malware payload (AveMariaRAT)", "value": "ad415b99349587159edba6a6cbf53b639207e4cc", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672871, "uuid": "abadc4cd-0050-493f-9293-1707474f33ba", "comment": "Malware payload (AveMariaRAT)", "value": "b2b22efe2ae5bf359329c21797bc095b0b1cc8bf65463d0455e83fd00e48ab207445bba3a0270b451bdd3c5051fc6516", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672871, "uuid": "009fcce9-391e-4c52-afd1-fddb684709f3", "value": "T1D5B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672871, "uuid": "c185e489-99b9-4102-93a9-8ed267c64334", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672871, "uuid": "e583b4f3-1d20-48ff-9cb0-42fd7087751d", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01N:K1VmhaH8EFvW+0OVE0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672871, "uuid": "694bcb3e-eb94-42da-ba2e-59648288251a", "value": 111313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672871, "uuid": "551f1e52-ee6b-41c8-b60e-c770d6b2a85b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672871, "uuid": "3db519ad-71c3-4ce7-8133-c684b11cd897", "value": "a52d5d2cefa340e9c1c301d64f66235d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61023146-df20-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625661572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661572, "uuid": "b569c935-f807-43a9-9f68-c680dbbb7f6c", "comment": "Malware payload (Hancitor)", "value": "0596744a0d841da80190069d626eb899", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661572, "uuid": "9a8a8139-f183-4a76-a7d7-4928956562dc", "comment": "Malware payload (Hancitor)", "value": "d6c7b5f170665c8efc084b4f841ea26c4bfa6f7ed9ed6cbc6712c0a0788ae3cb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661572, "uuid": "3c709602-9fe2-4378-a07d-94bb5a45f8f3", "comment": "Malware payload (Hancitor)", "value": "2e1d746e7ea15e94b3a22c66cf1c40d8f0a931fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625661572, "uuid": "8f91b5d7-ef72-4882-989e-ab2e5a7cbc88", "comment": "Malware payload (Hancitor)", "value": "eaf78ddf79372bb276f883ecdbf94c1c2185d9669b827cf3a21a87b37058316dadc1fea5db5be21d4d49a749818e40f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661572, "uuid": "b544004c-e931-46c2-bb08-63af970a3b23", "value": "39547C007940E570E6E322778F69E645437CB9200B619ACB33DC1A9F5F7B1E2663A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661572, "uuid": "b4c8b156-675e-4b95-907a-f88d9c45269c", "value": "66ea5ae56a1ad0183ee81e788900c71c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661572, "uuid": "11cd4269-f95e-4a32-bfae-07c298b9cbd0", "value": "6144:FzU8/N+o/63hP1NcmZglxvDf7U9RG7yH+:mM+pwmWlhWQi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625661572, "uuid": "b1a6dfd6-28f3-4693-99c0-b1b2ff677536", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625661572, "uuid": "6c4f6456-ab5b-48bf-95cc-9b38a58fc27d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625661572, "uuid": "2ddfa6aa-de21-48a1-a325-2068c41cfd7c", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27becc78-dec4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625621962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625621962, "uuid": "1b34474c-4044-4b12-99da-ea1bf5f335ac", "comment": "Malware payload (Formbook)", "value": "35ef7e017d305356311017e4d06068db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625621962, "uuid": "37ec1493-6c13-4056-8224-afb8d31d6725", "comment": "Malware payload (Formbook)", "value": "d71f2defd3e3aa48697681a732a8c5ce8df75479b65953ba3063e028fc3d9116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625621962, "uuid": "f998e755-2277-43ba-9a40-43ead650d0bb", "comment": "Malware payload (Formbook)", "value": "aadcd581a67a156815e8949368ef6e781c4c4541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625621962, "uuid": "95a435e7-10fa-48bf-bb05-a6abe47b4460", "comment": "Malware payload (Formbook)", "value": "42702e5e246b73691a2f59052b05a27f91f89618eee978ce7c666c56cd8298859736aee7bb46b22156f2f68620c03a3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625621962, "uuid": "43a105f9-ec01-499a-bba4-134ae8b071eb", "value": "AE24128133A1C96BD9E317710BB367A66BE4DA171864430F37E06F0D7936F82D91E682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625621962, "uuid": "635e04a0-85e4-430d-9b3c-697a98d2e492", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625621962, "uuid": "1de02024-30b4-4539-885c-fcc4d11f2eac", "value": "6144:xMm4CCAEmPcxTWr4UaxafbtTmW+SDzY8zboGNTsvnZ:xMwRNrW0fxTmWFDcsoGd4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625621962, "uuid": "44c1d24c-ea5f-4cab-88e7-ef56ac53567a", "value": 219961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625621962, "uuid": "ba657fbe-02cf-4d58-afbe-405a0dc8b1ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625621962, "uuid": "a62600d6-cd78-4452-8c0a-6f381e309d20", "value": "SecuriteInfo.com.Gen.Variant.Barys.126731.13854.30465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb250ba-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625634129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634129, "uuid": "06aaba2e-ee82-4957-935d-3ea46cb38ed3", "comment": "Malware payload (Formbook)", "value": "bf5029e55445e550dcd79bbed68f6499", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634129, "uuid": "d998fece-156d-44c2-8755-67a8c9326a08", "comment": "Malware payload (Formbook)", "value": "d76ef633fc30a0fa009064ec2dc22a7d204be5c7e910622cb741cb01d434f1d7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634129, "uuid": "ea0b3a7f-f247-4a83-954c-7d94eca86ff3", "comment": "Malware payload (Formbook)", "value": "8cf9a4bfe5f277427fc551ac8df8b190b4bd2b60", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634129, "uuid": "b55ac9e2-ba9c-484d-b0df-7fcf6f8b28e6", "comment": "Malware payload (Formbook)", "value": "57ad317ef7ed9f46b7a8138a380851ce9f791ff6043fe0cc49c0339e8770d58aa522dc82512e1e6e9dfa2e554edb2557", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634129, "uuid": "4b74d523-081a-4d45-abc5-0950a3363c62", "value": "4EB4234F64B4B1798D6B0EC822337121BBE908D1AD65DB8C3B9567340F97E4C28772AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634129, "uuid": "6ebc4db6-f0c6-4259-a10c-a747bdfebb00", "value": "12288:Ioc0xEZOcetpWn/n4Z81AjgGMqbfW+/L7v2zdeuY:DZEUcetzOfs3L70eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634129, "uuid": "5ddcc32a-53df-456f-a74a-7f8398decc28", "value": 536159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634129, "uuid": "6bb58be0-6d1a-42f9-9061-82163b740598", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634129, "uuid": "87a6747b-4bec-45ef-9cb3-77c7d350dcb6", "value": "AVR JULY 2021.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4624aada-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634039, "uuid": "a568ae47-5223-4bb6-a08e-6776c0936c90", "comment": "Malware payload (AgentTesla)", "value": "22f78ccbe85325f3587cd85e912d11f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634039, "uuid": "3dddd0f9-6ba7-498c-a6db-1cdb9f198a6d", "comment": "Malware payload (AgentTesla)", "value": "d77323bce2adab1c82d813a33539848b13f237efee6c8fdacffb2ba88fcf6051", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634039, "uuid": "52978a35-ea07-4d3c-908d-2a4d8aca34ba", "comment": "Malware payload (AgentTesla)", "value": "72c2bc4afb67af4afdd40e73a580bea1af4e3add", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634039, "uuid": "653887bb-2cc3-4e56-bf0b-c04d76a3f70e", "comment": "Malware payload (AgentTesla)", "value": "2198eb1097855b7daeae3127e3a9c502e15b7945b4533a0180bc0dcaead1fe8bfc04ec0966d8d27ded66b54378be44a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634039, "uuid": "bea05070-8ee3-4f51-9ad6-b821e1945396", "value": "88E448983312719EF456C872B956ECF0E6107E665B0B820360D33F9BB91E5D6CF901AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634039, "uuid": "6d9a60da-4e7f-41be-bdc5-3ffb6c5072e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634039, "uuid": "a9f3c3c2-6e1a-499a-8706-55fa373cd86e", "value": "12288:zJJwx3UVas8y+CeIGUfhA8scbFWzQ343iKXddSJN0Xc8Mvk6fadGTQf1EA0Ad9v9:VJwx3Upn+CeIGUfhtFWzQ39KXf1M8qSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634039, "uuid": "177f7dc9-c345-40ef-b2db-4826670d1da6", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634039, "uuid": "d4b30e0d-23ac-4011-b8b1-e5f85cf022f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634039, "uuid": "224b06a6-a85b-4617-9525-04b937143c9f", "value": "S O A -44E45T76468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afacf808-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625634646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634646, "uuid": "3067b480-2ff0-4e04-83db-b3563e870bd9", "comment": "Malware payload", "value": "67ba59e9aea2d129497726520149f0f8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634646, "uuid": "11014236-af66-4b96-b7c5-3ab8f07be96d", "comment": "Malware payload", "value": "d84e6967624cea75382ed68ffd44d7321857c6a0650d1e29d0343ccaf4520d95", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634646, "uuid": "299db03a-7101-4162-9710-c6be721fe3cb", "comment": "Malware payload", "value": "c8efc34a706b365a2ccc8cbc5c3f193902024832", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634646, "uuid": "fa992dd9-05f1-4ad5-8507-844ea438a025", "comment": "Malware payload", "value": "7a9edc20b1e834973e14a8082c42e3cb7e7739b94bfcaa186d65ee477e92a2564049320fd473250f4b538a31139db044", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634646, "uuid": "83acd5c4-68af-474f-8ea4-8e1ba0a1a171", "value": "5D823DACD54B46E88F8A67B8670B6F09054C7A2DF398913336B8A77527E1C3E550387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634646, "uuid": "56b62d95-1631-429a-871b-4afd66985882", "value": "384:WU/4LBdc8t3/4isyFNIlCaRj34rFSmroE91DnB3yfF8G6004klYh36HWO:WH9dc81AisyEfj8oCkKs04kihqHWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634646, "uuid": "e0169a72-c98a-4e4b-a5c4-638092b0becd", "value": 18608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634646, "uuid": "20dfa1fc-4ad3-48e3-adb1-7a4cf51d1ed9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634646, "uuid": "f96c63e2-8c6d-4a34-ac5a-b43522feef77", "value": "PO_287109139.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5538604a-df35-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625670572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670572, "uuid": "d64ffcda-3496-4bfe-821d-b7aa5c22d275", "comment": "Malware payload (Gafgyt)", "value": "9c7a3602fee68314d0ce7ef2543fa218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670572, "uuid": "0160292d-6b6b-4682-8fdc-02ac1ad0dfc2", "comment": "Malware payload (Gafgyt)", "value": "da4d8ad5bc52e0acfde602cb9e3f9715ad271d68c92756731ddaf4c83bc5b2b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670572, "uuid": "80a64a90-1cd6-4b28-9f6e-b118fb095e50", "comment": "Malware payload (Gafgyt)", "value": "059558c5b6e2783bfe811f18e398a1b10b153d14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670572, "uuid": "fa2c23ff-dc00-4eeb-9e8c-1949e2b20e76", "comment": "Malware payload (Gafgyt)", "value": "b379b796b7047ced87befce7bfd80e2a0b554398e038658413e8ca6a50ac9869848d0ebe3d74ad23790131f15fa6a4df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670572, "uuid": "d5a8df44-94ca-4407-a138-4084aa9a65fa", "value": "T1F5C3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670572, "uuid": "946df15d-f469-4e3b-b75e-ab57a26ddff9", "value": "3072:FDcYVLWKlAQTv+mYbbpl2m7/L7QsvmGugiNb:WYVxlAk9YbbH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670572, "uuid": "e88fb33e-8ee3-45e3-a568-3906ceb8da9d", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670572, "uuid": "9f8c99b5-2744-458b-a7f7-ea5aecf495b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670572, "uuid": "a2e371fb-171e-47ee-b153-d7bcd77ba8a7", "value": "9c7a3602fee68314d0ce7ef2543fa218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9734f91-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625634259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634259, "uuid": "f3b4a2e7-048b-4a00-b42a-36b1a814bcd7", "comment": "Malware payload", "value": "706be901d98176933656792f16bcee15", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634259, "uuid": "db08c912-38b2-4583-9132-eb84a75185ee", "comment": "Malware payload", "value": "da64f486e27687603d8c053ff40ecc4f4a2028786fa0aaee4ccffd370d87dee2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634259, "uuid": "b2e0b672-dff2-46a8-bfbd-056a8030dec4", "comment": "Malware payload", "value": "d8e4e81e106331e7cb405aaaffc876e5d7cc968f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634259, "uuid": "3ae401e2-1a82-4653-9c67-d0af3fd17bc5", "comment": "Malware payload", "value": "4a69566761b6d1e12ed71d9210b8e78233bab342c2f997fa0b97a7e61f7a0ae1dc8db550e88c9d4bcedf01db7f3916f5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634259, "uuid": "bb7f058f-b426-4e52-b597-8bb6e4b8efdc", "value": "FB842356344CAB73F6780063349B0DBCBE4B7ECB0AC56E386AD89151FD4870E681AE75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634259, "uuid": "192919f9-acb5-4d9b-88ba-fc5eca47f053", "value": "12288:swDmt9MaUbBIaMwGr7BygYXPWBROLhIhiFYa:bC/sBrWr7BvVBROOej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634259, "uuid": "f5529b21-f6d2-447b-8cd1-cd79c61626b8", "value": 399696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634259, "uuid": "f0bd6624-acb7-4a36-8e2f-c3a7a8b72532", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634259, "uuid": "09113f4c-1680-43a3-baff-6fa8e6689243", "value": "bank account details pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138166de-ded7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625630089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630089, "uuid": "b261ff44-f646-4325-b2bb-2667048f0530", "comment": "Malware payload (Loki)", "value": "d0ee40e6f67871ee744b814f663ac06a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630089, "uuid": "ed808cc2-1a49-4fa6-8c45-6db69d30d10f", "comment": "Malware payload (Loki)", "value": "dbffc779723c87d09447432bee7157ecd7422c635af06164f9a587f3d31bc209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630089, "uuid": "8d2ab8c6-7df7-448f-a79b-629c9e63755a", "comment": "Malware payload (Loki)", "value": "6c13ce38c6fa20a9492b424267bbaaba2a7ef81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625630089, "uuid": "d376e3e0-6832-4d9c-b284-11350a01711a", "comment": "Malware payload (Loki)", "value": "94703c8ced843a0d66bd5bb146030679b4dfba24eb5647ab271cff4636267b1d108c655e45b5a4a3b5b7d5529e8d2dc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630089, "uuid": "05c015b9-9349-4803-bc16-44ef1024730e", "value": "C235CE7A60338A92DEAFC7F90730652E4F6DAFFE904AB6741845743900F4B4D4BA1927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630089, "uuid": "c3f63be0-44f7-4b4e-8d4e-8905a2ded487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630089, "uuid": "a2fab394-6999-461a-8ad7-4d6b89de8d2d", "value": "24576:jJ+Huej8FkSlZbt5SpU6Mt0JLz34Be3iR0biYuWOBfWlB:jJUjUZToFzI+iSbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625630089, "uuid": "3bdf4aa1-213b-4107-a317-a2a6a0188d20", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625630089, "uuid": "0001599f-fb7a-4c7e-9913-6ce28e680e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625630089, "uuid": "1b2602bb-8d5c-4c5f-9550-b1d9198ca460", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DLO.genEldorado.16019.21563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615d8983-deff-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625647399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647399, "uuid": "fc4e4a92-74b7-4eef-bb1d-622945bdc052", "comment": "Malware payload (Loki)", "value": "1bad93a440d8a9078823a5b45d7109f8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647399, "uuid": "c332b514-3917-41d8-b56a-45b09f512658", "comment": "Malware payload (Loki)", "value": "dc0b34f31c9905308b2dc555787d293c090773fec6cc03a09c6e7aafeb516240", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647399, "uuid": "36c127cd-0f97-447a-9277-0a7389e386ba", "comment": "Malware payload (Loki)", "value": "ff7cac20be957997d244d6028e41e757e369eb51", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647399, "uuid": "55cfad89-94f4-49f2-a797-636c22a7cd3d", "comment": "Malware payload (Loki)", "value": "385f311ef3dfee4d7b9e9dc98864d7d33c233176777edd5346b465723ece0847fcac783b27b06f38964995bda3be47db", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647399, "uuid": "3f612749-7ced-4fce-9e69-8c0f415803ed", "value": "AC55122856EB7520C77F2A367283EDA4EDB9AC5D6182B311326D30C3743F6609BC1A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647399, "uuid": "5a7d6ada-12cf-462f-ae5c-f4af904c5ceb", "value": "24576:I7zOTHyLAzJNxycIJmjB/I2p2gll1+V9m608E2o9CrmoPstg4OmyVFOr:aZIxylJmjBN2glHu3V+9C70tgJmyer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647399, "uuid": "d89afa3c-bcce-4aa1-b354-969d4e2cb832", "value": 1281794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647399, "uuid": "8d210179-6a7e-40f0-9ae7-903f13b8c9d4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647399, "uuid": "3fabb555-6537-4c65-809d-a94a3a5013f3", "value": "12.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0283aac-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634324, "uuid": "3d490c52-77c7-4bb9-a311-f7eb59f914b5", "comment": "Malware payload (AgentTesla)", "value": "aeb27d7bc8efea454d810e655838b212", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634324, "uuid": "e0553a16-1a70-49e2-a0cf-6747f7cc70e7", "comment": "Malware payload (AgentTesla)", "value": "dd623927e95233e76397ee4d5e38efdd851ce068690dbfb489499cec480eb138", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634324, "uuid": "a6c92e8f-14d1-4040-88f6-56f7a4ceafe1", "comment": "Malware payload (AgentTesla)", "value": "10e916d97f102ae2323657821b6e6e0247c2879e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634324, "uuid": "98f00020-0c2f-46d9-838a-15cc8f85e422", "comment": "Malware payload (AgentTesla)", "value": "d89791af17bd31eb0a481a4e78b255f9a16a2ae64a270a87f9c51bbce345acd0ae49a103d6775009bc61fc5201ce8351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634324, "uuid": "de078510-0c2b-404b-a026-8999282c5982", "value": "2745CF7A60338B92DEAFC7F90331652E4F6DAFFD914AB2741844B47900F4B4D4A6192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634324, "uuid": "2a376f97-6161-4f82-b26d-60e8d9014335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634324, "uuid": "e92c86b4-608a-4133-88fb-25b3d4fb14df", "value": "24576:v+V+HCzGqM7R1iuEvZp+L5UDn2Kqu4g0biYuWOBfWlB:v+VRG5RJ7L5w2oKbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634324, "uuid": "5648398a-d375-493b-abca-b1efe03f9fe3", "value": 1222656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634324, "uuid": "55732587-10f3-4eec-b273-8c6240da07e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634324, "uuid": "69e0a821-0bff-4080-a7ad-2aff99b512b7", "value": "PI.7.7.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcd6e23-df46-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625678048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678048, "uuid": "566cdb07-1ab2-4d25-aede-15fcc4ab491b", "comment": "Malware payload (Loki)", "value": "f8defa81771ae2a55044870cfeb27ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678048, "uuid": "278add09-bb6c-46cb-804c-020c0e4f1d50", "comment": "Malware payload (Loki)", "value": "def6198e17163d73fd1e301adef53f353a66b1108c8d19a2c05b6216bf68d0e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678048, "uuid": "c9968d24-03b2-4c81-864b-ec422a0ab377", "comment": "Malware payload (Loki)", "value": "40d45b72f0f79715bca28e48c43e3b10ac043787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625678048, "uuid": "489855cd-01c4-4ca4-9a30-2ad0d1c7873b", "comment": "Malware payload (Loki)", "value": "471d7aee64ecad5bc5b4b05e4787b383a7567991b8f83a7f41b2755e20035f1aca860019f0292005284c21bf017b57d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678048, "uuid": "f8c4d0cf-1e64-4b18-b20d-3fe1ff90e94b", "value": "T11E45CF7A60368A51EEAFC7F94774661E8F5DAFFF904BB2780884743800F4B4D4A52927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678048, "uuid": "fb84cb7f-52d6-4bc1-b643-b929771e8af9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678048, "uuid": "8475b211-fafa-4e34-99dd-6178c27dbb15", "value": "24576:ewu2o9O5NH7FNupL5hDgPuYd0biYuWOBfWlBhuR/s:cx+y5aTObiBBBEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625678048, "uuid": "3a94b75a-adb0-432a-9a48-cc14ae33027d", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625678048, "uuid": "3422ab6f-1683-4177-94d4-2dde02b34f98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625678048, "uuid": "58370cbb-9284-4495-963c-68d880f02ee6", "value": "khFojGXJ0pHaxA5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d598cf0-df4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625680759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680759, "uuid": "403a41ac-8070-4e48-8e55-fe6168f079b1", "comment": "Malware payload (Formbook)", "value": "702b18b0650c0234aae73c200dd00617", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680759, "uuid": "bcccf6dc-66c6-44f8-982a-fe3e3618fcbc", "comment": "Malware payload (Formbook)", "value": "e02a6b078d2406f7e8dcf84680c5ecad971b13b0c557669de04914b1b1b10489", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680759, "uuid": "ba4f4944-0e92-4595-af78-a73b2215df44", "comment": "Malware payload (Formbook)", "value": "6429e75b158c66ffb31e55297bf795811737f170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625680759, "uuid": "e7c1edb8-3a83-4499-88fa-5e3c3687b440", "comment": "Malware payload (Formbook)", "value": "f848c532036e0fa6dbda36c860aba60b1387d0e1c9e28821fa8622af0b9f60df7a6747e235ebd2651cf0e391b69438db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680759, "uuid": "1a0bd53d-de47-4525-af18-ccdba392845f", "value": "T1A704AE32E641C430E2B251B1F67D1B7B483E0E343295A0AAA3E515E06FF49E5B53A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680759, "uuid": "e081a880-3876-4e15-82a7-157f1f4f8c0d", "value": "3072:oe4zgIF7CbNoTyHyBp+88bLxP6IQuTv0dk3ME1qoBEWjYtvdeu:WlBTySmbLxP6iv0dSBNjYtvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625680759, "uuid": "5dc56455-7070-48e1-8375-4befedd527a5", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625680759, "uuid": "653189fc-d92c-498f-8cf6-05db54db9529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625680759, "uuid": "4d9860ed-1bb5-43c2-b559-7c9ff5f2e089", "value": "702b18b0650c0234aae73c200dd00617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678e1323-dec6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625622928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622928, "uuid": "49df0e3b-adf7-4d2d-b3ab-274dd5e29dbc", "comment": "Malware payload (Mirai)", "value": "6acdbe979ac0c2c32b5c3dc6529dc4be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622928, "uuid": "5355eaf2-06f3-40e4-9a6f-32ecaaa7c1e3", "comment": "Malware payload (Mirai)", "value": "e1edfd34f23179e6e89bf69878855e6558118a1632036693c12ae4a6d9872477", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622928, "uuid": "e9d332c2-1cf3-476b-81be-2d7268996e66", "comment": "Malware payload (Mirai)", "value": "85b613f727bcc37ad73ad8960207caff1ceff63d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625622928, "uuid": "e8944854-8339-4d92-8385-78f40faefb7b", "comment": "Malware payload (Mirai)", "value": "5f75bf28923ab054ec54e351d248376994d06387d7ddb89bc85d06c59b9f294a4b0dbc267d23b2de60190998da9f733a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622928, "uuid": "a4d08778-95e4-4e45-ba4a-b4431b12e83b", "value": "E1D2D13517889FE7C930443EA9285A0E53B256FAA2E47562222A05F4EC8340797FD7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622928, "uuid": "e1b5d41a-a284-4c43-9106-925477b939e4", "value": "768:fwEDtNk0I3jCJxsb4ctlnhyvafPs9s3UozA:d6bG4bFhyvafvzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625622928, "uuid": "97b335a6-fa89-465a-b07d-259304f9c2dc", "value": 29548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625622928, "uuid": "073bd9f5-f860-451a-a087-b47d5467fa98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625622928, "uuid": "e560dad0-af5a-4615-b174-0bf8d7a34da3", "value": "6acdbe979ac0c2c32b5c3dc6529dc4be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20675bd-dee1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625634730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634730, "uuid": "9e1a0b82-5f8b-4dfe-9b4d-82a252a8c462", "comment": "Malware payload (Loki)", "value": "a46152ff71eebd881b719c84e6769288", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634730, "uuid": "1700292e-2813-4814-b001-052f824de58b", "comment": "Malware payload (Loki)", "value": "e3003db4ef0071e2baac7ef359f80fa8719ce9521831013328ca4963aa819126", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634730, "uuid": "151284e0-b73f-43b3-ada7-a1521732bc57", "comment": "Malware payload (Loki)", "value": "64d4e7cd64cca099b7fe00c85aef7b488309020c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634730, "uuid": "ae7fa23e-598c-400f-9aa9-5bd96b9d24e5", "comment": "Malware payload (Loki)", "value": "b0abed4b8f3e51b429da5c6371aabd5bd7630a6582ef53d481494c78ff6ba1ab3015384176c930580392e9ab72835fff", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634730, "uuid": "fcd25f99-3237-48c8-96fa-76b4e60c1fde", "value": "1545123A6CD46724C295A076CA339A2F40387D13F3DCDF6E2199FA014577A26EEC1C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634730, "uuid": "88bc3ecb-1e3d-4b75-aeee-011e756e59d1", "value": "24576:HINn28SSnyQLzeF1fz4rsJtThDRu/yWl9dQ3qpOPZ4z+r2x:HINn2xSyQLiFNzostT3u/FXWq4DCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634730, "uuid": "d26fca74-ac74-4200-bfb9-bf0bec3b3bfd", "value": 1225576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634730, "uuid": "a0d5212b-f75c-4d61-b09e-a11b3905e574", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634730, "uuid": "4749eaae-2859-44e6-bef9-9b53ce0d422a", "value": "PROFORMANew PO N. FM 06072021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3803c52-ded1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625627780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627780, "uuid": "be0093fc-ad07-4740-9d11-b3f9b724aee8", "comment": "Malware payload (Loki)", "value": "8b5fdbfafbbc3a6e71b6ea3266b7afdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627780, "uuid": "e6f18fb7-0c63-4c1b-8de2-d91859b6d763", "comment": "Malware payload (Loki)", "value": "e331ad52859c80b8a19d5b85c0d5c5c51463a8930944fb0b766fe64e7737c86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627780, "uuid": "bef209f6-2bb9-479f-bb22-5cdb4c7d0330", "comment": "Malware payload (Loki)", "value": "c7c304995c3bfd0d23fbce95c5279ca597dbe3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627780, "uuid": "5049df35-5d4f-49f6-9080-24d278495aeb", "comment": "Malware payload (Loki)", "value": "c3374f67faebd363b4ee55680eb0895025c5b7a73872c8193303c7229c4336a8bd71a27423b80ba3d02ad4f4891e079a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627780, "uuid": "44ea4427-913d-4896-9351-c5f3e89d5931", "value": "CD058D7621768F92EDBFC7384775261C4FE9B377D34BF6B92C9560990480F404AA2A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627780, "uuid": "82a73da6-5e21-4c5a-8a08-ff184fdf9092", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627780, "uuid": "f6c95830-2b33-40d9-b286-d30762fd4f34", "value": "12288:wdk5W4e6NsBnD/F08SxyeNgwG+l5Sf2H1/is9xRqH17seijHit:wd4Ze6NGY9gwG+LgGb9q174m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625627780, "uuid": "1f738f95-6bf7-456c-b540-04579a25679a", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625627780, "uuid": "519aa6e8-f999-447c-9202-fc590e9c30e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627780, "uuid": "5d3182d4-7d52-4313-8094-4930517a0ac8", "value": "hNJEKVCtVbCUtpY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6611b907-dee2-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1625634952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634952, "uuid": "4c2a0133-41bb-43c5-9f7d-57e642a1c3d3", "comment": "Malware payload (IcedID)", "value": "02b86e6098aeb1e57e434319850a3db6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634952, "uuid": "2a0827d8-7e71-4e8f-baa2-9c29504c8681", "comment": "Malware payload (IcedID)", "value": "e3b0a515f8ad1cd101eddab33f55139f4cccf452625db0534b17321cc7c552c3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634952, "uuid": "6694d1d1-e4b1-43e3-b4e9-0c65f847e9a5", "comment": "Malware payload (IcedID)", "value": "ed06266ef9ef26046ed6e52bb9d04cb6d7a464f6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634952, "uuid": "97ac2855-76ad-4c54-b062-69073ca40589", "comment": "Malware payload (IcedID)", "value": "80149bbdf8bf2f14e155fc746e568ed9b0356a3896f2e8071293d2aae56ff1bdfa55016bf223c5b328c0fe4de350488c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634952, "uuid": "360f8000-2bdc-4e85-a03e-a67206218d90", "value": "1F040155E162E6DADEA01C3E70F7424AEB644C726C487AA7483B3D89913D3E3F3DA540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634952, "uuid": "36bb5087-4573-4fa6-b74a-dcab6c0f95d2", "value": "3072:EDusrJcGUAUpF2e/RIiZmxjTH0Fq2yIyJFZqcN+KCiSsYErzSK/Xvpk:ORcGUlFzy4mpTHdrUc3/SsYASx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634952, "uuid": "298ffc8b-9a45-4b25-8cdb-e3d16afdc635", "value": 189905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634952, "uuid": "5c00ebd2-7840-4846-8c50-cb49ebbeaa9b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634952, "uuid": "86e2eb05-4b60-4177-9da9-5c6df0286dfe", "value": "Schedule072021R7218468.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77ebcdb-defe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625647087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647087, "uuid": "b28ff711-e352-4b2b-86a9-b7fbbf6a17aa", "comment": "Malware payload", "value": "3a13b28ce9fb80b4955c5517fdfeb1e8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647087, "uuid": "304a7081-8c38-4763-8d47-22b0f46a38fe", "comment": "Malware payload", "value": "e3d603cbd0b552c99e3401c8d559b4bbbcb4fd09a4e8d99d971ee094825ba7ad", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647087, "uuid": "9891310a-2bcd-48fa-9102-38efb6190b2d", "comment": "Malware payload", "value": "049880bcc5a6d1cb3135b1fd549f3329aa92b931", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647087, "uuid": "45a28b88-9803-4f33-8097-69782fc9390f", "comment": "Malware payload", "value": "a9e6123d59a19eff0efadef85b2bd13311d108fda056492a576fd86dc8a47a2b994f4fd8bda88b43c7c7b04894166c4e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647087, "uuid": "ffd14ecd-a867-4453-b3a5-5d10da88baed", "value": "EE52EA3E794CE82195272AA7DE0F9C4FF5B07074E94AB94C6241BDEE18345ABBF412C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647087, "uuid": "af6f67ef-c060-4187-a29d-e0c65992befd", "value": "384:33ebbLj5CRTHZqGFtITYR7CPsrB3K6YS835jkIwrihjU6:neX0RT5bXCPsrB31Yj35jkIwrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647087, "uuid": "19f4449e-17ec-4257-8ab7-79bcacf6c912", "value": 14092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647087, "uuid": "5c4d5d82-51ba-477b-beef-83f34d7c1787", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647087, "uuid": "71abf155-a9a3-4ede-8fcd-63bc0edcc46a", "value": "1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a679ed3-df26-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625664057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664057, "uuid": "e95f5f44-fb69-4fb3-a8b8-1889d21aae09", "comment": "Malware payload", "value": "91fd9ec521c7a72968182a959f009bba", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664057, "uuid": "4a088323-079a-4d0c-b95f-07ac649b5b7a", "comment": "Malware payload", "value": "e4a651d47a26e5970aed70661d4bb18b50bed59b9c9835ba3043f3937fdb9dcb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664057, "uuid": "8179c639-3434-487f-a78c-74c9692300ca", "comment": "Malware payload", "value": "a6a316b0edbc13781c735cbfd7c5423948ccf6e1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664057, "uuid": "08427c47-4b70-4bc6-b116-f81a133800b2", "comment": "Malware payload", "value": "c84c5009e97f55f78fca7025750eaefaa993b63db726a38cc3cdf6bb191da9e53635cd5749cac61d9e23f5ff5e7d5d0d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664057, "uuid": "e08c2c4f-e57c-48b0-931c-cf3079facf77", "value": "54258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664057, "uuid": "030352b9-f28a-406d-aa2d-cdc75e46763c", "value": "24576:EDaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:ED8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625664057, "uuid": "11848a48-54c8-40d2-ad41-ccf723a48d1b", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625664057, "uuid": "f67a324a-8b0a-435d-8529-0fa6e5fe9333", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664057, "uuid": "26b3392d-f086-4cdf-a6b3-feaad2c566bb", "value": "91fd9ec521c7a72968182a959f009bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c834f4-df35-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625670578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670578, "uuid": "9614b649-7d9c-4635-9b70-68067c48f709", "comment": "Malware payload (Gafgyt)", "value": "e2e11a7173ef8f07fdfc7fdb16eb8333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670578, "uuid": "270e3147-b83c-485a-9f3c-69ff5ac6898e", "comment": "Malware payload (Gafgyt)", "value": "e50ee1eb77f681768138c24163a5e02000fbf1d13f7e9d1cc5653e2987fbd5d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670578, "uuid": "c4987f43-3387-48d4-b716-bb0a08e9cbc0", "comment": "Malware payload (Gafgyt)", "value": "57c953796289ba7911be6c4f5cca66e660d02a6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670578, "uuid": "77feae95-855f-4156-b7bb-9ad182613d3b", "comment": "Malware payload (Gafgyt)", "value": "ef7eb59124efd02731d46b2574d3d32ee6d5cae6782197e1565721319693fc320e9ce3448cf0df999292cc6b943399d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670578, "uuid": "9f267dd3-8bc8-4b1a-9729-75fea0e9a2a5", "value": "T13FB31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670578, "uuid": "ac9d1eb4-89eb-4d64-9067-1c5743d3e2a1", "value": "3072:OwNUWqpCgYXlrSyWUfMNDMmH1cuEgv26uN/:OwNjqpC/G8fMNDMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670578, "uuid": "89774800-473b-49b0-85d2-07cee0e3b602", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670578, "uuid": "3ad91931-4538-4843-80ef-0fdd1d8c139f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670578, "uuid": "101e24cc-be6f-44eb-889f-9fbb219919ca", "value": "e2e11a7173ef8f07fdfc7fdb16eb8333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a408e9d1-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625637633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637633, "uuid": "a64e8591-0065-47e1-a8e0-65d9b40ec3fe", "comment": "Malware payload (Formbook)", "value": "d1659d1d539934522efd281e8fd40168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637633, "uuid": "97dd099d-3410-4266-a430-f76cd11e709a", "comment": "Malware payload (Formbook)", "value": "e753ebc9d17166f3c6e9df8201bb4a904c138673966c4c917fd54e4c44a43b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637633, "uuid": "940d61f6-5aa2-4187-b20a-a0064f99b25c", "comment": "Malware payload (Formbook)", "value": "5ee1ceebffbcdb51c77bfa2c5ebbdb7f9e74a0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637633, "uuid": "ce5fa655-946e-4cac-ad4e-65bda8412b80", "comment": "Malware payload (Formbook)", "value": "3515f0db82d202020fc16b9318713bf0b35880fe56af52caaaa18011ec9bdafba043b98b51a7a32b9c0a19c99b62db65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637633, "uuid": "a1b76942-bb1a-4314-8bd5-75d224b99f5c", "value": "B365DF3534328A93DEAFC7F50739016D4F59BBBCA246B53E15C0B83880E5BA80E5956F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637633, "uuid": "12749636-6827-4b28-97da-8548629ea5d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637633, "uuid": "331fef3a-6db1-4340-abd7-01ef01f78c69", "value": "24576:mH+H+RxXmf0S46yb8+9RkZHoz+JS9MY5VehEN0biYuWOBfWlBSgfGw:mHLof0+ybbQLJ45VabiBBBEMgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637633, "uuid": "8ee981db-6920-464e-8c40-e3dd8c8fe0d3", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637633, "uuid": "96917fb8-36e5-4596-aa2e-6bbbf6267ef6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637633, "uuid": "dc7f630f-9a28-45ac-81cc-a2f55452e815", "value": "M.M. Public Company Limited - products lists.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175297e3-df27-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625664455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664455, "uuid": "d368f3fb-0512-4d06-936d-6fe3e98182ab", "comment": "Malware payload (OskiStealer)", "value": "59ab66771519569b3d730dcdccae18c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664455, "uuid": "0b4593ea-8315-432b-9f2c-1cb613808d41", "comment": "Malware payload (OskiStealer)", "value": "e8c1c1c650353d674d7d490e0ccdb07ae59674fc3f23fb7d141a7f8224ed2a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664455, "uuid": "a4d638c4-f837-4991-9069-0484a45d394e", "comment": "Malware payload (OskiStealer)", "value": "5ab229ebf8622111e8ad4aac14b6ca0a5d3767af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664455, "uuid": "307574d4-6211-4b50-8812-44f4d94a083d", "comment": "Malware payload (OskiStealer)", "value": "a4a1f5130379cb10c592a3984c7fd53f4b5f6e5fb4f689fb38624824847f2849d8dcd8da7d364058c9e155cb489999b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664455, "uuid": "caea480a-0da6-4b33-b060-7e8adcc87e43", "value": "0B146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664455, "uuid": "39907291-46fc-46ab-8464-89a2b3efd8c3", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664455, "uuid": "28f8fd25-fa66-4626-b291-88e2c4608cf3", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIA1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNp1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625664455, "uuid": "af70e320-17ae-4dd0-bf4a-20bdd6a336e0", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625664455, "uuid": "e2465dc4-a081-4a7b-b233-92e4491a1b70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664455, "uuid": "ae306754-1603-4ae0-9cff-0b582663b981", "value": "two.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3861b65-df37-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625671519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671519, "uuid": "27ca05ed-137c-42d6-92d4-09a328399963", "comment": "Malware payload (BazaLoader)", "value": "872fa5355be624e8a30996a3a40a72dd", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671519, "uuid": "46e1074b-0471-4de7-9dab-9bf0a6bf1aa8", "comment": "Malware payload (BazaLoader)", "value": "e938d37c4b6e80c51dffa6bd1b75729b1102123c130fe4b1052d9a45edb237be", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671519, "uuid": "fec38b7b-e496-473c-8b72-4649cb160681", "comment": "Malware payload (BazaLoader)", "value": "cf352aefa31c4b26d9e7dfeeb3a6e385eb0975d7", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625671519, "uuid": "6395cf16-002c-4130-9883-2a656554f01f", "comment": "Malware payload (BazaLoader)", "value": "360f767b73a2179d8f3e31d07c1d4e60494fb48ba2427c95c8dfa08fa25a0293ffa6149da9249bb5526b768f41c7941e", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671519, "uuid": "5b786d37-8f0c-42b7-a9a9-b5efae4e7556", "value": "T12D048D11FB83C0B5DD6708B054E0A53ECD383D144578AEEBDF908F6E9F242618E39A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671519, "uuid": "e277d0b5-2b1b-491b-b3b0-ec4e9da4c7df", "value": "aade7ba79f860dd3dec2afa9daec4f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671519, "uuid": "68c42ea7-3c9f-44e4-828a-bddff3fa5228", "value": "3072:ZfkkLfel75uouLeviqlFXr9Gu3ttrk1h6FDa0zzQxEtt9Q9jBu/vmOTMrTdGuUaX:lkkyXEattQ1h6HQuto9F6k0uUa2YGZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625671519, "uuid": "d90d08c3-2f6d-4c45-be91-c32eb77ac006", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625671519, "uuid": "1b14d4f3-591a-4d63-83fa-edd17b571b84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625671519, "uuid": "55a2f0e8-1116-470a-baf5-d5cdc68b8f5e", "value": "FQ4jzOGrg6udVQoV9d7S.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5356de9d-df32-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625669280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669280, "uuid": "b6fb952d-5baa-4658-855e-eeb292879046", "comment": "Malware payload (NanoCore)", "value": "dd93a4d457580aeb49e4f1284a530abb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669280, "uuid": "81460d92-0569-4df0-90c3-3301ed54d1e0", "comment": "Malware payload (NanoCore)", "value": "e9cb60234089cc8b422cb51d1c12fe510d4e69deb300a55356c91108826453ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669280, "uuid": "91985880-acc7-430e-816c-8eb4590ce776", "comment": "Malware payload (NanoCore)", "value": "0cda99376df7ce05c98f5398452f7f7c4e1847f0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625669280, "uuid": "3152b4c5-3495-4c8c-aaba-1d35bcf6443e", "comment": "Malware payload (NanoCore)", "value": "aa939b5cb0427b3e9ee7182bde02643f5a72df2834cbac53aa2d9c82ef16430739321ddffc588b5e9b37ecc64e368121", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669280, "uuid": "0a41669e-78e8-4f5b-ac09-abf26ea004c3", "value": "A1831F7DF1970A988F4693B8131B2F81164CF51CF3D995B236A8DB3866D1D7B822293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669280, "uuid": "6c6f2354-fe99-4a3e-a229-91a2bedac5f4", "value": "1536:aETS+5NbHDCoIuXx0LQobxr5REc/tImttl46H1uJnLSp:XTSmjCoIuXx0LQobPRr/tImttl4o1uJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625669280, "uuid": "370fb503-fa7e-453d-ad3b-090ce07796a0", "value": 82724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625669280, "uuid": "4531c0c3-24f3-48eb-b5c4-bb0521ebab74", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625669280, "uuid": "ffd1bf03-2780-4adc-b8fd-bdcac4b3d81b", "value": "DOO STILO NOVI SAD EUR 5.200,99 20210705094119.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a68671e-df40-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625675171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675171, "uuid": "a4117882-3bcd-451a-89fc-296bf13557b7", "comment": "Malware payload", "value": "c7c7fd41e8df9774152c5e78486e43e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675171, "uuid": "2fe96630-d8ee-4b0c-87b4-647e6035e21a", "comment": "Malware payload", "value": "eac117472c5afe069b20e9ee06ca71b701bb9a3ff7916e9172b0ac9009e28fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675171, "uuid": "65096e9d-2b28-46ec-aae2-f8925165341e", "comment": "Malware payload", "value": "e51fa8efa36bce82bcd226c2ead9a7d660f3aa0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675171, "uuid": "304614b4-ef8c-49e5-b578-42de59f4aefe", "comment": "Malware payload", "value": "48c6b7e672f353717cbb6d52d01603296fcc5c0768e11f11c0a1dcaab877450d5beeaf18d0ee3c8004e6f62a67d7ed38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675171, "uuid": "ede5ae4e-780c-4d36-9b18-8e21f407fae5", "value": "T10814D15076C2CCF0F4A319360CF5E37F5F3E75128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675171, "uuid": "53cc2ec5-f646-4b64-a512-95377f5ccf22", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675171, "uuid": "353f7495-74a0-4c1c-81f6-4d1eb8d21932", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjupYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjlfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625675171, "uuid": "bc4c7e1b-88ec-4ca0-a8c3-681fd86f3aa0", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625675171, "uuid": "1da295f1-4ac1-4122-a2fb-b6713434d44f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675171, "uuid": "c0490133-0b4d-4fc4-97fa-c7af6f335589", "value": "eac117472c5afe069b20e9ee06ca71b701bb9a3ff7916e9172b0ac9009e28fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16a6f77-df22-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1625662646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662646, "uuid": "d6503a62-94a7-4cd1-a0e5-3fa356d80b82", "comment": "Malware payload (Gozi)", "value": "5522c21a05daf91658951bdf1c0e5271", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662646, "uuid": "bfdad725-08b7-4f6c-adff-708a2dbf868a", "comment": "Malware payload (Gozi)", "value": "eb6e2519aa5c31174a1ed6c0193b2d0e49e9ed6ca1ac01ed94b3007b5e2f6993", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662646, "uuid": "49c7f503-e7de-4a30-84bc-b0d7d980c8ed", "comment": "Malware payload (Gozi)", "value": "fed4a9b4069cd2676928441ecf8c844cc7f4a9ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625662646, "uuid": "294f02fe-54c3-4757-8793-bef111e017b6", "comment": "Malware payload (Gozi)", "value": "04c883e4ad1996c1189b7fbcc1f4a21e2fe34188fe469ff5e021587bbed3a5948b3807f1fc002f4a6e131ff2753cbba8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662646, "uuid": "57d2adff-1704-45e7-897b-7406d8153576", "value": "49849D003341E436C7E622758F29D6E5671D34A49BB145CF76E86FAF1FAA0E39634382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662646, "uuid": "965a6dd3-f529-482f-83c4-f77af49c8b6e", "value": "789fcca066875e59aafcb5a18bb50d1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662646, "uuid": "15fc74cc-1b63-46fd-9c18-fdd73be91ac9", "value": "6144:h8vockvtMD67Dvy8CyOuq107KjWMTxdtcrsianUAqPt/MmG3G/GERIgg:SwhtCy50mpMTxdtV8AqPtM3gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625662646, "uuid": "24b20bd7-5ca0-4d1f-87b0-4dcaf4c99267", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625662646, "uuid": "5e15cf88-28fe-45a6-9d3b-532c041b20f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625662646, "uuid": "32f43611-d0ed-448f-a3f3-9a90e52c75d6", "value": "Processwindo.DLL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c0f12e-df40-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625675181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675181, "uuid": "ad8b4d56-4c69-4823-9a02-b93d719450db", "comment": "Malware payload", "value": "d7d8cbd7e2980a13704bb7e73211ede8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675181, "uuid": "a331a2e2-6fb7-43bc-bccf-8e0c0b5d1034", "comment": "Malware payload", "value": "eba6c67a247d14d62c04c586e922e1b04bec476ff8fc33b3d9f7afae52c892ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675181, "uuid": "23f70762-d376-4109-b5e4-2b8f55ca4cbc", "comment": "Malware payload", "value": "884d0c9e1a0dd9296100c9d8d4a2ff2eb90c1aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675181, "uuid": "c41d3bf5-4678-430d-af1f-8c1bf5650478", "comment": "Malware payload", "value": "795e7839964fd95dafae03679988bd46bc1ead589a887a3e47af9fc9fddc65690aa96682e1333db9ace150d319235e3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675181, "uuid": "f8e3c7a2-46a4-4e09-b36f-e50d45ce783c", "value": "T10114D15076C2CCF0F4A319360CF5E37F6F3E75128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675181, "uuid": "72a42194-c09b-4a5a-a099-8bc6e6ce05e5", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675181, "uuid": "e0828512-06e6-4dd3-93a5-8315d3f2c03b", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjPpYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjCfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625675181, "uuid": "621897a4-254a-44e9-80a5-63a811748a70", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625675181, "uuid": "64fb9892-13de-4557-b22b-07556032ea59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675181, "uuid": "88ba8601-fed2-4530-9a69-1bfc05735fc7", "value": "eba6c67a247d14d62c04c586e922e1b04bec476ff8fc33b3d9f7afae52c892ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1218d2-df1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625660815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660815, "uuid": "6ee3c7c2-96ea-40e9-9440-d02dab27d9fc", "comment": "Malware payload (AgentTesla)", "value": "089ad091f1fa7081773d9bdc1a917be2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660815, "uuid": "b8d6522c-b35c-4b9f-a83e-d95810ce8dbe", "comment": "Malware payload (AgentTesla)", "value": "ec3b9ae6266490d17024e27220a4bb08e20fbdc93b4bc1850c77386bb588eb13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660815, "uuid": "63d63053-0129-4818-80b0-e27648968c0c", "comment": "Malware payload (AgentTesla)", "value": "faf6aced61ffa2e9ba9e2e1f51004f95c9331e01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660815, "uuid": "44c0f0a5-fc75-4b64-9493-15238285f734", "comment": "Malware payload (AgentTesla)", "value": "8dab1b639d57a966932714386a0fc36ef90acf5a50c9cb73fd0293de1c015105edf1e31b80198a449eb1256e40f774d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660815, "uuid": "7d45876a-09e4-4452-807b-34ac4524ec88", "value": "C984449411CB82B2E6885E4D35C0B1895A35FE9630CACC2A63AECA71DF557F62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660815, "uuid": "575076a3-af0b-4127-b06c-3ca1da58406f", "value": "3072:90BrB2BrBNhK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHjqQpgDUn4VONjP+1MWzPDjZ:MVcVNNqYVdzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660815, "uuid": "dcbd7b8c-9bb3-4805-9c44-df6effd77675", "value": 377838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660815, "uuid": "fae5d481-0000-4fee-adbe-2ecd249d034f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660815, "uuid": "8c6f9d79-d31e-45ed-a637-9cff2767e417", "value": "P O (2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a820753-df40-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625675224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675224, "uuid": "3586860b-ed11-4519-955a-6cd4f6625338", "comment": "Malware payload (Loki)", "value": "81da2c83aea63b92b64303f35299153f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675224, "uuid": "df804483-64a3-4178-9346-23181db02bd9", "comment": "Malware payload (Loki)", "value": "ecc2d36e874e443d436cf04fac29f0d95479d084b69111272a3efa4af07f83de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675224, "uuid": "fad96458-b985-4400-8131-36158c6f1f21", "comment": "Malware payload (Loki)", "value": "523cf3f068ca75461b3534b39506765dbd7ddba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625675224, "uuid": "da6c58fd-f1ca-465f-ad59-7b64c5aba566", "comment": "Malware payload (Loki)", "value": "3a96138d1e77cfa7523b5f63ec3df7c813a8be11f6fe494f7f3278954c2f8e46312c552abd1231c659fd4c21f8980945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675224, "uuid": "93c0ab09-ec6e-4377-82ca-828c1e74bfea", "value": "T1D445CE7A30338A52DEAFC7F94771561E4F6DAFEE904BB6741884B07800F0B5E4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675224, "uuid": "f5652e59-cff2-4524-b969-aef49ed9d8a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675224, "uuid": "1b296ad1-2e52-47e6-b8c5-74016c242df3", "value": "24576:HoR1yIQGDfhVrv5+TgN5ssAlmjM0HfrVEmybmOlJm0biYuWOBfWlB:H0yI7DJV5I45ssAZ0Hfr/ybmcbiBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625675224, "uuid": "1a8a0e9f-9ed8-422e-aa0a-4c7c330ef397", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625675224, "uuid": "4e66c814-b50c-42d7-b6dc-e20c82dd6816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625675224, "uuid": "7aea34e2-f2ff-49bf-942d-d8cee5b8f9b5", "value": "achi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c9bdfc-df6a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625693259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625693259, "uuid": "f8ad377e-780e-4293-86ab-d0784f11eb9b", "comment": "Malware payload", "value": "ca93180aa2ce7a5c551b291610d6e251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625693259, "uuid": "dad282b8-e896-4c9a-a7ff-94e89fd7e1ab", "comment": "Malware payload", "value": "edccccb1ea22dd468ed46cff8a8fa4da4c336ad0a68aa740ddf7e2138af8602f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625693259, "uuid": "eed720a4-755f-4688-859b-543c9442f4a1", "comment": "Malware payload", "value": "1451184bd0515e5eee607a6b8dc2d7d01e2cb36d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625693259, "uuid": "1e5eb608-e6b6-4a8b-a8d7-228e1ad8783c", "comment": "Malware payload", "value": "e74f515587d60d8df3ef49134f9ad0339825c51d8e7cc12aeb623545921adad49df50223122281bc3698f8ca1d8614f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625693259, "uuid": "53dc2808-1064-4599-b81e-204b373919aa", "value": "T13A14D15076C2CCF0F4A319360CF5E37F5F3E79128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625693259, "uuid": "b24daebf-f27f-4bf6-95c5-305198adbbdc", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625693259, "uuid": "21b691bd-8b93-4eed-adaf-4414898f83cc", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjEpYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjffLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625693259, "uuid": "01536b3e-0e4d-4934-89ed-dfe2191d024d", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625693259, "uuid": "c6f42eb6-7453-45a5-a33e-bbf6c097b19b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625693259, "uuid": "2a19180b-1511-4333-8114-550488832c77", "value": "edccccb1ea22dd468ed46cff8a8fa4da4c336ad0a68aa740ddf7e2138af8602f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90579271-dee0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625634164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634164, "uuid": "5272a6ef-b161-495b-a803-492a64c4037c", "comment": "Malware payload (AgentTesla)", "value": "5ff6bf84ac1c67ab29903298e56e004b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634164, "uuid": "99200df7-e4c0-4a1d-be89-6ce58729a4b8", "comment": "Malware payload (AgentTesla)", "value": "ef2b26649c6e913cfb041fc9fa1b415586793139a9393b98f276bf883721122c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634164, "uuid": "e9df5225-5c05-4285-a0dd-d24de16d9521", "comment": "Malware payload (AgentTesla)", "value": "ba6b64ed330cc77c8eb4fbee39423c8bb6003d12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625634164, "uuid": "fb84a72e-2f8f-43f0-8e37-3a114f61eb18", "comment": "Malware payload (AgentTesla)", "value": "b0799a2c136b1ace207aa17d0a486fa6f21bf1df289de94a5df351ae232b3e63617fc9a828f70f4221c91be5a2ed85ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634164, "uuid": "a8d3375e-4e61-40a2-94ca-f5656ee6beed", "value": "BF35B198325361DEF4168431BD569FB0B6103E664E068203E0DE3B5B793A5D6CEC3DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634164, "uuid": "86b5017c-8d2a-41ad-8163-f718cfd75ca3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634164, "uuid": "a7127865-2287-4f57-b8e0-3dd5a182070d", "value": "12288:vxCOUAIOGj37fdf/VfgweJiupOOIJV2jOc7y3UAPDWxT79pjiA2L0G0SZwoQ:vxCOUDBHllgouUOsVEcUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625634164, "uuid": "92f8f4f9-f03a-4dba-8fdf-830fdfb0fc24", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625634164, "uuid": "be024f28-a6df-44f9-a9b8-0a34796ad309", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625634164, "uuid": "ea5e4bc2-37fc-4aae-842b-675790cd5517", "value": "RFQ#17281651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6ed083-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625672951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672951, "uuid": "7b767af9-455a-4891-91b1-a6fe0c2534d0", "comment": "Malware payload (DarkVNC)", "value": "4e7e81192cdefc3d49e3ef94ea719fb5", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672951, "uuid": "34144105-db2f-4a21-b988-5cf0a1578717", "comment": "Malware payload (DarkVNC)", "value": "ef41d62dadb36c9f3eec74500f82a6694ebe728a1fedc2bc7120b925e8b831fb", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672951, "uuid": "f30f9f38-eea0-45e9-b89d-bc51d663ea86", "comment": "Malware payload (DarkVNC)", "value": "d88d6ce051aae36fc154ba73bcb3a5c6ad393848", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672951, "uuid": "3c7e340e-6b53-485d-a793-8a50f0fb02d6", "comment": "Malware payload (DarkVNC)", "value": "e5a7a7b7ad77988440e4de92b2f1c84ac7becd9bd3e6e366164b601dbac56c0f149800bc5a6c7be131668ad0c04c9ffd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672951, "uuid": "ae78d9b2-7733-4c4f-bd58-537a8b51ab18", "value": "T13A450100BAB1C035F4F315F499B99328563ABEB29F2450CBE2D969EE56702E09DF0717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672951, "uuid": "dacfa56a-88fb-42ba-8508-a08d4696d4cb", "value": "f0bfc1cc0e395e0b7ca1dd0906a94aca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672951, "uuid": "f39b0b92-cb80-4628-989d-c58b4fa766a9", "value": "24576:ISS5ZinZtoP9kPm2DRbcoxtNgNxRumQGUogcZlk:IfqkIDiGNmRx/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672951, "uuid": "e2405f61-8709-4358-84ae-a70e86e363d2", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672951, "uuid": "2a08f768-a862-417d-8436-3fb7bb41a8f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672951, "uuid": "f57fe54c-c8a6-41f8-b5c5-1e3f5e824ee2", "value": "4e7e81192cdefc3d49e3ef94ea719fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a73fc3-ded0-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625627195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627195, "uuid": "8c0614dc-65b6-409c-8983-eb0dd040c4ec", "comment": "Malware payload (NanoCore)", "value": "283376fccbdee2a790c9fd37fdd2cbf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627195, "uuid": "2076ae83-6867-4457-b0b1-52550e1e7f87", "comment": "Malware payload (NanoCore)", "value": "f06c1b7b27a12be5356ba89ecfce7ec4046a0bbf83437913a0fb58803c372924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627195, "uuid": "995825a6-b9b9-4e24-a373-9cbee615f60d", "comment": "Malware payload (NanoCore)", "value": "7ecea70da9414697e272426b4b0906d170fac4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625627195, "uuid": "948a3fd9-4e9a-4a97-a0a4-ea9f91b0b4be", "comment": "Malware payload (NanoCore)", "value": "09146c1def4b7f8550896ce89c2949e972feca6437de96ec026ae2b51f41eedccf07d07dccbc622e50353708760fdd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627195, "uuid": "d9a2e9c5-56e1-41e6-9350-3af8a79d4e34", "value": "47259068B2D1D09DF4328578FA569EF09103FE51C50AA50F90EA3ED7763B3C289A185F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627195, "uuid": "16f98f83-690d-43e6-97d2-aa4db75ad3a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627195, "uuid": "c1d7a8b1-8757-4eb8-82ee-d5a4f6aae431", "value": "12288:4rUUrD69y30CNiitfbLu8fLUvs37Ms6n+4XUoa9BL0zsRefXb9nZ6C0PTU/s:4wUS9yEQBtfbLu8fisQN+gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625627195, "uuid": "05e15009-d0d6-4f13-ac41-ea6c3afb88a4", "value": 1033216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625627195, "uuid": "500b09df-7139-4b8d-9251-639b527f916c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625627195, "uuid": "200593a6-9315-446d-abe2-01bec2c9c7da", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0645cbdd-df1d-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625660131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660131, "uuid": "b1e8c810-8da1-44a6-b799-5150c6594307", "comment": "Malware payload (SnakeKeylogger)", "value": "f140377154dbdd3c5cd24db1e55ff710", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660131, "uuid": "4625f17e-d58e-493a-b9f0-93f2e8750c54", "comment": "Malware payload (SnakeKeylogger)", "value": "f0a651414f22a271b0728932c19ed335912adaf2ad0c7edf011230a9632b0a42", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660131, "uuid": "41a83548-6c0d-4bfd-b9d7-536fc47efa08", "comment": "Malware payload (SnakeKeylogger)", "value": "701dfa747cecebb5d88af484de06e443bb03c18f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625660131, "uuid": "3ac6c5bf-7230-420c-9e3d-8e06324c4bd9", "comment": "Malware payload (SnakeKeylogger)", "value": "3dcae4155de54a67a50e16f89b6eaa22d9960f9d59295503e38023256ad1f5eacef84793d537f6d7f879ea7e98e6b4d0", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660131, "uuid": "498247e2-ee31-4e72-bc64-9548100d6a80", "value": "3AB42379B512CF3EF720A25F11CF365C5108E3604690EE2B146BB1FA2A7F1E94D68879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660131, "uuid": "6cd3d7ca-f7ae-4d54-b1c1-30a96d20720f", "value": "12288:btOYh8b+swOGMqEfGWz+Ww+AK8P9efOtMKaSBRed:Bph8SsxDrJaP9VZaORed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625660131, "uuid": "8af02952-912c-4be5-aaeb-23fffeb13a20", "value": 513636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625660131, "uuid": "a0f3cf5a-d6a2-48ea-a5e6-e6cc25450ef2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625660131, "uuid": "0d31d266-956a-49d6-a04e-a56b207ca001", "value": "P.O.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38d15b5-df42-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625676340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676340, "uuid": "85e15c10-a152-49f7-870a-4cb88a0ec8d0", "comment": "Malware payload (AgentTesla)", "value": "cc964f2cac30ffd506fce03e1e47b5c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676340, "uuid": "ae3f8613-b722-4283-97ae-b2869c8ae2af", "comment": "Malware payload (AgentTesla)", "value": "f0f6041db010e4c847ba0c342fe5aa066bf55891d1bfdb20a526199db08cfaa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676340, "uuid": "4df27c0a-4499-438e-8be5-47f71fb49254", "comment": "Malware payload (AgentTesla)", "value": "ec71b80e0ed9025aaf9b7c2aa69d885d4b2263f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676340, "uuid": "8110656e-158a-499f-913f-c5a9a353f650", "comment": "Malware payload (AgentTesla)", "value": "d22f62824bab203b6f15ae823f168c6abbcaa90a1c52348ebc1c4cf70e9b6e8d72544fb7ef11605d1a74b75ac15e9797", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676340, "uuid": "7e888bef-fdc0-4a34-8fd3-c60fb9e86517", "value": "T15DF45A583312719EF4178832B956DCF0EA107E665B0B8203A0D73F9FB91E5D6CF911AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676340, "uuid": "2dff91e3-7ee6-4044-b1af-134f1cabdcfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676340, "uuid": "af612bc0-b7d0-4aff-9a2b-e6f5446354d5", "value": "12288:oUn3QzwEwSCG+YUCRN9+eciLdxRey9gLiNUwF31RxXhP0p79NvSTOkEdUEv:oUnDTtUUCn9+KLdDeyZNUwxfxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676340, "uuid": "88eaba1b-61b8-4cb2-86fe-43724d70e5f1", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676340, "uuid": "bcc98003-d90f-49b0-8e31-740f774322af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676340, "uuid": "1fb58272-3dfd-478b-9b2a-e9da65233036", "value": "cc964f2cac30ffd506fce03e1e47b5c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6551a21-df53-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625683673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683673, "uuid": "e626f676-fcf8-47ec-bb0d-68805d5a678d", "comment": "Malware payload (BazaLoader)", "value": "b50f2fda1d4900544d85d3389d8e831e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683673, "uuid": "6f5a9758-489e-4782-916c-65b7d2196197", "comment": "Malware payload (BazaLoader)", "value": "f1b3ca4b0a085d26eb63b500cad95bc7cbc805df6fdbdea43ba38f2433fee2c5", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683673, "uuid": "3c8f1107-8637-4047-a85a-503e1aff9adb", "comment": "Malware payload (BazaLoader)", "value": "a352a1bb6b61880252d4b0f8e5fe1f9691d1b71a", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625683673, "uuid": "14aed9ce-0e16-4ec1-a04c-93cb10a62ff4", "comment": "Malware payload (BazaLoader)", "value": "f85b78b68e2b2517306ef0338bc1065e20b2c04a00524dd1dbed66ec4236fd986e6efb47eb3d89811b791ee0fc55aa1e", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683673, "uuid": "ed7a0804-687d-47e8-8d98-ddc3314bfec5", "value": "T10114D15076C2CCF0F4A319360CF5E37F6F3E75128A10CE97D394079A9D21AD29639A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683673, "uuid": "36b92322-cac7-41f6-85db-ff0416732469", "value": "d3370939beefe419a1d63a861c0a2b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683673, "uuid": "a0017f5a-542f-4af9-8b67-f6bf4695f3e4", "value": "3072:BWD25zjCr5aJpoDHno4KwMSYhF7Eo9T/QMPsmVR59h1ed7CU+GJjJpYfhKNKtC6:+5aW3/MSYnYoJ/xEm1zdQjAfLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625683673, "uuid": "fa30f037-45b4-44ab-8522-80a48b36ba5e", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625683673, "uuid": "16ce89db-c456-4280-91fc-6ab006451df9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625683673, "uuid": "0fdd809e-4f27-4f46-9f50-571e797f3d66", "value": "b50f2fda1d4900544d85d3389d8e831e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d7db2a-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625672926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672926, "uuid": "3e9e3e65-01a3-4e37-a05a-ea6617a91d9a", "comment": "Malware payload (AgentTesla)", "value": "eee6d8dc695bd59ff6d3533d96584be4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672926, "uuid": "64663230-3666-4e77-a379-1319c26632e2", "comment": "Malware payload (AgentTesla)", "value": "f1b83a44c460dbf9d967fba2ad03945ceb6d0502b23d5abf14175c85244e4cf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672926, "uuid": "c2a01d70-c109-4737-8e39-5f0de4193d30", "comment": "Malware payload (AgentTesla)", "value": "767a64c257fb5e00962c7ce3d5cd294e2499deec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672926, "uuid": "b87eaa75-6045-43d5-b232-276278dc852f", "comment": "Malware payload (AgentTesla)", "value": "d469eba064a8f63b3f7395bce2fd8b43eca3813f666e2722dc531296f2b07a688033af86a0e93ad25924b158d5201934", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672926, "uuid": "c66733e4-93dc-402e-bf5e-edaa7c425840", "value": "T1F7B49D3E6AA52727F77781758A814055F5BC80EB36329DD783C7268C350E9027EEA32D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672926, "uuid": "8395a578-b84b-41d7-88d8-3c8c41138fe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672926, "uuid": "79f99c84-778c-4fa8-87d3-cf9036ded296", "value": "12288:UQC8EKlXgFxY3wBeTqdFdBVOLRG2LIHndi3vZPqjH1WZV7pgly:RUdFIAh9yZPqjI8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672926, "uuid": "e8a71b97-b3ea-46a5-be77-295fd960635b", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672926, "uuid": "246e83a5-7c35-413c-8eda-cea9f17a858a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672926, "uuid": "a287b5e2-668a-429a-8ba8-87f30eb88ed9", "value": "SecuriteInfo.com.Trojan.YakbeexMSIL.ZZ4.26038.20351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c762dac5-df0e-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625654013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654013, "uuid": "6573d44d-192c-449f-a9b3-7b5c40152089", "comment": "Malware payload (NanoCore)", "value": "b229a36fe4c6961995d60d7eb0cd0ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654013, "uuid": "9ab018c2-f462-49b8-a49a-072f78c8457a", "comment": "Malware payload (NanoCore)", "value": "f1e9fd8dc15cf4c038828e3e9e39c7b70c79c676ca8ca025fc93fca7da1602a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654013, "uuid": "186d62d7-dde9-4b3c-9a74-5381e4f01b5e", "comment": "Malware payload (NanoCore)", "value": "8613cca2bd693cd028581c6c12ce8209179c69e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625654013, "uuid": "56806a2f-3188-4381-86f3-19505e0c30a6", "comment": "Malware payload (NanoCore)", "value": "c24044da23ffeb095411756ce66be0e9e212483feab6d31820d9769fb4429257d7e3ac3751400b91526f9d1aafd4bf8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654013, "uuid": "4cc9aa1e-03df-4010-adc9-194cee8e514c", "value": "EA55D07920338A92CEAFC7F94731262E4F6DAFFEA147B6751885B07400F4B4D4A5192B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654013, "uuid": "a03449d4-bd0b-4c6b-bff9-991ba14235fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654013, "uuid": "8c7d091a-a618-4f24-a526-d5d45f18772a", "value": "24576:SYLZLoVILor3F9ZYZgmAU0mqG0FG3LyeuPvx6N0U1zX+S50biYuWOBfWlB:SYLZL/Ur3F9ZYK7U0mjIG3bMQ0U1obiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625654013, "uuid": "0a83a7cc-b79d-4188-a3b7-cc532fb45145", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625654013, "uuid": "18796c50-afd6-4905-ba2c-29525a437fec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625654013, "uuid": "438e9c49-1d1d-4561-8765-eb87bbf1f1d1", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8a1ae9-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (SystemBC)", "timestamp": 1625672976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672976, "uuid": "aa7e5618-c690-4769-a2b2-41d36d545c2e", "comment": "Malware payload (SystemBC)", "value": "dca879ef4e2ae31f1eb398f15434ab02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672976, "uuid": "ca0116f9-1b00-4a72-b738-55d51e00400e", "comment": "Malware payload (SystemBC)", "value": "f207b081630595fb1b6d790e7c43ec89fe2ed88003026f5d0f9faf01c99673e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672976, "uuid": "5d172671-3fae-4187-bee2-1332005c1544", "comment": "Malware payload (SystemBC)", "value": "cf1698d56831e67197652bba3c5f5fdfc1ffeea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672976, "uuid": "24deec04-7d24-43c2-8419-92b062a9f691", "comment": "Malware payload (SystemBC)", "value": "4cd0c6111acd1f78c4275280d7d6eaf0a4bd79a4576c2c27be2338a6b7c6d97bd85f526cde7d30a0d4bb2148c5428eb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672976, "uuid": "27c47e95-2fd2-40e2-86e7-84fd87b6cd77", "value": "T15D847E36F6908437D2732678DC5B56949C39BE403E2958472FE82F4C5F39B813AA6393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672976, "uuid": "1991fba9-73b5-42dc-922e-95b9bec0e2c0", "value": "99330628a6833d5db21e94c072c86e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672976, "uuid": "9b5f6695-2bdf-4edb-a406-d9c54090a488", "value": "12288:l7YLXsOq4s8Nzb8TiDxgBtM7+PRCE0/1tsN9kqpAnk096g4:KrsONNX8TiDxgBtMi0E0/1tsN9kqpHUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672976, "uuid": "ba5be85e-f0cb-48d5-9040-06060ad656c5", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672976, "uuid": "1d277351-0971-446a-b780-c0efc2fb5509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672976, "uuid": "4602a772-28f7-468c-bd2b-810b0b4f2580", "value": "dca879ef4e2ae31f1eb398f15434ab02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba56dd92-df73-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625697370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697370, "uuid": "4b6b21a2-0082-43db-a019-31f26208e1c3", "comment": "Malware payload", "value": "dd51db7619839fd3e1cad9bb78c89dda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697370, "uuid": "3b0f612f-0438-40bf-9928-4b77164b3198", "comment": "Malware payload", "value": "f20c08877642a088709a71585a5ec473cc4c7c356dccca10a0e8d24aa85ba311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697370, "uuid": "b2dd20cd-a51a-47c6-b287-9acdc4c7cc36", "comment": "Malware payload", "value": "04aab7beb8796835e538c7fe48900a06a6220dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697370, "uuid": "d64b2e32-c93d-4776-a3c9-9d75de076aea", "comment": "Malware payload", "value": "89084c4fd603ea01a6d8d782037e152a0093d36d646637fd2f975a0301e74fec25ac7e030bea13208c71e66390f1aa0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697370, "uuid": "5cd0c6a3-b450-4b6c-bfc2-5f47215c7d28", "value": "T18B941227923A1791C6CE437508F6AEB053E5FD548F96ED5FA3D8BE0A68B234607D0312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697370, "uuid": "8de654bb-cf56-45e5-af36-3eb538e65d15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697370, "uuid": "6188e590-9f99-4f4a-90f8-f9a0f98d36ee", "value": "12288:On+NTFxOM5N96snPTrAAmMT5Xhn7W4p1UTBrXhi:EmRIvsn7rAA1dD1UtrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625697370, "uuid": "8eaca09a-8c9a-4b87-8c67-13fb867c74fc", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625697370, "uuid": "15cbb06a-6363-4ae3-9e39-6c3ce1257683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697370, "uuid": "0d337279-16eb-48cb-9b77-af524750db67", "value": "SecuriteInfo.com.Trojan00577e181.16644.7724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c0f837-deff-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1625647239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647239, "uuid": "95621421-7ebb-410c-bab6-9737664f6f2b", "comment": "Malware payload (BazaLoader)", "value": "6111ad5d585ff69d7e2bb01c5467c129", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647239, "uuid": "1831d1f7-9bfb-44d4-8f05-3afa8684a0f6", "comment": "Malware payload (BazaLoader)", "value": "f2caffa263687a0901d68e143af25169d67bac91489d6b62faa2727ed5bb49fe", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647239, "uuid": "f1025438-d943-473f-a799-b0a0ec031dd0", "comment": "Malware payload (BazaLoader)", "value": "a00e02ff397a036c9d25a7d88b6ebdc3e191d3ca", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647239, "uuid": "009931ea-2888-4e01-8e71-c97476a7f924", "comment": "Malware payload (BazaLoader)", "value": "aa31653ba86f102535be671b2ed6b0162d1ec9270c2dda9fefa8c4a44a28e6d9e5291e924a9cc9f929c2ae7b14675c68", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647239, "uuid": "5659e8cd-f797-42fc-b334-483206a73d25", "value": "3DB423667A382CE7E055D530E20314C033B866225E0F7F954D9A987EB6363F1BE81977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647239, "uuid": "8ddef009-5f76-47af-8282-fa59a328523b", "value": "3d1860e67531a560c6cdc03998659036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647239, "uuid": "21186059-3b52-4584-9dd3-6219a88c2e1a", "value": "12288:EJPP27qIgO2KRjw4fdclZPJlq0oEIhsayVwURxCPZTIxFWeUGcEvLqYk:EBP27mO2Ek4fkldoEBayVwgCPaDPUrmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647239, "uuid": "6868aebf-7f37-4876-a3fe-8499f6815eab", "value": 514572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647239, "uuid": "d3ac7a86-c3c5-4c18-b74b-146f4b72023a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647239, "uuid": "1a8208b3-5276-449d-aa68-f18f78ffbe9a", "value": "6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac90c45a-df73-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625697347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697347, "uuid": "6bb4c423-d515-4c7f-8c6e-930d8bb58dc1", "comment": "Malware payload", "value": "72e3782db3445c2de151cf5e2fb78034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697347, "uuid": "7320a505-08c5-4bcf-bf0f-dc96dd55e085", "comment": "Malware payload", "value": "f3323d4e43777b1a8478c3a0951cfcac4d39c68df62c6cd2ad08828078441bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697347, "uuid": "d93e5588-4b5d-45c9-8e41-30b3594a63b0", "comment": "Malware payload", "value": "86b789f93c9718d1c60e6058f7da540957662d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625697347, "uuid": "54d249a5-ee79-405e-b5c0-fc560c5ced61", "comment": "Malware payload", "value": "f6d283403e7a86e13e79918c407296c47b69ccb129e4fa866d6d336079af9fa4856f546ad4919147e52129de74ab206e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697347, "uuid": "6fbf0b8a-e3a7-4b8e-a6fc-998d791ca14a", "value": "T10F0501602650AA93D7BD85744862F2380AF26EA57E80D70F3C9831DD7FB3F690E15726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697347, "uuid": "f8fe2ceb-240e-4ae5-bcb8-f8eecc7a52e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697347, "uuid": "ddd6a376-85e8-45b9-aafa-b89e7e979400", "value": "12288:B+vkKQUVYtXiZbuAK9DlnRaIwte+KGjDqiJFFkHwbuLMjvLeGJZ:zRUVYtXiZaZDlkBte+lqiJTqOvLeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625697347, "uuid": "7d16657c-199f-4d7d-947d-c0754db3d9f4", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625697347, "uuid": "b1fbd1e3-0adf-4d0a-a300-f4fc393fd97d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625697347, "uuid": "efa69c31-1c42-4409-8126-57b7178a4c2b", "value": "o9URDFCGd4GFe5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6adac9-dee5-11eb-875b-42010a9c0053", "comment": "Malware payload (Matiex)", "timestamp": 1625636195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636195, "uuid": "0318d06b-1ba6-467b-b434-15c885eb0b20", "comment": "Malware payload (Matiex)", "value": "759c916d0157b58df46ae66e94cab3d5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636195, "uuid": "205e9a43-ec6d-4220-8678-0b8ad1f887a5", "comment": "Malware payload (Matiex)", "value": "f33bba74414e40d23ced5db86389f2d318e99b9dc2f0e99feb900090c683fcb0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636195, "uuid": "390e347c-dc9d-497e-aca5-87cb06c67be0", "comment": "Malware payload (Matiex)", "value": "259e0b16dce5fdd57aa0136f3761450fa57e0791", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625636195, "uuid": "19e63688-ca7b-474b-9164-827f2dff2204", "comment": "Malware payload (Matiex)", "value": "7dbf23c466f338fe4656bcbe19fc2db525ed6d6fa4009511c830487a67ff75224272963fb340f93c8b526c9a0a4a9459", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636195, "uuid": "97596144-2280-488d-812d-2f801ecf687f", "value": "1CD433EF7FD3D8C18E8C8B322BDCF76031185CF696478547164D8B85AB68859BCA4C61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636195, "uuid": "39ee192b-d313-4884-8de8-78818e7a7228", "value": "12288:socKyyWrl8zgan/pSdny7C8Qd0h3GUZkQU8fRpG4+pMUSzF2:sNLrl8zvxSdny7PC0BGgmSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625636195, "uuid": "024f25b4-1f0c-4d56-bb6d-a3093983237f", "value": 638303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625636195, "uuid": "eb32b05a-3a57-4443-8cfe-d97f12cb1c85", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625636195, "uuid": "80df89ba-c0cd-4cd4-9e1a-b4dd4ec4a6d0", "value": "Order_AY8763CY4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc58072e-deff-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625647552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647552, "uuid": "752da4d9-da90-4207-b953-8212af2daf1a", "comment": "Malware payload (Loki)", "value": "940f99dce1b27c608eafc4e47864fa01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647552, "uuid": "b499bf15-a5fa-4d72-9279-2479e14c54f1", "comment": "Malware payload (Loki)", "value": "f57be5308570597a73f0a1535d209c84c75e1f14e193ad4b670b6f005e1eebd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647552, "uuid": "04e156c2-72d0-49ca-8bd7-092f3e63249e", "comment": "Malware payload (Loki)", "value": "f5fb11d082070e1bdd23991733803f8987673639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647552, "uuid": "3f59a95b-a0a2-4033-95d6-03f2495fa219", "comment": "Malware payload (Loki)", "value": "53dccb9468d342c158e79119d2dd29eb34c9e2ca2ae248aa615eb83d52aa874114fb453cc32d28f407be0eb04c752bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647552, "uuid": "1c6edf47-919a-44af-a0b6-d4393720582f", "value": "0755ADB5A0324A91CDAFC7744732C93D4F2A7EFEA06AA57C18C87C2735F679A0911427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647552, "uuid": "dd3d9152-038a-4b66-ab09-227b1de39eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647552, "uuid": "5601c8cf-ccfc-4095-86ff-0ed0b5d7e66f", "value": "24576:E+12QImOVmh9HjmTRf8r+Hd8wpjwpL/yX6RE+0biYuWOBfWlB71q:E+12QImdDm6r6d8ZpL/yrxbiBBBES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647552, "uuid": "78edad36-6506-4b42-a962-254a8f1d20ee", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647552, "uuid": "aa4a08af-4638-46b8-9c4b-e367124e0df4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647552, "uuid": "01b580fe-137a-440e-a486-f749cc994848", "value": "SEZNAM VESELIH ?LANOV.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9a59fe-decb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625625329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "daa23bdb-8667-48be-bceb-09ca6b4e2d65", "comment": "Malware payload (Mirai)", "value": "3ebd96e2e6a047e1b371570bd914fba1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "f47c42c0-16e4-4cf2-9ffc-8226d840b08f", "comment": "Malware payload (Mirai)", "value": "f68ec0f3a535c1a6641d20655cee494a10ccc9c53df31c7e6c24735bd3da45e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "ec6268c7-a94d-4b57-b3cc-b9c479d207a7", "comment": "Malware payload (Mirai)", "value": "db1ce0336abb5599b7b93c0980d11b95533204e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625625329, "uuid": "4ddc7a6f-179f-4d65-a4ad-2088bf97fac4", "comment": "Malware payload (Mirai)", "value": "ce33d141a72e40997e72643ce173925956d2d546d3c2a8de3ee20b9d0b0a078fb51032fc90240fa4877fbb73d47ac498", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625329, "uuid": "841cc580-f5b8-48a4-b0c6-028dc40953bf", "value": "F67319DAA0014E6CFC9BE9FD92214F09F920221145830B56B3A7FED77F721A98D53D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625329, "uuid": "9aa5394f-c01f-4346-bda1-a6b9ccafc419", "value": "1536:gPB+ugXKa3nn4p64uBRPTfzV7ok8g1ptNO7cHov60jJdyXrv8S:g+n4LuBAkxpSakty7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625625329, "uuid": "518c45ce-6e46-4664-a406-88b0c1c96e62", "value": 76700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625625329, "uuid": "cd6c595d-83e6-4dda-b0aa-eed772811b6e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625625329, "uuid": "0c099ba7-f4d6-43f1-b7a0-2cea77abc99a", "value": "3ebd96e2e6a047e1b371570bd914fba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9267f99d-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625637603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637603, "uuid": "aa74ac18-37dc-4ec4-9f76-edbc3e422c53", "comment": "Malware payload (RedLineStealer)", "value": "38a57abb72d24845bdaf7a2e19bb01c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637603, "uuid": "077826da-2796-4915-b356-13b7889c1c22", "comment": "Malware payload (RedLineStealer)", "value": "f77ee607590d0eea0340f732222a78f3ffdb990c45796075071b051aeb83afbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637603, "uuid": "6a2e1ad7-a337-460a-8097-db10003ec074", "comment": "Malware payload (RedLineStealer)", "value": "fdf0f8bb6279aace5c7e66c698586bea6cb5bfcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637603, "uuid": "94f4dc7a-6875-460c-bba9-0eb6e5415dcc", "comment": "Malware payload (RedLineStealer)", "value": "87da4c42bde5727f94d61b639133ce12798b969f185958a567afd62c4793e2b68a0e00b386ead62b8ea6e6e29b88df22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637603, "uuid": "e1a76cf4-f83c-4fc8-b1bf-101fc426f1ab", "value": "61F4E000B691C035F6F326F499B99369513EBDB25F2864CBE2C466EE1A356D4ACF0307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637603, "uuid": "04939bfd-4f52-45dd-94fc-336c190c2664", "value": "1e8c0f829b104b9959a084b4dd191d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637603, "uuid": "90eab368-127a-4845-9879-4da4fb0f2050", "value": "12288:mOEDmBPLjISQoEMxi3y48AcmtMBPrL7IYa24qmLeMcktg04GOgHwA/WCco:AD6VEqPacwMBPrL7I52PmLeMcktD4dSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637603, "uuid": "c0ca694d-2c71-4e6b-bac0-044923af5e64", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637603, "uuid": "dc42c994-004c-492d-a874-5d1b63361648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637603, "uuid": "eba47824-8117-4121-b1b7-f5b8b4a451e2", "value": "38a57abb72d24845bdaf7a2e19bb01c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866902a8-defe-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625647032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647032, "uuid": "38b2becd-e2d7-48db-adf0-ea08b23aa1d2", "comment": "Malware payload (NanoCore)", "value": "73aba090ec5559f00d6d0c5ce4124b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647032, "uuid": "6047d32f-1e77-4f16-bd1b-472e9daf7b4d", "comment": "Malware payload (NanoCore)", "value": "f7e9725767f9100a6148e82022b6be2602937e013a9648ee98ba2a37091098e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647032, "uuid": "ae829a0c-2d72-4a4a-80d4-b134603b221e", "comment": "Malware payload (NanoCore)", "value": "a1cfd17fab7f39a7b772e6ae8597a33864087191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625647032, "uuid": "00b85575-1ef2-4020-b9c1-9522959612e6", "comment": "Malware payload (NanoCore)", "value": "e206f9131af35ce06784508628e6f9eb9f7dc6269d19fea943b09f95704513737d17e441d169d45c584670ae819fbf63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647032, "uuid": "bd4c6269-60e7-422b-a936-a44e6f4fb297", "value": "FB55DF7A20338A92CEAFC7F98731551E4F6DAFFEA047B6741888747800F0B5D4A5592B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647032, "uuid": "f1b785b1-e516-4c98-b9a9-98867a549788", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647032, "uuid": "1c74a700-7102-45a4-93c7-16f67673d89d", "value": "24576:UVxxBR2kXdDUNKDv2eKWnmX2QtU7j1Os0biYuWOBfWlB:U5mklzDv2GnmX2QtUj4biBBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625647032, "uuid": "ca17dfe3-0d1e-4b96-ae0d-cad739a1414a", "value": 1300992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625647032, "uuid": "fa30d04b-e586-4358-91e7-b8db3269486c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625647032, "uuid": "432d951b-97a7-4891-bf9e-8999aeeeceb3", "value": "QUOTATION AND SAMPLE LISTPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6931ca-df43-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625676763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676763, "uuid": "cad1da1b-137b-4d25-88bf-52a780277bb1", "comment": "Malware payload", "value": "0881905bfaabb65890b8053675f4c41c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676763, "uuid": "efebd026-d4de-456c-a861-934a70a114c9", "comment": "Malware payload", "value": "f94c7b2fad1844565378a3df0132f195eda60167fa8fa02adbb2e415582cd4a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676763, "uuid": "4ca9d86b-be2e-4f87-940e-2441da0a1b7e", "comment": "Malware payload", "value": "c4f16c731cb92f6b055e02c805108b78cbfa81a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625676763, "uuid": "4fa4e01f-aabf-4f23-bf46-fa6effd8f19c", "comment": "Malware payload", "value": "c5715dbec8733ccf865d594f0fad9fe4cacdc63ae620a14936f77938a69fdd3af3ef562a6b40e4aee5d8865810df8b06", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676763, "uuid": "5129288e-4bea-4500-8b70-f5a7c84ed278", "value": "T12632D6B71B079375D938357B4E2A848C6FB44B920B251373B24CB2289CDA37E645A376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676763, "uuid": "e21c2b83-fe09-492c-8ab2-c4c11bd0b913", "value": "befd011f90184d7406f46fd7bf9ac681", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676763, "uuid": "96a6e09f-36dd-47fe-b6c7-d91abc58f332", "value": "192:C0momnF+U5oK21BGJRMu2KuWTCK15phDwVBJMd4gZY6S9Gmp:S/nFwXUMtXyZ9w/yDS6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625676763, "uuid": "99e1d0b2-0e56-4f95-8627-5712a5e37f7c", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625676763, "uuid": "bad89b22-8286-4591-870c-1009ae7fd4a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625676763, "uuid": "cf8e4b21-09a8-4b98-8f59-1b9d5da59eb0", "value": "SecuriteInfo.com.Variant.Barys.126731.4167.18541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b968cf62-df5f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625688779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688779, "uuid": "59ae3c41-d626-4c50-bb64-8e7343207b26", "comment": "Malware payload", "value": "1d700b208c65ca26efe5fa4be4749569", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688779, "uuid": "519d12c8-23bb-410c-b410-2a6f089fead4", "comment": "Malware payload", "value": "f97954d9c80dbfee223fb704863c5a156912f450eee2d0510af6301dfd919f09", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688779, "uuid": "72f16688-d9b1-46f8-8afb-e08d04f07395", "comment": "Malware payload", "value": "3deeff224b359ca2b28a841a116b84b783206adc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625688779, "uuid": "8f8cfdbb-8f95-413a-900d-d405d486fefc", "comment": "Malware payload", "value": "d189f4c33175cbdf7224d527afa9fa0c67fb13898a2dcebe91a06fadd713dd6e583a11b6f0df2bb1341adbbf5761607c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688779, "uuid": "dadd1bca-4d82-4d9c-8cac-8645e2e16ab7", "value": "T158E48C103399F821D2E663328F61E5E44B4938241B7515CF3AE83BAF1F6D5F3AA25316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688779, "uuid": "22f98d01-167b-4bd4-af42-4d3459c7c8d8", "value": "5f2bb841560675d1d7ae86cf967cd2bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688779, "uuid": "de1b068b-2691-4c14-80ce-b0474cc3bd77", "value": "12288:A1Xiy+UrnWHWzB2nWSgg6Uyan4jN3PMLYHBlIfNGwOF4IurIU+ls:JlUKQgWfg6qkHMOF8IU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625688779, "uuid": "c10c0f80-8c39-46f1-b9ac-a24b4786b3b5", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625688779, "uuid": "ace40ee6-ce86-4ac7-8b27-9b9438e14c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625688779, "uuid": "1087e382-f36b-4728-9275-35f08c9fd7f9", "value": "favicon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caceaea3-df0c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625653160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653160, "uuid": "798bb425-9aa3-431a-abf4-8c5805428e0b", "comment": "Malware payload (RedLineStealer)", "value": "e02a33e22776a56ea53ccd8f9d1afa7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653160, "uuid": "227284c3-b6a7-43ee-97e7-5d38c6e8131f", "comment": "Malware payload (RedLineStealer)", "value": "f9c2f3c090ddc6fcf53b1a8704164658c4e8bfee2215e5a3af8642da9e2b7b78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653160, "uuid": "0cfea74e-077b-49b6-8abd-d4a7132b6b24", "comment": "Malware payload (RedLineStealer)", "value": "5b09b60da63a4170e1a8385faa5de64739e66386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625653160, "uuid": "c40f3555-2d2b-423c-898a-df3b918c3d51", "comment": "Malware payload (RedLineStealer)", "value": "70581fe4af9d94d1b35b099814928970ce15a8fcf71ae9642af3ce21821b68bd133ba2bb3ded68eacd52be9315cad36d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653160, "uuid": "6588c903-73e7-40c2-a046-6af33bd3a061", "value": "14742628647FC01985E3EEA12EDCA8FBD99A95E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653160, "uuid": "50243cb4-edfe-4121-8744-c6d4b117ffcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653160, "uuid": "c8f6ee6d-1237-43a7-b488-40dcc7d507ec", "value": "6144:Qd5Yqofbync0oYPTTSHELkb66Tv/RjU+:Qd5Y3fbynchYPTTSkLkb66TvZjU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625653160, "uuid": "32fe8ae4-378b-4233-8198-633f5cf2640f", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625653160, "uuid": "18401a10-c89b-4e2a-8828-95a6a7f14977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625653160, "uuid": "a898850b-1c14-4128-8e7a-5e8299d97982", "value": "e02a33e22776a56ea53ccd8f9d1afa7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd406042-df77-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625699093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625699093, "uuid": "ee074683-a64a-4d5f-9c75-5dc505e53f53", "comment": "Malware payload (Mirai)", "value": "ca291e23284da50c2280aef5fc527d1c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625699093, "uuid": "74e7b46f-3a22-4a46-a035-5c72055f7da9", "comment": "Malware payload (Mirai)", "value": "f9ee4aabfeb080303c9bfe9fa0981c02bd77db9a832d58bc3d3e0b02936f1b93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625699093, "uuid": "5749a123-d130-42c7-8c33-4c7ab45f30b1", "comment": "Malware payload (Mirai)", "value": "4ffc1e17ccd66655858432282c67c60572ff6e4a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625699093, "uuid": "706140dc-9feb-4c2c-b8d1-a222469b7a9f", "comment": "Malware payload (Mirai)", "value": "ada2ae1c89ec8abfb59fd4f6ef6c3b0f510752cb65ac6c4d21f98ef47b8378bbb91baa77a129a2e4e5e0daff76dec502", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625699093, "uuid": "4133ea28-5b7e-47f7-96af-dad1b2f9f35e", "value": "T10D543A8AFD81AE25D5C1267BFE2F428A331317B8D2EB71129D145F2876CA94F0F3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625699093, "uuid": "50b5ebb6-5a26-4aff-9bb3-bf6ba3b73407", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625699093, "uuid": "d6013ac3-d96f-4c2e-a474-11b7b4c51d00", "value": 294256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625699093, "uuid": "9973e5e9-ea22-4780-b0cf-41cc49020bc4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625699093, "uuid": "eaa860e6-0147-4cfb-bf2b-cf442c581a57", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1490ba44-df27-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625664450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664450, "uuid": "7bc85694-4e30-4cfa-bc8d-58cf2c576d4e", "comment": "Malware payload (Formbook)", "value": "6ddefaa934f93d73167d08364a040b40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664450, "uuid": "2971746a-5de4-4226-92bb-55b0abcfabc2", "comment": "Malware payload (Formbook)", "value": "fa5314d7ed599d8ff5bd77f3e0d7ac0988ba1352757bd7715c375ae8009f8107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664450, "uuid": "f8193da5-4525-4ec0-9426-0ba8fb8edb93", "comment": "Malware payload (Formbook)", "value": "1204fc2995241f1306c2c0060f50f241a5f74fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625664450, "uuid": "b99f5967-a416-4405-9ec7-a2c75f8e2f87", "comment": "Malware payload (Formbook)", "value": "6ca3fa9931dbe15ba5cf5c942c6130f467d715ecb90f3c0d4bf51f1e73c741936b371243f3849d37cf19035dd53fccfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664450, "uuid": "b52adc4c-0e78-40bd-a2dd-dadbddadc99e", "value": "298412A637744B61D7ED0272089B9CB013E9ED1B1D20E607EB897FDD4A377084BE2658", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664450, "uuid": "d45bf661-e57a-4ec2-8f94-1cd232c6314b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664450, "uuid": "735ad6de-b34d-4bed-96e6-be70724b7b1d", "value": "6144:6HZdHwSLlIKC0qgvYnsJet8874qs6aQDqh9XBcF6PERIsKgLeD1fmyvE+ESAfvW:65dHxIKSmYMevIXBcMPds6D1f1vxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625664450, "uuid": "f0ae1e42-3102-4987-8e4f-b9665775059a", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625664450, "uuid": "42841b63-f71e-413e-ad76-c5465bbd70c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625664450, "uuid": "bbafa031-93e4-4882-8cc8-022bb1bfcffb", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf83863-def7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625644144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644144, "uuid": "b8171fe1-8052-4906-b8c3-df8b78cab0c3", "comment": "Malware payload (AgentTesla)", "value": "56493c470154ab3f05f06df7d87bc98d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644144, "uuid": "48de09df-0c69-4f40-ac71-7b829aa0b715", "comment": "Malware payload (AgentTesla)", "value": "fad29843768b7dc1c65669f75615d0d1435848479132095a1590a7cd667c8fed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644144, "uuid": "e9024b69-a55c-49f9-bc60-70c8662e59c2", "comment": "Malware payload (AgentTesla)", "value": "701e51fa114b2fcc2c7c6d8d03838f6368ad9c42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625644144, "uuid": "a2f096c4-5ee0-41c4-8ba3-49177d83bff0", "comment": "Malware payload (AgentTesla)", "value": "ad12196f654bca59fd92d2e1999e77c94099cdd9386fbf35c837418323ea89fe28c5a15f7f097c281fe5666a1bfbd168", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644144, "uuid": "8cf9a0f6-f41a-4902-9b62-bc49bb525ed7", "value": "6384F18225581532E5A80DFE902873C90EAEDE874B25D2D9A53F3DF8BCB518167F4387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644144, "uuid": "adda24aa-0e9f-47d1-b2e2-cd8e314d751a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644144, "uuid": "1a4e9548-44cf-4079-af0b-1451ab3cfcee", "value": "6144:+rQgGxfcyEwZa2n615JXaGe466Kxtwn3p1np2g61Uv81i:h7xU4b6bJXaGp69QZ1nMwMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625644144, "uuid": "4f497780-0ef8-4809-9268-b4c1d58c9e9d", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625644144, "uuid": "55ca5113-2dfd-4f3a-9ebc-493530f54cee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625644144, "uuid": "a235a654-9994-4fb0-b819-18df157a24a9", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84af9339-df45-11eb-875b-42010a9c0053", "comment": "Malware payload (CoinMiner)", "timestamp": 1625677523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677523, "uuid": "0aebade7-a05a-4c1a-896d-4d30846d3c34", "comment": "Malware payload (CoinMiner)", "value": "ddd1b892cae78b0b9759353bc4f0b2c6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677523, "uuid": "cb17adc8-9fa3-4fd8-89dc-70d2b1c7864b", "comment": "Malware payload (CoinMiner)", "value": "fb49ad3836c334d8d06a36a45994eaa52d7629ecbf765fe46aa53825aef56e56", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677523, "uuid": "bd50d850-10fd-49f0-b2d9-7478df9d5702", "comment": "Malware payload (CoinMiner)", "value": "29b088bc617ce93293700232ba864ecc4e5c5493", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625677523, "uuid": "2610f44b-ee60-4a36-9f4e-6ff395679937", "comment": "Malware payload (CoinMiner)", "value": "2649dd664664a3a2c168aea7764cfca242b5761a9d58596678044e9b5fa0d62416e61e275931f250782af8ed37d03a52", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677523, "uuid": "a91d3e7d-924b-4eb0-b69f-dd64ea3ce05d", "value": "T1D5046D1D5F8BB8DBE4240AB558A7E7D1076DEFA5F1E1069C30E9BE3CB7924748500BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677523, "uuid": "24cb35d6-86f9-4f0e-be0e-8dbba0cc785f", "value": "3072:+9vtF0Ozk97zkoF7FlKJvtNK/Iqr3ZbgMwxHHUtoGO2SDb:O4lLHUjK/3DOfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625677523, "uuid": "4542d6a2-54e7-4840-b492-d4b53f8fe74a", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625677523, "uuid": "49ae9cf0-5a19-47d1-b282-67c61f9788a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625677523, "uuid": "c43018d0-988d-474b-8f4e-7c78bbf1c1e6", "value": "ddd1b892cae78b0b9759353bc4f0b2c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e51483a-dee8-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625637623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637623, "uuid": "98f99728-7657-4a11-9e5d-8233473617a6", "comment": "Malware payload (AveMariaRAT)", "value": "3332bd8b25195d9f8f21b3652b6996d1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637623, "uuid": "023e46fe-999a-4209-9ea9-44d8c50134ca", "comment": "Malware payload (AveMariaRAT)", "value": "fbb0ee521cf87e105d6a687a2e2dc5187b10676576e585fea3965ba62558f536", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637623, "uuid": "9856b0e8-cc1a-4e6b-92a2-22c927d2a1b6", "comment": "Malware payload (AveMariaRAT)", "value": "8714b737759e7f74eb065b1c8387f01e689e4253", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625637623, "uuid": "fdbd7e63-1560-4a77-9b79-e178a9a65415", "comment": "Malware payload (AveMariaRAT)", "value": "0d50b0dd021b093b0d3f6f01dc28a19048971f9ca410bee0808dd3f690304eb9a296c6db379bd0d082e65c73dac3a7eb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637623, "uuid": "82548ea5-dbf6-4144-9308-0d6afffea278", "value": "43B39E13F7E54835F3B201B01ABD7E6ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637623, "uuid": "991226b3-7af1-4564-bb89-6d8ac9443d0e", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637623, "uuid": "71b128cd-daa0-4d4e-a160-d97d21d87880", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01/:K1VmhaH8EFvW+0OVE05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625637623, "uuid": "6a782318-50d9-48e3-b28c-715d54dec215", "value": 111612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625637623, "uuid": "68a01d7c-6402-4d12-b0ad-58fd49490b2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625637623, "uuid": "1a54eb16-6add-44e2-bbf1-df5b2d2b0e25", "value": "3332bd8b25195d9f8f21b3652b6996d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b642cae7-df3a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625672882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672882, "uuid": "aba99ec4-c789-4566-bb28-5903fc731912", "comment": "Malware payload (AgentTesla)", "value": "804aebd67b3661d6ab370f8c524da199", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672882, "uuid": "a195674e-260c-4dd6-a70e-f1c04e654a5a", "comment": "Malware payload (AgentTesla)", "value": "fd110cb1dd9a7cabdb7ef29dc7d7b7bf9a24433115723031669e4dfeaf1eb76c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672882, "uuid": "dc9b3abd-e45a-4eb9-a92f-76dbcece3432", "comment": "Malware payload (AgentTesla)", "value": "9b0732ecfb8d156332b164afcfdd9f2c2e0b55e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625672882, "uuid": "a2122b3d-368d-40c4-8c5a-be2804a49d76", "comment": "Malware payload (AgentTesla)", "value": "d7226bc7092789c429a3c4f945e5c09ef8057cd8ea0d5b9c70031637d156fe7c79fcfc7ed341439eb7f6615a9a0c43d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672882, "uuid": "37fe60d5-6efa-4335-a2e9-d62d091e55c8", "value": "T1CEB401806A288632D5A80DFF886973C40E6EDE435721D654B53F3EE5BCB634187E934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672882, "uuid": "cf7e4ad0-bf90-4a25-8e06-c555dbf7fcb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672882, "uuid": "1fcbd58a-4d52-4953-95a1-f08f32f8a927", "value": "12288:zP9l3U8n4gHaSxcvOY8AHk7S2opLFYZRzG59oBLb:hRzYNhppYZgcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625672882, "uuid": "641f17d5-0469-4393-9910-7193643c601d", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625672882, "uuid": "ef4a6133-0b3d-48ac-9552-df9752615816", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625672882, "uuid": "0a44e28b-7bc6-4925-8cba-3fe4658931fa", "value": "804aebd67b3661d6ab370f8c524da199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b84dadf-df35-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625670555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670555, "uuid": "85016524-6d05-4f79-8667-0b59d789c9e4", "comment": "Malware payload (Gafgyt)", "value": "acde176fc11a8205eb37124c6435c23b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670555, "uuid": "9425ea7f-57d0-4c80-af20-5b91029c03d0", "comment": "Malware payload (Gafgyt)", "value": "fd9bb374448f01496520ab17ff83472214b1b99ddf7985abc0a820f33fceb904", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670555, "uuid": "7aaaa8de-5ec5-40f8-bb00-7e12aef04760", "comment": "Malware payload (Gafgyt)", "value": "4a3ef519f939ab932aff320a16ad70648b02c71d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625670555, "uuid": "d228196b-b9a2-42b4-b1fd-0546b713dfb9", "comment": "Malware payload (Gafgyt)", "value": "e614662df0155082d1e5b59e05084c75286186edde9d12b90849436a3f1ed58ff451b48d8c3da11c8dc86c7ec69ab48e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670555, "uuid": "8f90e3e3-20d1-4794-96aa-69b5d566d97d", "value": "T170D3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670555, "uuid": "e5e02531-ece1-40ac-a2c5-afb79f5367c3", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+pdAOhmm/QMurB12CGNb:RrUlkdXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625670555, "uuid": "012137d0-c2b1-48ef-897d-720ddeac9ea9", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625670555, "uuid": "25aebf4e-63b2-4e64-a92f-627f7264f2d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625670555, "uuid": "0f4aa515-cd64-453a-8892-7c6659990fe1", "value": "acde176fc11a8205eb37124c6435c23b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910c2daa-df02-11eb-875b-42010a9c0053", "comment": "Malware payload (WSHRAT)", "timestamp": 1625648768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648768, "uuid": "63251e84-da79-4aaa-af26-480d4ad937a8", "comment": "Malware payload (WSHRAT)", "value": "cb60009572a19049b91278e09e9bed49", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648768, "uuid": "1bd691f5-5634-4596-8c1b-9221aed43296", "comment": "Malware payload (WSHRAT)", "value": "fe5e2a9329cebb7abf2422e401032c90d1a669a6209b00c5fe40f66e664c2d9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648768, "uuid": "e6ff5b30-47a1-4ec7-8dd3-9faaae186f00", "comment": "Malware payload (WSHRAT)", "value": "1bcd5a69c3f28bc00d22533f774fd43b06279d14", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625648768, "uuid": "ce8b7180-ebc6-4bad-bbfd-57faad534752", "comment": "Malware payload (WSHRAT)", "value": "15c377e6104a81fbb1afa975f805d6686550f9db996b5b87e91cf64f5670d45babc01d066788f92c6f167a01ff98a118", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648768, "uuid": "f41028a7-cbce-40c8-937e-48e8930615bd", "value": "C025B1C2665DBB27BB93EE06C25A57132474C723091F3C11FAC23F889F5A88469F99D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648768, "uuid": "5c4e4fee-b97c-4f28-a590-14df1c285917", "value": "3072:caq6zCbggueDnVtuTgj9QH2mah7nZMBTw1pKP/oMzG11GGJ:caq6zCbggueDnnuc4NBUpKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625648768, "uuid": "4d4f1e8a-8715-4e2b-8b4f-b1a96e9a9f29", "value": 1016619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625648768, "uuid": "f93cbf81-57c0-462d-94b0-4f5b1bf7b7a0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625648768, "uuid": "0e503c20-548b-45d9-9c90-ba27bf9f9e07", "value": "scan23421.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783392b0-df3d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1625674066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674066, "uuid": "8fb10499-81c6-431f-8272-23fcf68eb54b", "comment": "Malware payload (Dridex)", "value": "69d66e5a2cdaea02a13ce56a9054296b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674066, "uuid": "ad9b5cd9-81b4-474a-b58e-c3838dd7f4cf", "comment": "Malware payload (Dridex)", "value": "fe97e3780a2cb4f2693a8768c7c2c139a1a46553f6cbf487f80caf3eaa21a7b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674066, "uuid": "4bbbaba1-4305-4aff-ac63-aa216c610719", "comment": "Malware payload (Dridex)", "value": "5d02ab2d21288a708346a7c941e2f564710b03c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625674066, "uuid": "bacfbc48-bf8b-41cb-b49a-1dc091fa8c62", "comment": "Malware payload (Dridex)", "value": "21d79df8f45e47677f82e94bb2efd51508755079ec432217807575e14bd5f4a696ad496311dbb361906bdc3d8ec3e354", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674066, "uuid": "8cf62d0d-b837-4814-a6ef-c30c2f3a8dfe", "value": "T140441247CA4F73F4C19BA3319151A13F2E20258ABF18E4FBDA651C03CD8D5959A7A7B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674066, "uuid": "2be4ae65-8f50-4f3c-9956-e261613e212d", "value": "4760b63b249352350fb67b805f5d8b2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674066, "uuid": "c70f36b2-cadb-47e7-88ff-55e9e09bc67e", "value": "3072:PwEYUOZgqLerAZN43UFui/XhLh7keqwxncf8Prs6aZQPacsWZdA+juV05R7v+blb:YnUOZ3DPSUNXBFkwPnPacFdlW4R/8g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625674066, "uuid": "73d95505-679b-47d3-b3ec-eb71cd43b6dd", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625674066, "uuid": "aaa82f26-2bdd-4dd2-a6b7-83ae300a48e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625674066, "uuid": "bc9de40c-0cce-445c-af53-6cf83e7a93ab", "value": "69d66e5a2cdaea02a13ce56a9054296b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }