{ "Event": { "published": true, "date": "2022-05-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-05", "timestamp": 1651795381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b15a87e6-0092-479f-8b99-fef28d128ead", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb11a50-cc4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651739693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739693, "uuid": "18224089-b493-4193-8552-c8a28c612dc9", "comment": "Malware payload (AgentTesla)", "value": "472105ec41fb80ab45ed5e0f9e1d5451", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739693, "uuid": "f9cfa721-1723-47f1-a121-4984c154c6d4", "comment": "Malware payload (AgentTesla)", "value": "00b9ececf2bf61a3abc48f4dd3206c3fa96c5398294858cae33f4476faf70c11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739693, "uuid": "b737adc9-e65c-451d-a5af-621fcac4828b", "comment": "Malware payload (AgentTesla)", "value": "7f85213e3a91480d2dffbc41d2d5763089cbd84e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739693, "uuid": "149509b0-49d1-4dd3-bd9e-18dd4c17d479", "comment": "Malware payload (AgentTesla)", "value": "be4808986a7084ad04fc1d3b9706eb4a7fb5dfd5ad516702a75f8b8da73b62a404831700f88a32e5331c09f4ad3edfa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739693, "uuid": "2b0c23d6-a413-472a-8153-477223b8cbab", "value": "T198D423353097D6D3FE701B76712A4EDC2781A646ED07B04E3BE6314B998FAD23E4A409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739693, "uuid": "0ab7fde2-573d-46a9-83e6-a468ab08491e", "value": "12288:LKSeLdPTN22KqKUzG/xoZZD6xgoL3e6FKs9FmjKSdKOTfk0yQ:LKXb22KUGoZD6yYKs9ZSdKgfryQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651739693, "uuid": "8e362208-3d22-4650-a836-2eda4acd7ce8", "value": 601298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651739693, "uuid": "6ce522b0-5388-4255-822d-9516d3a5721b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739693, "uuid": "68c32a52-5e4a-4f0a-9ffc-0883daf12a5f", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71288504-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746224, "uuid": "6ab71701-7918-4a2e-aa2c-1cea226f0e98", "comment": "Malware payload", "value": "f0b718dcf462120bd188d3a94d33d1bf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746224, "uuid": "684b598c-6f78-4e8c-a254-f139afcda87d", "comment": "Malware payload", "value": "02f74ef12bfd2bc315ceaf130d8db99c447fe5dbc764585ab8eebc90ecc35a5c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746224, "uuid": "7f6e843d-575a-4895-a89c-f80e1614e4bf", "comment": "Malware payload", "value": "79153d4f9e79485c4ba69722f94e2f20efcfd518", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746224, "uuid": "401e3a00-3f0f-4ec3-a0e9-f732439a7551", "comment": "Malware payload", "value": "d178789843e896670d70428690111b0bf8a1d6376f38b1672302de8e29c95a48ea89e4a43b0b7bc1bd2a1578fa83b6bc", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746224, "uuid": "f259205e-bb39-48b0-a814-3e3dc4b4f6e6", "value": "T1FC22E81677E88B39D17257739DBBD60003B8BB91E413CB5D2988610EAD733D00A93BE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746224, "uuid": "3445ecfd-d5b1-4b68-95a9-78d7d0dd7943", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746224, "uuid": "f622a550-2e2d-456e-96a5-43b436a4c854", "value": "192:i4SNCLKFNayAc2ZNKSTzMo0V2zYpYKnJU9n6:iPNCLKFNQtMoFQu9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746224, "uuid": "6de4c42a-ac47-44d7-85fd-e2456c0b909b", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746224, "uuid": "bc4219d8-161d-48e9-91e1-913a42da930b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746224, "uuid": "a34549c9-690e-47ea-ad4f-98d36f8c3bb3", "value": "DHL SHIPMENT DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a22b271-ccce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651794718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794718, "uuid": "da76f187-85db-4b65-ad15-70419b205562", "comment": "Malware payload", "value": "df6be762004f40caecfdefd028a86189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794718, "uuid": "c575329b-5dd9-4843-8aea-9b553961af35", "comment": "Malware payload", "value": "032abd951b79208291b337b1b87d128d90b4b7401f0426ee469abc3b693bf52f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794718, "uuid": "a63a1707-9da1-4ed8-9b8a-8c8566781763", "comment": "Malware payload", "value": "3d451efb4c14b767dc890bd2e4f93f90634d41c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794718, "uuid": "d372847f-a785-4b32-9faa-c31749f4bfe4", "comment": "Malware payload", "value": "484da5b25376253717876f333c85fef0312b0716f5bedcdf2e7d0557cad2cdc03c82abdf2b5ee84db1c75cf2e6b4f245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794718, "uuid": "589a9d86-f984-4d06-99c8-a290f161e3bf", "value": "T1A8C2E72C33B68232D2EE067E4562EA5153B5D44BF223FB0E4CD994DD4B5B38A0A41FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794718, "uuid": "eeb95f09-a79e-41e9-9971-ea879c2e53a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794718, "uuid": "d7fbd95d-4ccf-4b56-8afd-7f67201b9aef", "value": "384:SLhmRdJGown6EQl8XZfCPPuthlMDAQk93vmhm7UMKmIEecKdbXTzm9bVhcaF6xrZ:MMk4X2SDA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794718, "uuid": "abaa302f-b75b-4db8-953c-c2f2a2366e05", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794718, "uuid": "d75a9a72-9a4f-40a5-b322-de84f1d52181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794718, "uuid": "de2057c4-c982-40fd-995a-8eb49b809e7d", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2390c508-ccae-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651780883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780883, "uuid": "44f9677e-6711-4492-9aa4-8b00393754e9", "comment": "Malware payload (RedLineStealer)", "value": "c72ff15651e341c78101d5133a8fa31c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780883, "uuid": "493b497e-48dd-4ff5-8091-a117fb6e75c4", "comment": "Malware payload (RedLineStealer)", "value": "04eb472779a21aaea0da53a19d85d756172b3bb387d91a07d43e907f296504d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780883, "uuid": "b905c208-a674-4f57-8d08-34e11ba0df30", "comment": "Malware payload (RedLineStealer)", "value": "3b13c67d80ad2127f7089fb59d2b0a7a58cb6021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780883, "uuid": "b68bad1a-ec59-4ce4-9648-f054430be532", "comment": "Malware payload (RedLineStealer)", "value": "9a8b5693148b592438a30aeaf201d340c22faaafc7c8035296f43f7635f060f1ee4f0cc4513f9b4297cd5ef1a23b8027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780883, "uuid": "31fad007-4598-4d8f-9c84-301d6996adef", "value": "T1E884C010BB90D031E0B316F58979C368B63DBEE1AB2155CB53D46AEE56386E0EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780883, "uuid": "78b86a43-a2a4-46a6-bdb7-71e2c7dcab02", "value": "d2344da305ac679e4aca3994db751dc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780883, "uuid": "6dd28870-88c1-4fb7-95f1-331996827bd1", "value": "6144:dPW3Uj2utGnYrPht36KlZ26YZGkcbcH1hbKssV2DiFzwFlnFP:dONuAYrPhtnlZ23ZG9bMFv7Xln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651780883, "uuid": "33d1c5aa-a8e9-4d05-b504-7cbc4585c851", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651780883, "uuid": "22fb209f-1a0e-44ae-8e32-59cd508a3025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780883, "uuid": "17d1df19-ef62-4063-8701-68f8b0a55537", "value": "c72ff15651e341c78101d5133a8fa31c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a023e22-cc8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651767096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767096, "uuid": "82ca1dce-d062-41c1-bdc5-f05713e512c5", "comment": "Malware payload (Mirai)", "value": "700ad73454c8a9e54df82d77543aba34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767096, "uuid": "6e11ede9-03d2-4c9c-b7a9-6c96badcfb5c", "comment": "Malware payload (Mirai)", "value": "054a72f6f307038c98291845eee3543f25438cccc05c831fd27079e176990eb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767096, "uuid": "1ce8d1eb-10a9-4830-ac2d-d28dfd285353", "comment": "Malware payload (Mirai)", "value": "5a67cfa8ffc9cf4c3373eb688be4ff3fb13cd83b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767096, "uuid": "528f44ab-5dae-43bd-a97b-a899832861dc", "comment": "Malware payload (Mirai)", "value": "0c208aa068d180e7c68660ecd068a10e5d8fe1496909d3c15e6dad714f519268893e77c5e8ac05b0e61d28940ac643c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651767096, "uuid": "950d0fd3-16d0-4181-ae30-7a5a7dd498ec", "value": "T15C833A857840A622C6C952BBFA1F024D375523D8D2EA330BEE245F7077CB92B0DA7756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651767096, "uuid": "a253c210-bbbd-488e-becb-410d3c39e86e", "value": "1536:wHdfrfLTWVs00uGsFh7OSTOJnT22vZN/Lgfvcc5nF2Y:wHBrfLTms005szi1T22vZN0UcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651767096, "uuid": "cae7e391-c1b9-4b1d-9db1-c8758f58b131", "value": 84172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651767096, "uuid": "d5d39f42-50e6-4ea0-9ac8-c8b5dda86746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651767096, "uuid": "770cd5be-6c96-4c75-83b9-33a29b978da6", "value": "700ad73454c8a9e54df82d77543aba34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45df47bd-cc7d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651759895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "77ede56a-7039-478f-8ede-d1e1d387d14a", "comment": "Malware payload", "value": "1c32d785398e3a7eaab0e9b876903cc6", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lure", "colour": "#6D457D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "a538e3ab-24d9-401f-b4a8-8794a7344433", "comment": "Malware payload", "value": "0622971147486e1900037eff229d921d14f5b51aac7171729b2b66f81cdf6585", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lure", "colour": "#6D457D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "7e356df5-d373-43d4-8456-265382f903ac", "comment": "Malware payload", "value": "3dad168e79bc7f421760c98a8b6be2e1630a63ec", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lure", "colour": "#6D457D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "0cefdb7e-3ee9-459b-b486-b561d139fda1", "comment": "Malware payload", "value": "89e91c937291446d0b0b2f85666d7affdf48061b1d2b6a22515a260225bd4df94e0f0fcdc02c773cef8e671ce1646802", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lure", "colour": "#6D457D", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "a6ed3c34-31de-4cd6-b738-8113ea97a703", "value": "T199A1B89DD9F279841081F5107BC06956C8A750CB24841C07B9AD8D9F9F00F93AFA36E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "d6b07bb5-fa4d-4284-a420-04fd65eb3736", "value": "48:PBtPTwN8gkyvqPQD5CUhrFqzmPtskP2cAcaBnLqFvVxs3LF8qn9KyGg:plTwNsymhcxvP+kXFynLYV+RlhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759895, "uuid": "e9f492da-272b-4123-9514-f7a6ec9103bd", "value": 4911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759895, "uuid": "89af3c57-e62a-4cea-8030-aeb234234383", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "928da565-8113-43e8-84a3-ee9cb0798d57", "value": "BLANK.PDF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97345d82-cc10-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651713216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713216, "uuid": "a056b895-4d0b-4a52-99b0-c4db24095c59", "comment": "Malware payload (Quakbot)", "value": "6c22976c86e3e3345b5e7439f630d4a0", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713216, "uuid": "b0de2986-f785-45bd-b9cf-23067507a497", "comment": "Malware payload (Quakbot)", "value": "06cfccd728289970135c714172ed359fe1075af9f2852902998e3b49e75b2099", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713216, "uuid": "5fa7e3af-9568-4df4-a0c2-0ca4fb9cb2cb", "comment": "Malware payload (Quakbot)", "value": "1f803414af66bbe254fce0934b0febbc54a2263b", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713216, "uuid": "5f07350b-04d5-4cab-90cb-e2913a55bb4b", "comment": "Malware payload (Quakbot)", "value": "152739d15bc7821931daff6a89944145700baf956c5dec1c96fb427d082747dd18be5780062a71a6a711e23ad14587c9", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713216, "uuid": "269e9de1-0ef3-4d71-bc28-95a5920f2343", "value": "T1F6C39E13E06280F2CAB6007881D99F295BBE75D01F66A9C7B398BA917D506C1D73B3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713216, "uuid": "d8b9292d-51a2-45f0-869c-b64d331cf800", "value": "fcee36a1a37f58eb0ce848652ae40e15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713216, "uuid": "3c30eebc-52c5-43a3-b890-7bb3ed4f722a", "value": "3072:rQZ4CPNV5C59EO+WZMIEqAYEJTAflcTBfQpOt:84KV5CX/+WZe/YEJcflcTBo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651713216, "uuid": "47e118fd-c664-4904-ab94-7bf7794fc1df", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651713216, "uuid": "8910f79e-bb6a-4331-86ff-7942b7681c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713216, "uuid": "d70c5316-8dd6-48b9-a561-3b2a283b6329", "value": "06cfccd728289970135c714172ed359fe1075af9f2852902998e3b49e75b2099.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c1a0ad-cc7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackOut)", "timestamp": 1651758744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758744, "uuid": "ff967472-3264-48cf-a501-51330a789137", "comment": "Malware payload (BlackOut)", "value": "3832241d05f789f34d97633047711422", "object_relation": "md5", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758744, "uuid": "78d9738f-bc44-4bdd-ab0e-56c2762aa170", "comment": "Malware payload (BlackOut)", "value": "076737e5e088fe2883053ab51e675838921161f78ba8ae35421b61afbd5b2193", "object_relation": "sha256", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758744, "uuid": "6a8db63c-6cbb-431a-89e1-36fcb7172c12", "comment": "Malware payload (BlackOut)", "value": "04332898d1facf47d87c585a7e771177ce584beb", "object_relation": "sha1", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758744, "uuid": "b77e7604-6def-4cb6-a87a-294ca039c040", "comment": "Malware payload (BlackOut)", "value": "86acf118e90f4b343dfd0fe5d89366eafacac5d9c52fee21fe68fa99b42b7cdf39b2d82c51f301ba8342650410d3b61d", "object_relation": "sha3-384", "Tag": [ { "name": "BlackOut", "colour": "#8F7A6E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quantum", "colour": "#169263", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758744, "uuid": "7004c3ee-da44-4607-ad39-e1bc6cf307e5", "value": "T13B738D49A3B100F6D51BF175C8B70F3BC3B2B4599178860F13AAD794DFA3321861AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758744, "uuid": "e29b18ad-ee25-45a4-a41c-c75bf13aed38", "value": "74805d10733a7276e8a5edc7c2c6742c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758744, "uuid": "bfb7a91f-11d4-49cd-ac5f-f60143cba993", "value": "1536:daXbNVxTe67EXHnD5Pvs5VlEJkFs0jCp0:ubNVDgmJEJkFLCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651758744, "uuid": "732ca037-2f99-482f-a309-be00ad10c0b4", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651758744, "uuid": "8c418f96-bf64-467f-bfd0-e4537916a631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758744, "uuid": "8d76812c-22c9-4308-a4e8-fb26bdc23326", "value": "2617880891.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb4a65d-cc94-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1651769788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769788, "uuid": "91d4d988-9a51-4438-a5f5-5321636b7c86", "comment": "Malware payload (NetWire)", "value": "028e3a8a96adf5e51fb571ff91a602e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769788, "uuid": "bac162dc-07e2-4293-b33d-9a2ee03b3f73", "comment": "Malware payload (NetWire)", "value": "089c37a0afa3e281d1784c54442e67572690496a7795f28d93fa9cc3284e93c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769788, "uuid": "37d3d039-b6b7-494b-ac00-522ed0eb26b4", "comment": "Malware payload (NetWire)", "value": "272e32f9d6f9585439a2abe6b60737198cd40195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769788, "uuid": "2b9cb2e8-dc6d-471d-8def-38cee8abbeb8", "comment": "Malware payload (NetWire)", "value": "509092976ecaefa72412d2dc598e0351572f0b8fd041f8745e53ee2bad98ae2639a40989efbc50e794a6b9635384768b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769788, "uuid": "ececa5da-53f8-43c4-b3ad-0819f9081253", "value": "T1A9B2B60CEEC0C96FD86B5236C899C5500D61795EC5E1467E1C8EB20BBAA23D304AF79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769788, "uuid": "c4cdec67-6d9e-4282-81f2-02d0c96af727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769788, "uuid": "a2f24109-7d14-4d55-ae51-e0bb0494ccf8", "value": "384:OdpC242/T/gZ2xCJueVk9qd+m0MhLbAG:ypBkPfkYd+m0Mht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769788, "uuid": "96be6bbe-4b0f-41fb-bb8f-def2ea95106c", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769788, "uuid": "1132d214-d842-4ea4-a303-70db41fc7c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769788, "uuid": "1779c2b4-778d-4d88-a2f3-573877a2e9d7", "value": "Second Order 050522.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433e11ad-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651757314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757314, "uuid": "00a8b72d-cbfb-447c-95ba-08f500a3eb45", "comment": "Malware payload (SnakeKeylogger)", "value": "cec21e09a3f9305895cd17a9450597ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757314, "uuid": "a800fd98-5541-4f43-8b16-8c5491a39281", "comment": "Malware payload (SnakeKeylogger)", "value": "09b7fc9298de57ebba17f0a308fb1755daf3fae6464f121094379ad168c25efa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757314, "uuid": "e1a58382-4696-4f42-98ee-ef8b87bac903", "comment": "Malware payload (SnakeKeylogger)", "value": "f3a3a51f48a2fa820738e0599956ce6511830950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757314, "uuid": "69c4ec40-35f3-4c7f-9973-7acd811a1d77", "comment": "Malware payload (SnakeKeylogger)", "value": "ffd9d32959f58b3756db494f5934e8e39fc635cccc9bf92c05e214a6457f99f00d64e859d1905f4e88f05b5aaed9cd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757314, "uuid": "94b14bc4-8832-42c9-ab0b-72b1154d8fe1", "value": "T1CA14022A33F4C1A3D4A243716D3A87235FA2DA231075838F5BB09F5D36716C17A0E7A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757314, "uuid": "dfd5e34c-295e-4106-9f50-6b24f0e0aeb3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757314, "uuid": "11061bfe-f6d4-498c-b5a5-14d1f9fa24d3", "value": "6144:HNeZmleTA/77UnBOWBoWSWQ59jaOz9gKtE1:HNlssUIWBoWSWujaigsE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757314, "uuid": "4ccf02f2-b92b-42b1-9e83-d9f87befc85d", "value": 203921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757314, "uuid": "67e25a79-07f0-43fc-844b-b63cad02effc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757314, "uuid": "222efe88-6195-4a35-87c5-a242450e8a27", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a1117d-cc59-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651744587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744587, "uuid": "f76b48f3-efa3-47d2-9aea-040a664f654d", "comment": "Malware payload (RedLineStealer)", "value": "9d438a66200ecd9b050c61a15997a29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744587, "uuid": "4b9cc507-8916-4799-bb59-bfd57df15ad6", "comment": "Malware payload (RedLineStealer)", "value": "0a9688182898eb82a2a84305910ea8d36e1fb72e26c746a9df194ee53b42d450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744587, "uuid": "989eaec5-97ad-4022-b025-189bfa26f155", "comment": "Malware payload (RedLineStealer)", "value": "a786b2c0c996963cc6df7007bf2b9737c27b7642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744587, "uuid": "4eb7d065-e71b-48a0-ba83-836d7e920863", "comment": "Malware payload (RedLineStealer)", "value": "4cf1237a79411020181ebecda20320bde5be9c2d72def31f85b9cef258020dbd9a2dc70148f9d3fce6f5965941e43869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744587, "uuid": "47709963-5fdd-4394-a3c6-948249cc4376", "value": "T17795C0E38752400BF162603A802D9E6D7172163197CFB8BB778C9BE997173D05A2EB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744587, "uuid": "1edf2369-6b16-4198-a458-9860379a60a9", "value": "e9626794517ae5f9ef503b6366d80781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744587, "uuid": "66a727d8-4c0c-497a-9ab3-366fb782cfbe", "value": "49152:W+mWfjL4cBnECJMLR6xIT1mMUsHyWiA67MlL7N:WMLVBECJMiIgXsH2A0Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651744587, "uuid": "e3388da4-4b77-49f3-bd94-4d7a27e8781f", "value": 1884264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651744587, "uuid": "e67a5683-8d80-4fd9-997e-85f1a2419655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744587, "uuid": "247aa7c4-9250-4164-95a7-af6357146d29", "value": "9d438a66200ecd9b050c61a15997a29b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcc364e-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651727941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727941, "uuid": "2430bcdb-92e6-4de7-87c3-d43fa810e195", "comment": "Malware payload (Formbook)", "value": "5ef068df05d031e4910a9f0a38a5a46a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727941, "uuid": "556751a9-4e61-4272-81fc-3407b45955cb", "comment": "Malware payload (Formbook)", "value": "0b5d4af8b253298a07aa5ebe3066a80632703e51f14338c9919b6da9484deb75", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727941, "uuid": "b9739a2d-2d02-4b53-bc3e-29529cf052a7", "comment": "Malware payload (Formbook)", "value": "0e370094d82024574dc235928e3ec96cd893f3fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727941, "uuid": "fef48605-ee2d-4cb4-8d6e-8fd9df034c1d", "comment": "Malware payload (Formbook)", "value": "36ece1031c7c87fbeaaeca691884491fe196d243cd1d6030dee7486fd22a879377380b5a37f398adaef31561e6df2ead", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727941, "uuid": "82202778-d4ae-4d84-a9bf-10ec2c324992", "value": "T1F12412B53402A70BF16B7C7ABE64661FBC92CFC31B8C961F28123394A5335A544DA3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727941, "uuid": "400bb436-991a-49c1-bb6a-7ea2eb5193cf", "value": "6144:D9KLfp9w+V1CaOFi5NPl6RdJs9XjMOT/1:D9Wk+bCaOFi5Nd6valMOT/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727941, "uuid": "942ae720-615c-4efd-b734-f3370931f53f", "value": 210568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727941, "uuid": "365093e8-36e9-4a74-9c1f-61ce78c7c41b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727941, "uuid": "ff3c1de0-6302-4426-a5e3-8e2f7a6f615e", "value": "MTSWIFT_732013817361_861736482_941834_PDF.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9791b409-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "fd043fc1-588a-4056-9097-7c94c0f14bf8", "comment": "Malware payload (Mirai)", "value": "dc450537a26c6c2b59c3c16de4251027", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "842cf570-1158-4b27-9b52-48c0e3e2ca65", "comment": "Malware payload (Mirai)", "value": "0f26348542a920895ec2864eccee1715117218ff8a9fa8fcb1d8f14fbfa136ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "1abc40fc-4697-43f1-83b9-b0e175bd2dd4", "comment": "Malware payload (Mirai)", "value": "cc9b0fe922188f5c79c5ce88026529623020baf1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "7d19a094-b7da-4b73-8cbb-ae54516dfd0a", "comment": "Malware payload (Mirai)", "value": "4b95d0f0b9aa7b975a43db03f2116cb20e60f659ab3544465ce51f68851056b372d9e5d780d434a1c7718bc34e8c6e3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733403, "uuid": "837b0567-52ba-43f7-b323-ac74f4b06981", "value": "T1FD23F1328823E676A1191A72BFD84EC28D9AE8FD75AB3132049CCD551EC0D9C27F1D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733403, "uuid": "42e75e2f-423e-4142-9fe1-9c2a43ed497b", "value": "768:cXczh3zMKPMFUv1kbn77VwSOtL/ajbvxATq9q3UELUnotQ0j2e0woJXp7beXXAXq:cXcilF+ab6f/Q7GzLPOe0HJo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733403, "uuid": "84dc8284-3856-437b-be4b-835826282c45", "value": 46096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733403, "uuid": "01dbe2f8-1fb4-4a42-96a1-141db4c29767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733403, "uuid": "fbea9bf3-a6ce-4996-bf0c-e4a2677af04d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5a6c24-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651746751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746751, "uuid": "11652d56-575b-4d5e-8430-76ee1b3e3f8b", "comment": "Malware payload (Loki)", "value": "3357ab1f63f073ca1c965173e10191cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746751, "uuid": "d1203ddc-ed5a-43b1-a12d-e29496a4173b", "comment": "Malware payload (Loki)", "value": "10771f89d25d10e453a1caa577756ffe9cf704fa25394bcd0745c43939bb2305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746751, "uuid": "98743bca-ef32-4733-85fd-dddc0f9f756a", "comment": "Malware payload (Loki)", "value": "f425360b6a5706cf4bc3bc96485abb53d2cf2eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746751, "uuid": "7bbadc18-7502-448c-914a-c5ad7cd16454", "comment": "Malware payload (Loki)", "value": "24bc7b81db82e891b3663b2ae5f1910b973462a327f25c7d3ffab04f8c6a19bb523e6d89c9f165a26f88ac2cd8f7910e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746751, "uuid": "92531996-17c3-489a-8078-7ff974c6dec9", "value": "T1ACC30228F2A5C467D5D28BB20E791B777BBA963211B1835F13509F9D7C222C1D60D3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746751, "uuid": "55a84224-869c-40f2-a992-3bf9d67b724e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746751, "uuid": "83f3c813-a2f5-47f2-9b33-0700851acb95", "value": "3072:l1NjcVVnLpPunbavhAflw2cmjQ1ROv+927EKTorJd:HNeZmQQw2b6c7ELJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746751, "uuid": "52d5360a-51a1-43c9-931f-a034be635b18", "value": 126685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746751, "uuid": "a5fa20c5-a182-46ba-9297-b02f7965744f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746751, "uuid": "343ac7b2-e1e7-4ed7-ae50-e3a5909a2631", "value": "3357ab1f63f073ca1c965173e10191cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86fefe42-cc86-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651763870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651763870, "uuid": "9fc4a8a6-9126-4edd-823e-1daec20d98d4", "comment": "Malware payload (AgentTesla)", "value": "ea372104f1e9f069068e3752b543c7b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651763870, "uuid": "fb7ef5db-dc74-4410-ae5d-424048252319", "comment": "Malware payload (AgentTesla)", "value": "110a91b180bc3421d6c10d8dccd371994872e48a2414d12cf5c9dc0f15f1ee1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651763870, "uuid": "50c4175d-aabc-45c3-b37a-37cd85ca2042", "comment": "Malware payload (AgentTesla)", "value": "9f057d94c9b77d6286073dc5b5c382bcba67a3b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651763870, "uuid": "0fc1de3f-2964-4f07-8743-c7d0343080bb", "comment": "Malware payload (AgentTesla)", "value": "832dd901acdba83ec4ed261079b1cfd94742130d353b9be3d3edf243f6497abf0f36bd11399321f4a7c59d9ca3f97a57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651763870, "uuid": "52307a99-7d8c-4c6c-a57c-f1c3696f03f0", "value": "T1704412827790C493E8B14B303E3A9F7E95EB842528A8DB5F43508B5A7E11781592DFB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651763870, "uuid": "83eab977-0e0a-4ad6-8a59-80b342685c02", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651763870, "uuid": "454b3523-33ef-42ee-a678-a45f4f0e1d9f", "value": "6144:HNeZmbFbpPhnmoF3EPQQxbG37bCveL0vDxeiDWM6Wzon+Z:HNlbppJnmGKQQxi3SQziDtTo+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651763870, "uuid": "5b9750ea-cca7-4cca-bdaa-c1223aca69ca", "value": 270017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651763870, "uuid": "ab89c70a-7b46-4977-841c-035fcc934547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651763870, "uuid": "b216033f-b09e-4052-be62-993389b8a05a", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6487eb15-cc10-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651713131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713131, "uuid": "2d053194-4d8d-4a4e-90d2-3d562325b5a7", "comment": "Malware payload (RedLineStealer)", "value": "af1bc8b132f35eea2147e4689ee192f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713131, "uuid": "e7f233fa-74f3-46c6-8149-00ce067c5df4", "comment": "Malware payload (RedLineStealer)", "value": "1269097b6c36aad4e6a3b344c023d2659b6ada1740c7b3856c1e61c8ca53c844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713131, "uuid": "c1a71658-2cce-4c29-a2dd-205373994338", "comment": "Malware payload (RedLineStealer)", "value": "21c3295e178a918d5d482eea120c12cc79a55c48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713131, "uuid": "63302f1e-80e0-4415-8bf1-e201c53d2e5d", "comment": "Malware payload (RedLineStealer)", "value": "a409f45cc5ff21731f20944945ea44ae74657b6957629b158eba814c2f39d605a20857b54f1a5db93e72381661b877e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713131, "uuid": "d3a88790-b314-49a5-acbd-c63ed278b97c", "value": "T11F1501D1895048BBCF26B7768078CDB48EF03DB3DAC27979A344606F38592C75A1E61E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713131, "uuid": "877c5898-fab5-45d4-9bef-7197ba1b6efc", "value": "5410f297cc24d2aab19c557a2671dd7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713131, "uuid": "89d2de17-154a-445a-b9c8-7bad2950a718", "value": "24576:Z70f6I3w9PfWZssf6HampxZqB/R4GLP6bGODJ:6flw9W86mZqB/6aP6XF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651713131, "uuid": "b209fcaf-ecdc-4cb5-ba6b-728b1b021a8f", "value": 957921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651713131, "uuid": "3ced5e25-dc5a-4b55-8cee-c03bb5fca2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713131, "uuid": "870215e9-75be-4067-a76b-a88b6a777628", "value": "Autoinstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251779b4-cc11-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651713455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713455, "uuid": "3ab6636c-44e7-4afc-a3f7-a6ea5833fb08", "comment": "Malware payload", "value": "cc934f6ba7251f6d1cb97beb2a447615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713455, "uuid": "3da28b13-2f99-4d90-a826-5dd5f683ead1", "comment": "Malware payload", "value": "13228a9fce36a6900a434caf4b91092f9a6642e36a7a9e9d103caefa3b02274a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713455, "uuid": "50fa6269-e4ae-4728-9451-cb53cf99a4a6", "comment": "Malware payload", "value": "489b88642ac57f52648474eb9e84561772bef501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713455, "uuid": "a83e71c6-dfea-48a7-bf46-394545faf6d1", "comment": "Malware payload", "value": "216d2a42cfa4a702f0694136bc329b3017615a3f3f484020d0285ccdd201f50da90f0469b7deb97a4414b46d2ceeefe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713455, "uuid": "64911774-b7c6-43ab-8633-5be4d7cca3c1", "value": "T116043102257CA8C3F69C6C73A8DC975E1EE06C6C4676106DF247B6E9E53F103E6212E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713455, "uuid": "8320dfca-19f7-48eb-8ae4-fc7f007aa690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713455, "uuid": "987eca30-efb9-426a-95f9-2cc08d3f26f4", "value": "384:40kffo7SqqqhCVAD6YHzffXSSbYlR/1hFVeGJdNETT4k4g6tGocA04sQm6eS2KWO:40fSqqqhCmWD/1/Ve9afe3ElGVBBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651713455, "uuid": "c044b0d4-5c0b-4eb5-86df-22612f5c194c", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651713455, "uuid": "7127a035-a5df-42ec-a408-d3363600ebca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713455, "uuid": "a7df71c0-6a92-402a-8a17-7f64fd49ec9e", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ce322f-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651729050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729050, "uuid": "da148e15-f5a8-4b5f-b07c-f4ee90d1b402", "comment": "Malware payload", "value": "2d3f9dc123e8b614432d83b782c6aee3", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729050, "uuid": "0fb7d1d2-4484-4d0a-b909-e9257a08cbe0", "comment": "Malware payload", "value": "139f01ab8e3dd756558be9462ba2cb41f5c4f5753872aaf7b7108bf489c1ee89", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729050, "uuid": "fb7a54f8-cd71-4d9c-ab38-d6c51f94d655", "comment": "Malware payload", "value": "1f6f602ea2f65d20b50a567fdb836bebb96deef5", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729050, "uuid": "c75e84be-b48c-4370-8589-06cef0402629", "comment": "Malware payload", "value": "20892618c97ca6ea98f6485819979b5a5124f9c39cabb6e78cef454ab250384e13386c83daa8c57ff9ba85e5cbe20501", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729050, "uuid": "2ff1c050-a7ff-4aa6-a8e3-adf06dd50027", "value": "T18FA412C9BB90CFA7C1E3217911C1EAE712B4AD100EA6DA4B7680FF5E9831B1C355613B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729050, "uuid": "ef9004db-5925-403f-8c25-21bd5899baab", "value": "12288:wZzlVpK0SHwmjUp7V+EEQuQxuh0URvVHCw:QzlV7mjUp89QuQsiivVHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729050, "uuid": "07ae9196-ebcc-4465-baf3-25b3fb8a8132", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729050, "uuid": "1d2daef9-4949-47dd-a652-75b239a0a8ef", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729050, "uuid": "de837f51-4e26-43c1-b91f-548e42a5f0ee", "value": "WellsFargo ACH Remittance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f76b931e-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651733994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733994, "uuid": "e47a8262-353a-470e-bb4a-c460d38804bb", "comment": "Malware payload (Formbook)", "value": "1b62873557a3d842221a86044f290760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733994, "uuid": "4bba5c7d-c627-4ed8-9aea-d1eb34d257e0", "comment": "Malware payload (Formbook)", "value": "14641fbe2c1d62713c7893a32a0fca7e60ef1c517f2e3a1b5e1b32f1240f86b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733994, "uuid": "29973d03-af55-4192-9916-d3328a2fa3ae", "comment": "Malware payload (Formbook)", "value": "2ffcd5e16f199b9c7fb6abbd6db4589ad7b1d224", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733994, "uuid": "60a5089d-6934-4376-b22f-5b421c978fbc", "comment": "Malware payload (Formbook)", "value": "cc3c9cfa7c7f1b29a8e82d530e963f8a989accfb4e9c30df10f51f2d32766e6e11dd00ceb1a35cd5e1799e0e8808b1c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733994, "uuid": "20b43c61-0a3e-40a4-874e-6c9a022eaf5d", "value": "T1331412443664C0A7C5916E338D775BBBEFBE7B212231820F13546E9D3E276058E0EB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733994, "uuid": "94b5c70d-5913-4ea7-9db8-01e60a7bb035", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733994, "uuid": "4206adca-c268-4fe4-a799-a7a56c49d54b", "value": "3072:l1NjcVVnLpPunbfq0V8DvaJp12pDorbEcMKIj5RyRsH4texcR2KdGW/0HrSM/4U:HNeZmfqmKan12urkKK5wsYt9Th/uSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733994, "uuid": "1bb427a6-a645-4db1-a8c6-8d5fb09c7617", "value": 198013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733994, "uuid": "1511cea1-59b7-432b-81b5-952a98e6e7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733994, "uuid": "6d6a3f3b-d76f-485a-8804-1a391988ea38", "value": "1b62873557a3d842221a86044f290760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7489eb21-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651757397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757397, "uuid": "73eb4625-cf3a-499c-b425-41c19f9b83a0", "comment": "Malware payload", "value": "d0be46f109fb63af04e5d1773de837ab", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757397, "uuid": "00b2d931-da4c-4ea8-a663-13f6a55988f9", "comment": "Malware payload", "value": "146bce1736bb4751d092b95304ffb078d34249d5caf8951d63a492fdf322f855", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757397, "uuid": "0c71e055-c520-4ffc-be12-ae6003d4d3d3", "comment": "Malware payload", "value": "ea9176fac054a4917b5ba012280e9ff6294fbcff", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757397, "uuid": "e867034c-1c5b-4992-b3c4-c15a6d5aae56", "comment": "Malware payload", "value": "657537954cec26368a886df1e6bd825182ec1e03057f8796b10891f0a7f0868fd5f5ca6253a2cba7b6e7f909b23250c9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757397, "uuid": "b9e12cb5-feae-4bcb-bf47-549589186d22", "value": "T1A044CB3BD2A15E7500851CB8F8169973D29FC7808EB48A55E7E3996363CBE02ED51CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757397, "uuid": "30e1c51e-d107-4c84-b9ee-0d946375fca3", "value": "3072:QWtrTBd9P7UIldDRK3Rhs8Upsr3IWF6sCU:QWVJ7HxIRW8UpsEWF6sCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757397, "uuid": "d7fa7ecb-114c-4299-ab20-0d334e56ce9e", "value": 256964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757397, "uuid": "85b79a90-abbf-4a8a-9c34-806dcf47f12f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757397, "uuid": "916f8cb9-e771-4e00-869b-81aacab7d6f8", "value": "DHL_OVERDUE_INVOICE_3ESE3273UK87.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7f4c05-cc3a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651731397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731397, "uuid": "4f7cafcb-45b6-46c8-8a47-b12d76469af9", "comment": "Malware payload (AgentTesla)", "value": "438dd45856a6b6aa328d4bd2cb67b6e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731397, "uuid": "2e04ae9d-03d3-43f3-a809-f3fc6b39c666", "comment": "Malware payload (AgentTesla)", "value": "14a510b349dacc4c42688e333424fc0b3ed6d48e3e1f4bd20829bc8f1bbf4ac5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731397, "uuid": "39e51ad6-6c4b-434a-90b8-2e1b48b88131", "comment": "Malware payload (AgentTesla)", "value": "b53357539598e9ba7613fee6919631fdb4b93e9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731397, "uuid": "1ca4b10d-df1f-472c-9b50-966cd0b6dc6a", "comment": "Malware payload (AgentTesla)", "value": "63b79a897699655f2f6aa43d6bd65806d38adcb49c30611551b45044662c8d7e05b194f4426eb74f5c1c2557bb254332", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731397, "uuid": "f79d88e7-46a4-4cc4-b9ad-92cd255b098c", "value": "T165C423EC0F373F801275EBB57D6C178F1862D70842D896E8B1644B4A0AB29256EDD1FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731397, "uuid": "5d8400ed-ac8f-41b0-b4b8-49ef29b13399", "value": "12288:IXRjaEbPENtG7Q4g1wqk0LlhTKf5qX23dfEBZ/:k4Est14YafbdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651731397, "uuid": "94ef41d3-a3c1-4e99-a615-49e440bd6891", "value": 597127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651731397, "uuid": "d63daca2-2174-42e4-b025-61274f31b791", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731397, "uuid": "8615ff16-28c2-4edf-8874-1df742e4865b", "value": "HBL+MBL ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f0cda-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651730223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730223, "uuid": "5d7875b0-e91e-4c91-ad21-31b99c38e233", "comment": "Malware payload (AgentTesla)", "value": "6f417728f22967577fbb5def3b52a161", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730223, "uuid": "8eb96733-d8bb-4d84-bc3e-d0229d93910a", "comment": "Malware payload (AgentTesla)", "value": "17396fb423bb2fc593a9ac4729fb3434ed527eee12510dc64c72e4b5f762cb36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730223, "uuid": "6f2e3dda-b60b-43cc-91d0-53aeb4fde5b8", "comment": "Malware payload (AgentTesla)", "value": "67f40f86f40f812ef35caf374fda94ba042123f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730223, "uuid": "764850f4-d883-4b60-9163-4cc4474e1987", "comment": "Malware payload (AgentTesla)", "value": "22990ce8166053d8e0246c0e6a760f309a7bda391f2fe99522a4110c9ed4386f987c668382f3afe7663ad40aa89d5d9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730223, "uuid": "60c44650-db08-49da-aa5f-6b5077ef0e5c", "value": "T1C1056B151DC621C0E9792B36DF4302256F6ABE82DF62FA6EA4B6727514B003FDD0B274", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730223, "uuid": "97659589-3773-4496-b5ef-7c65d0c13fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730223, "uuid": "fde188ce-c6a8-4ff5-b568-aaebe406d4c5", "value": "24576:Mr99K7OhNLUpLXlWK7UIFq/LAAvbA6QyUIUmeRp3JINVpiVTgl:xmFI2/LAAvbA6QyUIUmeRp3JINVpiVTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730223, "uuid": "1fc5c981-f538-4585-9263-3b29d890b78a", "value": 843664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730223, "uuid": "6f7e9677-7dab-438a-ae48-7f26abfe0b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730223, "uuid": "42cfae0a-f838-4763-a380-9e8f11ef69bf", "value": "CharteredBankcopy2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c0bfc5-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651735811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735811, "uuid": "128c4de5-6a8c-420d-93fd-fc96d9dd0384", "comment": "Malware payload (SnakeKeylogger)", "value": "209ef2948a25b984abc1bc3234146174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735811, "uuid": "f14576f7-3ab9-4d3b-91c3-8e568271469d", "comment": "Malware payload (SnakeKeylogger)", "value": "1799704e21771aadfb49f97211e4dca36c6644c0615594051adba50f7a4ecf3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735811, "uuid": "ac4697c2-6d1d-4c0f-b461-c207a8d1c4c5", "comment": "Malware payload (SnakeKeylogger)", "value": "8b9bc0a7df07b339900b0e8997e781cb6480e6ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735811, "uuid": "03eae1a1-19b9-4313-8a84-7bbe4bcf1c5d", "comment": "Malware payload (SnakeKeylogger)", "value": "1e195edba72c111a3679cf9e88186d6ff5de236bcd0363b0bab5353aaefa97aa6f3115ce185b1b9cc2b28699f4c5d3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735811, "uuid": "cc77a4e4-0224-4c50-9ea5-fab3321d6a01", "value": "T1A5553B8C138D8A05EC50B776DDB12B5273A3C7FD68A9675792993A3DC42B3EC1E30642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735811, "uuid": "5d4564ee-798e-42de-9f16-b7f5540e5c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735811, "uuid": "91f1fa2f-9692-4070-a6be-e4eddaf34f06", "value": "12288:11fo+52SggE6H+3Ww4CbziusY/9WKf+PPTkp0B/QRZ2nPX4tn4sOWBC88zuz2ax9:vMSj+f4ahp/9WKQfGRZ2nPX4tnSCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651735811, "uuid": "3e14a8b4-cc4b-4afe-821f-75e5835dbfdf", "value": 1348608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651735811, "uuid": "b927e4f7-4c28-4fd8-a869-ae3777727acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735811, "uuid": "548ba51a-1b27-4643-a187-bc409addcb12", "value": "SCANCOPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b2d689-cc0c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651711488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711488, "uuid": "b0ee0498-79e7-4ad1-96b4-1d39da38cc05", "comment": "Malware payload (Formbook)", "value": "c2172640d52b619a759296e77bb00a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711488, "uuid": "5c973cee-8684-4236-b84d-d28c40c9d6c3", "comment": "Malware payload (Formbook)", "value": "1799e80fe0e05e3e784de5536df1713309a3b345ea3dbd920acfff477735afbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711488, "uuid": "1594b6bd-4301-4a8c-8c23-f724282c5fec", "comment": "Malware payload (Formbook)", "value": "7543449dc103aead564723aef0dd6a1cbb8fb8fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711488, "uuid": "9a5b7d6b-0bbd-4af6-9bc5-b1303a235e8d", "comment": "Malware payload (Formbook)", "value": "0d087227608ce0856c9f757f8864ae9e9a08c9f96915f74d22e346304caadc374955503b7060fbaadcf983498310511b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711488, "uuid": "afaefeb7-4ecb-49e8-ba13-f1ec1821d97c", "value": "T14BA46452D28AFDFAE00A45758C79F628081E976C51A5482B3D2D3806B5FB39371FEC1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711488, "uuid": "c6689a2b-543e-41ca-b0a4-68e20b8afa88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711488, "uuid": "63be998a-1249-411a-97be-b0eae2df4e55", "value": "12288:cavCrNyzhj6Yo5DJ/zWHnnGwt2Fx8hyBum6AzX3sAIfBJ:p0NyzZ6YmDdknGwkeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651711488, "uuid": "475a4543-eb01-4e30-8262-ce6add80e633", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651711488, "uuid": "6ffaeb42-b5ed-4295-b4c1-ae87f305795d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711488, "uuid": "167c3473-d47b-4d29-b4ad-97a3b46eeb62", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daa1794-ccce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651794778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794778, "uuid": "ea093bfa-510d-40f8-ab4c-51a32e035768", "comment": "Malware payload", "value": "09397e91da2a58f6fe76ed29419c32d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794778, "uuid": "cc3adb31-93ac-48e9-b95f-eeb0d7a5d1f4", "comment": "Malware payload", "value": "184758a094d1144c1a99899a7437c017daba0ad4c71ac851dc49a537c79a5d41", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794778, "uuid": "2e9add33-898d-47a2-9f51-61709dba6ba6", "comment": "Malware payload", "value": "2b11e594318caaa2dd95449dec62266e2f3447b5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794778, "uuid": "8d62a8fb-b957-4115-ba26-4d5514cf3603", "comment": "Malware payload", "value": "a2d7b63d1a0da0ddf54fa7972f223d5bdf386f163a62b4746aba4cabd5dc061f8297c87c3cc0a714ff29da23398dd1f0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794778, "uuid": "9e1fd363-9743-4a3f-bc61-051a7ffc3da5", "value": "T1802533D139FCB545B5134970E285C8E4229B21E1A5FCA308CA7ECFC4196F8EDE875AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794778, "uuid": "9cb1ee48-0134-4bd1-8075-86ca43c6aafe", "value": "24576:VKhECyuiqrQ1e/+d6RabFa5xgr5Glxtrg3QkEtXmTpJXwpEJgnq:VyE4U14+gR6Vr5KdgTbwpEJkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794778, "uuid": "3f7f1004-45ff-4726-bffb-42e72541a596", "value": 1035558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794778, "uuid": "e9f73b42-8b56-436d-a649-c8c1fdf4e017", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794778, "uuid": "d277ac5c-b915-45df-8861-90a3f8ad4fdd", "value": "\u5982\u672a\u81ea\u52a8\u8df3\u8f6c\u8bf7\u624b\u52a8\u70b9\u51fb\u6253\u5f00.lz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5cc46e-cc43-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651735296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735296, "uuid": "0997ef00-ec2c-4dc7-8f1e-c06016e8fbd5", "comment": "Malware payload (RedLineStealer)", "value": "32240517174f68b6fa99fb6a943fd978", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735296, "uuid": "732ebaed-904f-478c-849e-8ceccc2837ae", "comment": "Malware payload (RedLineStealer)", "value": "187884897d0e6f21ef43e86597c33019fab04d0a06b60a386767f83912693340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735296, "uuid": "9231a730-1d06-4ace-b9c3-5e2b6b6ca525", "comment": "Malware payload (RedLineStealer)", "value": "3abaf0c5f72e938ec6597e5d038bf48382eba161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735296, "uuid": "16be0c73-3577-4fd7-8ae6-7d63b30adf0e", "comment": "Malware payload (RedLineStealer)", "value": "90487414b0a44eebc6b343cdf8d548d1670f3bcaca3913c005e868833358d034225f6bec9684b5134fef0ec92003a4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735296, "uuid": "4a35dd80-b854-4029-b310-9a9bd564dae4", "value": "T182B33B6973DC5624E5FF8E7078B1519156F0E1A27D02D79F4EC4E4DA0E22B80FA22BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735296, "uuid": "adffe38b-eb12-41ae-93eb-6775e4c8a0d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735296, "uuid": "9c622d46-f5e3-4d97-bf78-e89058303b1c", "value": "3072:/CrdQX/OHkUDWZYQfcHj8Wvl4AUhQLj0k:udq83Uhaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651735296, "uuid": "fd0e1b48-a9dd-4ecc-8b9b-006aaa7ff97e", "value": 117248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651735296, "uuid": "7220edb3-8904-4caf-b1e7-ffbbc3ff76b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735296, "uuid": "d4165637-2788-4caf-a9f1-532a8afc0499", "value": "32240517174f68b6fa99fb6a943fd978.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2826923c-cc68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651750826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750826, "uuid": "e23076c0-fdbe-4db3-bf24-1de438e5c79a", "comment": "Malware payload (Stop)", "value": "b6b816a1f69ebc122752448768f6d931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750826, "uuid": "82ed51f3-3ff3-4b17-9821-563aea2beb86", "comment": "Malware payload (Stop)", "value": "1883ead5379c6a1a725b788e27e10acbb65b999a52a84cda91836dc4ca98cedd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750826, "uuid": "4942b0c6-a6a3-4d37-8290-48e06889efa2", "comment": "Malware payload (Stop)", "value": "3d713a25fd652c9f92e1e500bbd1d3c1780f054f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750826, "uuid": "9bfec47a-a7f4-4018-ac4e-059a34fecd36", "comment": "Malware payload (Stop)", "value": "abe95c7615bb4505e806775f82fe3aa0a27d4a2c51bf5373f510b22e4d424e88ac03ed55b47155aecf1f8076832fdf12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750826, "uuid": "20c29484-b37e-49eb-b5ed-6b21780be6ea", "value": "T11B050110BB50C034F0BB62F4563AD3ACA92A7DB19B2405CB63D53AEA57356E4EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750826, "uuid": "42e9ca42-0e55-42d4-ba5c-086a3a12b564", "value": "102925d1127f9c0032b267954e8e052b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750826, "uuid": "1c3b9bf1-7305-4568-a43e-9e384be4b82c", "value": "24576:XIU2qij2tDTURbgmcdjOENUAwOEWlc9veLm:ZM21wRbmjvlw2lme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750826, "uuid": "60318b68-e3c1-4c1b-8112-34873438ff4c", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750826, "uuid": "9a49451d-62b4-4c76-9301-7ec31a7840ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750826, "uuid": "8c25631c-c2a8-4524-98bf-b8bde99bf51f", "value": "b6b816a1f69ebc122752448768f6d931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a22080-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746121, "uuid": "10ef7cb9-dce6-4390-9da9-fc36b6fd5344", "comment": "Malware payload (Formbook)", "value": "e81db2e4c64677f9138d18bbd1678591", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746121, "uuid": "493c2acf-4b67-4c50-a545-28fa2d8dccac", "comment": "Malware payload (Formbook)", "value": "194a3631217c27a9cd8c56344fa5ab8310a3b1eed34236a34c7d968d815b9607", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746121, "uuid": "f201e98d-e4ea-4295-837f-de35230c41d4", "comment": "Malware payload (Formbook)", "value": "faf1cd58c15d0f9801df46fa97d38735c3ec57a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746121, "uuid": "ad83c442-3d8d-4e9d-ac9f-5974cf100f36", "comment": "Malware payload (Formbook)", "value": "525de8d71eee9215f10120ed1cdca29d8703c74e4bea030b4207d2b37e465783366cb63d95dee7c39084148ea4e452e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746121, "uuid": "936cf442-3788-45f4-92b6-ff0e286a1189", "value": "T16124126F728C950ECA7777333A624D94F30CDE25C4A4A41AA37B396E61B65C4BF8011B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746121, "uuid": "04eebe2f-8ec2-44b1-a068-8df82244b5a5", "value": "3072:7sSkJFDAlM7q/qyyrwj2auarWV74u5h0YoLGUeOoy2xFmylSu0ZAIZSpr1nXLLjv:YSk3slWvyW3au0+bRUZyPBSbZpZWuoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746121, "uuid": "66a620df-dba4-4cb2-82a6-de236dbec20d", "value": 211704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746121, "uuid": "cf14d24b-d311-4faf-81c4-95148d7020cc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746121, "uuid": "cb5ff086-d060-49b8-8385-a1cef7a55156", "value": "CUSTOM PERMIT CLEARANCE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803f3461-cc55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651742813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651742813, "uuid": "58c9d1f5-ceb8-44e9-b16d-98d9f48ff48e", "comment": "Malware payload (Formbook)", "value": "d55ea65042996e5a30ec7ca37e699130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651742813, "uuid": "ed0a5ade-ce4c-408e-984d-eeb7e9e26520", "comment": "Malware payload (Formbook)", "value": "19a007d4980b99ea32ee2d9feb1c7479ee4c7b165b159fd4fbd33622b661009d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651742813, "uuid": "e220b14d-df94-4136-9758-9eb5cf6a6667", "comment": "Malware payload (Formbook)", "value": "7e6aa118f0954eb812038c4b7186fb4b3151a3e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651742813, "uuid": "54891fd3-56e8-46d4-87e3-b5315a0b2fb6", "comment": "Malware payload (Formbook)", "value": "63b9f18106abcffc5dbe76afa3267d9d4c6805601f67ef43e8aa51cfdeb32bd2f888ee3f7cc4446b1a22e7aa456875e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651742813, "uuid": "6e3af7c9-23c8-4375-967f-73f3eb59cd42", "value": "T118C402597781CB12C11956F0C0F7007903B65A8B7E36E75F3E8862C91E8A7E18ED978B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651742813, "uuid": "e043872c-caa2-44a1-8f80-51300ebb7d4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651742813, "uuid": "8510dfa6-c805-4a31-8d82-429bedbb97c6", "value": "12288:csoE66VSUwPED/0Nu9p2epG9Pl6JLwCoTDXlcBaD7F:roL6Rwk/aWp2am6JLJW7gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651742813, "uuid": "9f905c18-c929-4d12-8bda-a94dd8e094b3", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651742813, "uuid": "e08c7a08-2ae0-437c-85eb-f50bef857833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651742813, "uuid": "90ad7564-740d-4c26-80f6-5141425cbc15", "value": "Purchase Order MRQ-5525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446b64f7-cc4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651739706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739706, "uuid": "200dbc20-9397-4992-9868-f96859ea8f7d", "comment": "Malware payload (AgentTesla)", "value": "0cd6862feacf169f9c5b7e0148f57c8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739706, "uuid": "87ca6ce0-b7d5-418f-98c9-1a645faf72d5", "comment": "Malware payload (AgentTesla)", "value": "1a15e3c588a2fe431431d9cc5a22bedcc86937dadb181af68377b2a63dde0632", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739706, "uuid": "7c3d95b8-81c0-4a8e-aa88-3dfe595ab58b", "comment": "Malware payload (AgentTesla)", "value": "0336a7944fa081747d45222fee22b6d4d30ed753", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739706, "uuid": "db1422db-3db1-47e3-9e3d-018be93ae43b", "comment": "Malware payload (AgentTesla)", "value": "8bef326c7518b83b4d9bbacc9882cabfd49683b0de991c688b19326c9a12a039ce7ab8c061c59ab5a823852e3959dce2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739706, "uuid": "690de079-b6ad-4074-bd5d-196aac7da3d0", "value": "T176D4DF8D7191B2EECA27D072DEA81C64E6553DBA431B13139097B3ACD9BC887CF145B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739706, "uuid": "03523fe7-2bf4-4745-ae57-073f5fec3f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739706, "uuid": "d2596fbf-4d9a-4a35-8b7b-8527a3e76f7d", "value": "12288:DLnsfJQewDHBlM9vO2L2IK3vRRJRzCNV9kbk9wMA+y9Jv:DL/26vRRJRGNUnMZyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651739706, "uuid": "987a4e89-3972-487e-bebc-5715e99a72b6", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651739706, "uuid": "f31065aa-a1d2-4dfd-9f63-3a6e2155cc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739706, "uuid": "d425dc2d-603b-45a6-8a8b-b644e2c67739", "value": "SecuriteInfo.com.W32.AIDetectNet.01.18552.24528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3973ea2d-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651728092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728092, "uuid": "36a6e67e-f9d5-419b-91a5-bc0c2b620a99", "comment": "Malware payload (SnakeKeylogger)", "value": "763a414571f4f48c6e6a43dc4fdb2a50", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728092, "uuid": "bc706bfb-4bda-4b15-a95c-9a623d89b444", "comment": "Malware payload (SnakeKeylogger)", "value": "1a443f4faa6f4187f8b4e90743b30c48bd33fe18602238a992316036d779f4f8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728092, "uuid": "a5852df0-4fc0-41c0-a288-a7907a296917", "comment": "Malware payload (SnakeKeylogger)", "value": "7b686ef53c1dd0f40dfa0df7a11aae30c61a2a8f", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728092, "uuid": "3204812b-eee2-4e0c-b784-cf2170c91aa6", "comment": "Malware payload (SnakeKeylogger)", "value": "a876159a019a8afb0751de3e551aafab260da02ba457cf805a3e6aa25d1e8468e15ce360a763e07d993aa4bb5b460a7c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728092, "uuid": "d17ab0aa-d6ee-4552-95ae-dfdce0301f13", "value": "T11945F167E3D7FAB0E6AE56BAC5B5DA38136E74A24175B749B6404CCD39203438930F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728092, "uuid": "78d4fcec-1c6f-4a54-9419-6a9b2156d1b6", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728092, "uuid": "b9cc45f7-8e98-41e1-9f81-5a38ee0eeba2", "value": "12288:RnnnZq3Z2muWdP8bzbBSrevEA3FgGde3ZbAeb40KR+OuLBjMa0q/PeGAPUXfQELL:RnnnZqpdRKX1sA6q0fN/0q0QLiNo8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728092, "uuid": "edf55634-962a-4239-9442-6dac68b6a612", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728092, "uuid": "64d3ed62-c54b-417f-bf5f-ea44cddb1834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728092, "uuid": "772c2337-27e9-4465-83e2-e368faa7ce97", "value": "9064636371738.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f538b6-cc12-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651714065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714065, "uuid": "5ae6ea83-6c1b-47d2-8ad4-bdc0976eae60", "comment": "Malware payload (AgentTesla)", "value": "10ee5e66c551f7dfdf146d805de65656", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714065, "uuid": "9bdb414d-9809-45fa-a87b-a442ad0f40c0", "comment": "Malware payload (AgentTesla)", "value": "1a7627dcff8f8d294411d085df8775e37c8277e86e55bbb5a45afe863a95d208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714065, "uuid": "bbeb49a9-f100-4b0d-aa2e-3f7e8df11ce1", "comment": "Malware payload (AgentTesla)", "value": "50742d88187e34487b909994fba3422f6359b548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714065, "uuid": "9cb474f6-3f42-4125-812b-1fb9b57c8ddc", "comment": "Malware payload (AgentTesla)", "value": "04dfd48f787a688764a6fdf13655ad6340b9c53f1e61f3ef40c8addcdd71aa68179595f47a580a9f46aa57e9e3130ca7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714065, "uuid": "e127c900-8e95-417c-a05e-8ed79e31b646", "value": "T1C2B4E0113BAC3A15DD6FCFB56461850053F4A48FBE23E11FAEE718CE6A63B415360A72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714065, "uuid": "8f1574ad-d1d8-45fe-b98d-500b2f6966c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714065, "uuid": "0a8ea2ee-b5ad-4836-bc2b-2ad1f57f596d", "value": "12288:T+A80c69FCbBHtHUXsRn+bNcfWOD2iNnc1:f8WiB1+bNcOOD1Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651714065, "uuid": "3eba4cb6-98b4-4b2b-9199-4199d5e658d6", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651714065, "uuid": "715c8547-c804-4968-8d05-1f694e9c96e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714065, "uuid": "9ca43cc5-6a81-42ee-a138-c1670215ff8e", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9201a44-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651727957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727957, "uuid": "8f7a39aa-3684-4c7a-bd76-871559f39b37", "comment": "Malware payload (AgentTesla)", "value": "c72f92bb423476672e5501427ec4cb5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727957, "uuid": "de792a66-89ea-4c87-a7d4-c8a4cde84383", "comment": "Malware payload (AgentTesla)", "value": "1c2d68760c95f13e1fa0c27c2311b0f3aee3c4f923bf1420765da4d59f7d7bf5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727957, "uuid": "5699ca3e-beb1-4487-a044-44254c6c5997", "comment": "Malware payload (AgentTesla)", "value": "386e69ef30a9c2a5fa0e578d04fd7ff779e9adc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727957, "uuid": "ed607222-1376-4a0b-b0d6-a17a2f485688", "comment": "Malware payload (AgentTesla)", "value": "6fe265dcddd2bb4988edb2e77ffc27403f5615f45a3f65734933b7b5850b961cd3f9b0255a0ab608c7f12abb64872c6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727957, "uuid": "5bb686eb-7d5d-4cd9-81ca-ea90ec09cb9b", "value": "T187241298B320B19DF374D231693BD7104868FD109A9760C7E5333A2927F1DD38ECA99A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727957, "uuid": "123fc058-9c1c-4d24-ac7c-511b6951efee", "value": "3072:i5SUcKmu4fVO9KG8e9nSJIHFHyqEm/EZIJa5xchy1cZ8eRSFd1V3rPYk5hjkT:ocG4f4rnDHFSbm2Sk1cmeRmRzYQ9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727957, "uuid": "dc00c7ba-bb7c-4ce8-8e1c-83e776d7e899", "value": 211144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727957, "uuid": "692e7823-5dac-4f4d-bfb8-6bf45235f117", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727957, "uuid": "31a5e0c8-70df-4ea7-84f3-b2c8c8b16b51", "value": "Factura n\u00ba 220111826N.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fb8b3f-cc2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651725554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725554, "uuid": "12f11c28-fec8-4313-ac75-e97784e8672f", "comment": "Malware payload (Mirai)", "value": "5c3da0a49a557673e84e0ab28211d051", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725554, "uuid": "20977949-f7df-42c2-90a3-f81172b23528", "comment": "Malware payload (Mirai)", "value": "1c6f1fc5d030a88d7320f829aebcbd08e4e301b0e0e6e0e31c89b912e23346b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725554, "uuid": "ba854ea4-7487-416d-bbe3-0a7fa2a9993d", "comment": "Malware payload (Mirai)", "value": "4b6b667e72abdafdaf8a00d1159168801859a1b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725554, "uuid": "dd06f4a1-4592-4e20-96d8-d3ff8af418b7", "comment": "Malware payload (Mirai)", "value": "8a6ee58d038635ecac3c6138ab3122d79bef9f58ab4b8c055447beb6b9bbb99441460ff440561ef4ee4717656a22667b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725554, "uuid": "2ef6d439-4a7e-4291-9159-c1a466f76322", "value": "T12F735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065494172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725554, "uuid": "ab46e08b-534b-4b32-882d-f79a6b92da8e", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcSrGhQxV6vVgFpqxfCFFm:LtIYWc+8vVfxfWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651725554, "uuid": "d8f94bec-2dd6-44b0-bf60-a073a0ec301a", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651725554, "uuid": "3a306523-a118-44a0-9171-dd6e139f8b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725554, "uuid": "eb731b26-7615-465b-baf6-9bc3fd9c12cf", "value": "5c3da0a49a557673e84e0ab28211d051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2d46a1-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651730161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730161, "uuid": "74b30329-0076-4883-bbd7-4fd3acd1ff19", "comment": "Malware payload (AgentTesla)", "value": "123a3a0b79058d0004e8d5d0f48d9784", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730161, "uuid": "8993d4a9-976b-4af4-8a10-6d119cc6b6c7", "comment": "Malware payload (AgentTesla)", "value": "1d9a5a1ad734aa6cca8a32b8f4e5d16c20582146fc96acaeb39d54b907a2b978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730161, "uuid": "06ef031e-585c-4666-bc4c-490df553e01a", "comment": "Malware payload (AgentTesla)", "value": "78b3a768894e41b11155e5d3331df61b38c39e61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730161, "uuid": "f3e1173b-1dae-4213-b539-92c01460ae8e", "comment": "Malware payload (AgentTesla)", "value": "0de6f5d434e2a26e08a4d367a8a26554739f75c7134d1ae9177e86d86ddc6a3c0f444e0ff7961197a0c68bdb948bc2cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730161, "uuid": "84ecd731-76ed-4b66-adf2-7668e0f47acd", "value": "T199F4BE8B3BFCA8C7C27D2A708C54F70C82B55DCA91298E5A2C91F19567717841AF31BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730161, "uuid": "da605ea4-202e-4222-bc22-b9dd02a49c6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730161, "uuid": "b572e47b-b98c-4977-be04-101fc805eff6", "value": "12288:tqhFdtq0Gme8HXdEFaFfc6Ivw8X+F1ntiiKpYQBcNY4qjNO56xh:ghFdtl5R3aLI8u7nHKCQB2Yxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730161, "uuid": "b1b1d731-2270-430a-8bec-ddd97314d5ae", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730161, "uuid": "0c676326-790c-4c56-8bf7-c1aa07bf5f82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730161, "uuid": "0c4ac420-8878-45c0-bd54-5e69e7bd0623", "value": "123a3a0b79058d0004e8d5d0f48d9784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07802ae1-cc0b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651710828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651710828, "uuid": "3cad1cf4-7545-4502-8b4a-d8623936f636", "comment": "Malware payload", "value": "cf24dd0026dc7a5462fbd05cf61450c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651710828, "uuid": "79e08170-0217-4424-aea7-cd929a430283", "comment": "Malware payload", "value": "1fd03a4288fb3f86dcf7ce0841f74ca2a76846142baa5d8e3b443994e158a26c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651710828, "uuid": "8deff688-b485-47e4-8b6c-d0db179577e7", "comment": "Malware payload", "value": "c367c51134b29bc5e256648697d5d98241ee7fbe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651710828, "uuid": "21461fbb-f114-441f-bbb0-b919136b46db", "comment": "Malware payload", "value": "dbe9d450afe23744d63d0513d73372a4040ab4c86688ce53319533d83874670ab25fd5b2c5b007d9d520965fd229d20f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651710828, "uuid": "7c53c482-8ea5-45c1-9b94-8ee282273205", "value": "T126035B03E99DC1B2F9963AB83456277AC1B73D6817BC6AA32F91CFC504A305AFC11527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651710828, "uuid": "db2dce41-5d5d-41a5-8b05-3f16aba5dbf5", "value": "9f94c351e671b5f8b5d1807bf8eec3c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651710828, "uuid": "6ee29af4-9596-4613-b59b-2c6740b06093", "value": "768:ABx53JBFHAJv9sFqdqaNk+Z98ixHLTAWK0eBTDK46vidnPHLMlPmv:AfAt9sQqEciFL8bDDblPrMl+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651710828, "uuid": "8bd8bcb1-3b94-4d3e-b00e-d002fe062de7", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651710828, "uuid": "d9c27f3d-268b-4114-940f-caaba6315460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651710828, "uuid": "0229938a-1d39-4aca-803d-a0ce3273b3b8", "value": "sample-1FD03A4288FB3F86DCF7CE0841F74CA2A76846142BAA5D8E3B443994E158A26C.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf8610b-cc50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651740605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740605, "uuid": "9e66073e-8769-4e87-9e3b-a081b05fac31", "comment": "Malware payload (Mirai)", "value": "69f47514808a39521413bc5f44636b79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740605, "uuid": "076f3c05-6760-444a-9173-dd16feebb983", "comment": "Malware payload (Mirai)", "value": "1ffc6cb3d1691743c39c1e02817257b8850ae9066d3527c8ba1966eba01b4bf3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740605, "uuid": "cb66d9a2-cec6-403b-9a4d-98cdb64633ba", "comment": "Malware payload (Mirai)", "value": "fc99ccd31ae97aa1149830a1b2812457c56bb6d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740605, "uuid": "793c7951-d85f-431c-9539-6cb0fbb374f1", "comment": "Malware payload (Mirai)", "value": "949059ce0920ad6fe466c07cbae787607f702a0fe198d0b7114b282cbe856da271910b4845fe748a98b25abf89c97ac3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740605, "uuid": "4362cd77-11ea-4985-aad3-0977551a7162", "value": "T1DBA2CFEC92A942F2D0661475FE75024367A33FBEF2E832BE215405E4D3C2569C6E54CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740605, "uuid": "7a40220e-5241-4376-9c91-2deb4772014a", "value": "384:uaRugoCxL2z6QZj7AmYIC65l7vt3TbA7/QgizNoePwhymdGUop5hX1:9RuTw2GQZHAZ0tLnhWs3UozJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651740605, "uuid": "395295b7-b055-4ce0-939a-87c07ee49f69", "value": 22212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651740605, "uuid": "eb6ce03c-376f-41de-b956-b514d18d2edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740605, "uuid": "0ff169cf-e28e-4fb3-ae8f-382d9fa16b81", "value": "phantom.arm5-20220505-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb46f797-cc90-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651768279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768279, "uuid": "543837c2-1cde-4cb7-a170-71c67f476e6a", "comment": "Malware payload", "value": "72dbbd693c9c44955480bcdecac2d913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceID", "colour": "#BFD7D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768279, "uuid": "a3520538-bd2d-4f97-8c28-ef48fe3b9ddd", "comment": "Malware payload", "value": "2123ed9e1662ae4805361fb25f1389bcbbb096e0a975d98a133797481ed0ebcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceID", "colour": "#BFD7D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768279, "uuid": "c41e7804-9d12-47a9-a4d9-4c7eed09d84e", "comment": "Malware payload", "value": "3a531b1bbd05a09fb0eb35cf4c1ec7acc6a70fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceID", "colour": "#BFD7D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768279, "uuid": "f78a354d-b36d-4b76-8aef-e6fbfe1d17b9", "comment": "Malware payload", "value": "32eb88d23bc3d6710f874f7f9683043be92fe523f6fc6567b4c3103081733af5ec97128df881f16cdc1a5c4f3b5986c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IceID", "colour": "#BFD7D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768279, "uuid": "2e3c8d19-0990-4a67-ae8f-aaf314d2ee87", "value": "T13DF4AFB876182CE6E57F567BCA967DD923B227228987D8CD806477C30D63371EE06C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768279, "uuid": "97b039fc-4294-48f2-aeac-c80149ba4b58", "value": "d4755b9a9aec93c05c955ca11140bdc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768279, "uuid": "31ccb2b3-b43d-4f48-bff6-f85f6f357729", "value": "12288:AKRfIA5hSQu0aHQ2HDYTES5IhJmSNY+q8nkPcWUwpjpf6VLnOamxDac6MWtKg:LIA5MC2HDcIHhNY+JkPXUGQ1OamJV6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651768279, "uuid": "1c367e95-0226-44ac-81df-0073c50f2b1f", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651768279, "uuid": "b8b2b354-8cf4-4473-95e2-478f0227148d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768279, "uuid": "1c5d3738-96d2-4b26-8dea-f0a38c018b58", "value": "obrush.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994c0c98-cc68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651751016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651751016, "uuid": "7ed77333-eabb-481a-a882-1fd0f1fd7b2a", "comment": "Malware payload (Loki)", "value": "daf13df2fd3ffb044f56e75f4693580e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651751016, "uuid": "09c4c243-2c05-4252-abb9-25c48960f6e9", "comment": "Malware payload (Loki)", "value": "2141b82e99fba9b9d55f041e08b9c6d7d5b1c152eacd907a41b23b24fc6a480a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651751016, "uuid": "962cf6b2-df17-4901-b7d6-d02eb261d449", "comment": "Malware payload (Loki)", "value": "11815cb3c9f96043157d8d0ec179f5ccbc94cbbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651751016, "uuid": "aba2eb24-1b2d-4a1b-8478-b3bbcf5eebf6", "comment": "Malware payload (Loki)", "value": "68755a1b2bafde90da01aeffdbef2656ce9125c1bb4d8a373f8b706c34b04714f3c94e9f811c28289ac56786ed41d25a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651751016, "uuid": "76142113-6a90-4a4c-9e48-3c7fe8a18a1b", "value": "T18B44BE2276D2D432D0E746304870D2A51E7FBC525B78098B77A43B7E2EB12E11AB7367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651751016, "uuid": "9b218376-d593-4e52-9177-8ff2f981c1c1", "value": "18005acb9e04a37974d18c68bb7b3429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651751016, "uuid": "c83ecba7-6470-42aa-9c49-d40ba620bfc6", "value": "3072:d4I9ZLVl3a4lA8b8NaVmW2++CR4QVGwUP81:qCVl3a2Bb8NaUPCR4ZPP81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651751016, "uuid": "fa2ede2c-dc66-48e7-9899-a99469dbc3b4", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651751016, "uuid": "d11d6f4d-264c-4e46-b5dc-5ff22aafcc69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651751016, "uuid": "4af91109-96ee-4f90-92e1-967f8a571e9b", "value": "fk_2022-05-04_16-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a16b5b-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1651728090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728090, "uuid": "12976e16-bc41-435e-af1c-73eaff863d2d", "comment": "Malware payload (Smoke Loader)", "value": "950ba620951b993d7e0aeac7f7f5c2c7", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728090, "uuid": "4e8a8e93-0ed4-494b-8eff-affe29ca5972", "comment": "Malware payload (Smoke Loader)", "value": "22e22c3553f6f7d9a2f8ad11caa9889f80dd0b2d479c2d5689b48e3bc6a54bc2", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728090, "uuid": "8818989e-24a2-47ad-8cf8-a1c126ed1d0f", "comment": "Malware payload (Smoke Loader)", "value": "7a6ea45b3621d921cfadcae3e9f3605ccf235a27", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728090, "uuid": "01d9c47c-b59b-4124-bfee-02c6e3ac9b0e", "comment": "Malware payload (Smoke Loader)", "value": "5b3412dbe2fc88b1457b5db93add96fd0e88ad415c961a887d8c2df70d45b723b6da0fbab8c93cf0f668b255dda775af", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728090, "uuid": "91b3e99c-5fea-4907-bafd-74aa72e6b66d", "value": "T1A532FA45FA5088FED32D4178C4635E4BA075B211E7A263CF737C456A2F92786372878D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728090, "uuid": "86c1149c-8656-4709-8a25-4e03773162db", "value": "d2def47d2a92d4173aea3c245c5c4bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728090, "uuid": "c0a9104b-84fe-433a-b3d9-5d71124b1c13", "value": "96:SY2pNnF557AN59lpepeiI8a/nXDFpJW+tsPb6zjB1YfWjeNNYlS1VAdsDJkD4uAA:Sz57g7pIeiba/DBokF1YaQYQA6DUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728090, "uuid": "96be06d4-fdd7-4e97-85c5-a6d8a28eaa03", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728090, "uuid": "9588c6b8-871b-4959-b287-af026c785c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728090, "uuid": "a4f18ca9-30f3-48f0-acc1-4f3b16d6369d", "value": "QUOTE-PRICELIST ITEMS.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91a6a49-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733970, "uuid": "0acaaa1a-18f2-4fa9-ba27-b7118779b18b", "comment": "Malware payload (Mirai)", "value": "1d4bffe1c516d7f3875acec353da0dd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733970, "uuid": "c056864f-72c2-4a43-9a7a-1cda587bfbc7", "comment": "Malware payload (Mirai)", "value": "233413c9b180e34af8a48371d49ba640e54991c145edfcf9bc85708b48fc45e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733970, "uuid": "9d9a3b75-f67a-4d95-86a4-c13149e9f637", "comment": "Malware payload (Mirai)", "value": "b35a3a6b6da9ea23368c9287491e4874fcec86a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733970, "uuid": "dcffd30c-3340-4608-ab47-dd86f55c79b3", "comment": "Malware payload (Mirai)", "value": "fb12d8e3d1822f487c4e88f5ee9a3ce10a56d892af86f1dced6d00247fac033a7e8efe11e8c28bec27c11a791db81936", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733970, "uuid": "59240302-d601-4447-879f-37ce2f879bd3", "value": "T1D3C2D175A580A831EFA225B47069CC4E7D09AF7B94FD34022378A3197F72945FEE8385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733970, "uuid": "b71935c3-9181-438f-8e68-3818168f8851", "value": "768:yEqhSpoZzfE1m6gv+uMrk5WU0V9q3UELK+:yvhSOZrE1m6g0+0oLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733970, "uuid": "84175294-be60-48dd-bd38-2746b82b32cf", "value": 26200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733970, "uuid": "28f18907-2282-498a-ab27-7dac71db57c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733970, "uuid": "46f6c684-881f-48f9-b721-353efec60fba", "value": "1d4bffe1c516d7f3875acec353da0dd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3466834b-cc3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651732378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732378, "uuid": "3e8de9d3-d721-4dfc-a0f3-6d5afafe7de2", "comment": "Malware payload (AgentTesla)", "value": "1688f6e35a13df80ba694e8b3b5525fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732378, "uuid": "5f14b680-704e-4058-818f-7b3d336191b6", "comment": "Malware payload (AgentTesla)", "value": "23c055d82f5e6ef4da6b5d90de87610e6ba15be8c8a654294b6ca1c090fad979", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732378, "uuid": "b3fa01a5-cf03-4642-b111-03f74f2f8773", "comment": "Malware payload (AgentTesla)", "value": "1fc5193c25ba1b59a4219d04ba9cc7029a4a9d4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732378, "uuid": "ecf732b2-4fac-4f24-8a21-2fa4e4717ab0", "comment": "Malware payload (AgentTesla)", "value": "3c4c36b6f5374e85a798a4ee8fc39d79322c781b03bf6200e609b0ded367acb4cc410140553ee8b809b2a43fb5adbaff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732378, "uuid": "ee25722c-dfd9-447a-8147-1ba4731e5789", "value": "T1BF451280B7A4C4F3D6A11531477D5662BFF9DA032060532B772CEB2E7B736856E0A782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732378, "uuid": "b1bcf3cb-9faa-49ad-8b25-d83727cf7b40", "value": "6144:vNeZm5qumDp4tgbr7rmb9SBC3scrzKfsnnQHDFfm7YZ:vNl7gP7rm5sCPz3nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732378, "uuid": "88b7b535-e3e4-4d80-8b34-22a4a4cf145c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732378, "uuid": "cea33035-b90d-4ff4-a6de-18cb6c154635", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732378, "uuid": "fea002d6-1d80-4af3-8131-f5bf04a01c16", "value": "LUA22030011 REFRACTARIOS REFAL.PDF.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f19d84-cc52-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651741635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741635, "uuid": "fe3398d7-382c-4145-8f63-377d4bd0029c", "comment": "Malware payload", "value": "60b499476b02f28a2effeb5e0c9d6884", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741635, "uuid": "2058ac27-243d-4f76-a602-02b24a607993", "comment": "Malware payload", "value": "23ddf03407b26649a98b78ef22f9ef4d9fd0755814ebe9fa087f0fff87593a94", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741635, "uuid": "b38cb69a-3db4-4e6a-8a70-ea1ca846ab9f", "comment": "Malware payload", "value": "fa0ed4c777b6bf4c786717866a0f59ec723f0f17", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741635, "uuid": "648359fe-90b4-4862-ab3d-4d900835401a", "comment": "Malware payload", "value": "f456df76c1ff0f507ab41a57a2931e1329aed56c1e03e194130dcb2f06a0b44e6e93917e849303f1b44f0b2f7f17fa28", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741635, "uuid": "82798176-72f4-4793-8e6b-7eb734498e06", "value": "T13134228CD78E42A5CF806777021B0E4445F9B73EB64542B2749C87713BED83E84A66BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741635, "uuid": "12e5ff5a-e91e-47e1-8ce4-93345a481d1e", "value": "384:bBiQvDr/gqgAEd8SVF4ntLDxurxglkt89LqF:tiQHIqgPnVF4ntLDxu9g+t89L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651741635, "uuid": "8057cd69-ccf3-4802-a134-0cc5c4e2b1cd", "value": 235431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651741635, "uuid": "06d9e594-3317-4fbf-961f-d4e84d2092c2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741635, "uuid": "9752ae51-5a05-4029-a29b-3294b824b51c", "value": "SOA APR 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5e670f-cc3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651731564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731564, "uuid": "5299d3d2-d74d-4de3-9dda-6c7e25dc0069", "comment": "Malware payload (AgentTesla)", "value": "82de9021ecd6075619cac9ec11c219da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731564, "uuid": "ec4f3e4a-56a4-43e8-b011-09b3b6b1a03d", "comment": "Malware payload (AgentTesla)", "value": "24282377e086a372ac84038618839d4dd3e718647701aa7688289271e35265ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731564, "uuid": "92dad971-79da-46f0-aaaa-652c1b1c1ee0", "comment": "Malware payload (AgentTesla)", "value": "348a93a0c40f4b0df3bb9836e24b4e9973e08a5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731564, "uuid": "2ea83db1-7a13-4e0b-b2f1-69193c609d0e", "comment": "Malware payload (AgentTesla)", "value": "ee92a8dbf7dc3b65f40940ab0ecd5c4f2039f7c0d4644fa512f63137eab6676aa6758a1aca805bd1f965a7db9147b660", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731564, "uuid": "ca46ff3b-21cd-4bbb-946a-d63a7b21f939", "value": "T1CCD423353097D6D3FE701B76712A4EDC27819646ED07B04E3BE6314B998FAD23E4A409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731564, "uuid": "80062981-daf3-4dd7-a4f3-7dcc02c50321", "value": "12288:PKSeLdPTN22KqKUzG/xoZZD6xgoL3e6FKs9FmjKSdKOTfk0yY:PKXb22KUGoZD6yYKs9ZSdKgfryY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651731564, "uuid": "a9498a3e-6060-4246-8bf6-31c15a43fcf1", "value": 601308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651731564, "uuid": "22880a0a-b655-4185-9c8f-7478c244aa26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731564, "uuid": "252161e7-d3f3-486f-884c-75ac0e1c0e72", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af796585-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651746758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746758, "uuid": "346d3199-8953-4258-af54-f3d687b610a2", "comment": "Malware payload (Loki)", "value": "0ebf139feb9dd170366c73d1d7a6c3b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746758, "uuid": "7aaf81ed-c486-4ab3-9e98-069d447136bc", "comment": "Malware payload (Loki)", "value": "2559470d892d939b0df177b1613313cc1b2bced2a17cda536de05d0c02e09d20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746758, "uuid": "57050357-ed0d-4e5a-a817-74ceb28409b3", "comment": "Malware payload (Loki)", "value": "c68443e242e7ff84b5711c531eada1d073c8c9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746758, "uuid": "f50a1141-272a-450e-b8d1-5a16ce4d971d", "comment": "Malware payload (Loki)", "value": "546f2358412bae64501f14fe59eabc943f7c24cf401b752226ea33d42920980088e755872b4ddd52a555bf4f1a74dc8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746758, "uuid": "af17f1ba-8b15-4cbb-bfbb-438a5f5dde21", "value": "T167C3021A27A4C477D29347711F36E752EEF6FA3321B4839F27606F99BC51281990E382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746758, "uuid": "b98f934c-e687-4484-ab27-4b91b76c8808", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746758, "uuid": "3307cbb0-deef-472b-a797-6d1924db4ed2", "value": "3072:l1NjcVVnLpPunbcejd/DRVT96ZaDZ0cmRRbflyhZ:HNeZmcejd7RVT9hZ0cmhQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746758, "uuid": "8bda8410-cf7f-415f-a846-dde97c039119", "value": 126442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746758, "uuid": "f3154262-9fdc-4036-b633-875bee8ed16b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746758, "uuid": "6380d983-4c71-4cc7-8d4c-bd681cc035b3", "value": "0ebf139feb9dd170366c73d1d7a6c3b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0157d389-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1651730145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730145, "uuid": "bd09dfd9-7047-4f05-ab8b-fecf53ecdca8", "comment": "Malware payload (ArkeiStealer)", "value": "d2509eb89c22c203e4c96170c33cd698", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730145, "uuid": "179c0aae-429c-4bdd-a21c-f9888b76ec57", "comment": "Malware payload (ArkeiStealer)", "value": "25d4ec4939eeded4ee26d91dc1312393c6cb42b5449a541034ad07608668e1b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730145, "uuid": "42b8eab6-0bb8-4b15-8dd5-92976c682727", "comment": "Malware payload (ArkeiStealer)", "value": "d1c792caeaccbb6c3a5bdb8dc86d61569969dd2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730145, "uuid": "071af31b-ec87-47eb-ba64-1e0a731b5eab", "comment": "Malware payload (ArkeiStealer)", "value": "f82e42e2d92f720fe8960540e24481e2649528fadedc645cd955056bccaaa1ff43a50f10255fb5f4a97cb5de1e950089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730145, "uuid": "996d0d0e-d572-4441-a5ca-4f18a3a951b0", "value": "T18784F111B690C071D5E34A308431DAA56EBEFC636678094F3BA4277E2F31EE15AB4357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730145, "uuid": "78eed6bb-9834-4c08-a762-ae2d66753aa6", "value": "9ebc8867b651a1072783bcc1dc531b90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730145, "uuid": "a989db6b-0960-4cb5-b72a-f67dfe733e2e", "value": "6144:tnNXMveMa4oxWCIldttJ1lWDz5AjmfTOHzosoIrXYNYr4G:DXMf8LIfdelmzoSfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730145, "uuid": "68d853c7-9369-4c75-a83d-28ea2c4b5170", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730145, "uuid": "0e8ac1ae-41e7-41ac-ae6d-c9ee3952aba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730145, "uuid": "3501c6fa-7858-429a-a865-5b5ffa35585f", "value": "d2509eb89c22c203e4c96170c33cd698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa239e2-cc50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651740603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "f8acfb0e-cd71-46e3-aeaa-19992bdc0f7f", "comment": "Malware payload (Mirai)", "value": "ad6712f1375a99e9e8d4dcdfa60b23dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "014584d3-6132-40b3-954f-a22addbacea4", "comment": "Malware payload (Mirai)", "value": "2694ad338a95d9012166e42789d69b15d3d88a3bcdebb38421a5bb7ddd2f2200", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "914bc04d-1340-489b-9487-df18c9477a05", "comment": "Malware payload (Mirai)", "value": "baaaa1d64d9eb32b4ccd4bb2fdbf25965827d796", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "20642677-29c7-49e7-aeb8-20b68172c3d2", "comment": "Malware payload (Mirai)", "value": "bf1095fbc45505597a98aaaa098183102d61c655b1dcf919c185fbb99bd8d1e3b9e7001ec7f609630261ced4b8d351d5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740603, "uuid": "a10426dc-c1ef-483b-8f92-65373c176687", "value": "T185C2D01E330244D5FD1686701B7817587A221972BE43EC136797FBC2E98B4FAB9068D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740603, "uuid": "605c8ef4-fc55-4298-a437-227b248b0fb9", "value": "768:AMLqzcIV/LLwl9eaVT5R4iXNjm4+FJgGlzDpbuR1JmrW:43VXmeaVdiiXNkVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651740603, "uuid": "09cfa986-42e4-4739-a07b-857cb5249130", "value": 26236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651740603, "uuid": "abf39c8a-9b71-46c1-b60b-65206b8cfa4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740603, "uuid": "05c35d9b-ae80-477a-aadf-a4dd47560e52", "value": "phantom.mips-20220505-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4b3d2d-cc13-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651714539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714539, "uuid": "cc89a489-d0a2-4801-bfcb-8e6a3e7deab3", "comment": "Malware payload", "value": "4b4579b9c4d7b1e333773370526e6fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714539, "uuid": "71463251-f8de-4aea-8a71-707395af0e7a", "comment": "Malware payload", "value": "26fca6c897ac6142fb5c9e58eab28504d255e10c33c2f3e03435dcba7d668750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714539, "uuid": "55ec2a21-2e52-43c9-857b-f8a58a3a9108", "comment": "Malware payload", "value": "93b142ac84bc343913a4dfae38ceadff047436a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714539, "uuid": "a340afe4-29a9-4336-8b0a-f4311ec5c620", "comment": "Malware payload", "value": "aba490fc1ca083591cc6a290b43371d4e5b4af91c31d9a1acae36aba4c7073d1fc95d4b096b325d9288694224674f2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714539, "uuid": "9fa401b7-c023-4121-aba0-0302d708e271", "value": "T1C7863308521424FDE0F7513949928D38D4727C774B92821B6BAC42B6BF97CDA7CFDAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714539, "uuid": "6dcc564c-95b8-43c9-b521-40fef455d32f", "value": "e1e8417f4591da7741a300229f9e8e8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714539, "uuid": "199aea73-f60c-4aab-bb57-5f9cdd0806e0", "value": "196608:tuCfeIsvbo9onJ5hrZERlyiU8AdZYJERfnHrTcPze7rdIWP47yJqbTsO:J39c5hlERJAdZYyVHr2S3d7P47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651714539, "uuid": "e8ef08fa-8892-4084-b34d-cacf2a55629b", "value": 8052280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651714539, "uuid": "98ea1024-e46e-47fb-bae8-562ed54cff6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714539, "uuid": "8212ad15-be46-4558-9dbf-06be2174a85f", "value": "Discord_Webhook_Rules.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec79228f-cc8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651767906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767906, "uuid": "82129b87-ff88-4faa-811c-521699d42246", "comment": "Malware payload (Mirai)", "value": "5738e7d6cbaebbefd61435a9a34e79e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767906, "uuid": "bd4874e8-4f8c-4579-b638-751c4eee44f1", "comment": "Malware payload (Mirai)", "value": "2707e38d3d7983329919de1984a0e03ae9241e893183cb0cae0ad00fb40919f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767906, "uuid": "9e03c123-5a10-4ccc-8eee-b866f6261f21", "comment": "Malware payload (Mirai)", "value": "b1918cccc3376616d48fcab485f08faa327407d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651767906, "uuid": "a3564584-1f5c-4148-bc7e-7c6387b8e095", "comment": "Malware payload (Mirai)", "value": "fac2b0e4019f2d96c44e37dbef38f81428a37ada6690a667d1e3feb65940ebe4d391a9757eac95c4c299cbc86705a518", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651767906, "uuid": "fa322f10-7551-4ad5-a20d-74068e4dbdf1", "value": "T16C534D86FE805A12C5D21677F74F42897B2A5398E1EE3303AD296F6077CB86B0E37501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651767906, "uuid": "0bc325f8-9d1d-4613-bc7c-dbc7435876ff", "value": "768:DxpTpkZm9dZhVwtkJ0+mw3lwhRNCkx4ARKG6tLMiaxXE5WM4Kcf5abwvmrmU3u1z:VcehX+R5LR76tAiUX24Tfoc6duNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651767906, "uuid": "e9d4b616-5782-4b4b-a60c-babeaaad0ca8", "value": 64264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651767906, "uuid": "5b02a1bd-32a3-425f-b2ee-b35eb4203965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651767906, "uuid": "1713efe9-92c8-4fac-b3ea-3702cf562057", "value": "5738e7d6cbaebbefd61435a9a34e79e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e2987a-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651729017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729017, "uuid": "b2f59188-fdfa-4d7b-8e09-3c29b84679d3", "comment": "Malware payload (Formbook)", "value": "460585976637c19bd81aff58fead23bc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729017, "uuid": "9689adbc-9386-485a-8f33-83643a75c3f7", "comment": "Malware payload (Formbook)", "value": "27a2a7f338453710aa9bca030277aabc645a165879b20962788d8a42b608ea95", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729017, "uuid": "ed5b585f-c2cf-4636-af00-7447300c55ad", "comment": "Malware payload (Formbook)", "value": "913b1d9aae24ce4d51428a1fc9bb6a14b4334921", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729017, "uuid": "91ea428d-5e6b-4cbc-8cda-90e229658872", "comment": "Malware payload (Formbook)", "value": "a15a0db2ad9b5308fc26ef5b2c69a7dad7eea456827c996c3229c557d279db1d898f6245fb7891818559f8ee5ca9915d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729017, "uuid": "470c50fa-0083-4ed4-8839-6fc0768eebcf", "value": "T14B24129531C9B275E1B12AB3856F41B42780DE111EF7A65A7AC0F70B0BF4D414ABCE2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729017, "uuid": "f0f5c121-4bd4-491f-9bc3-d856b8d9c2a4", "value": "6144:zfrImp7vSk4B/v9tqkbbym1AWx/8sBOU8f6Z:zTtZvy/akbGutO3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729017, "uuid": "59990d12-aaee-47f6-8684-3dab74fac5f2", "value": 211704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729017, "uuid": "2381fbec-9c7d-433b-9cbd-df53920a2c85", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729017, "uuid": "f1e2f797-1163-4fd6-9ec6-a7c41e2aa6f3", "value": "SOA 20220405 - 51731086.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeb4aa1-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651730188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730188, "uuid": "224763da-fa93-4753-a692-22a19fc0a46d", "comment": "Malware payload (Formbook)", "value": "6f111b596da1ac7d71c4362b18309648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730188, "uuid": "412f27f0-a3f8-446e-a8cc-20961563b72c", "comment": "Malware payload (Formbook)", "value": "285e772a15413afa15e86632327faebaa56ff23d0ca19249c228b2d531e19f96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730188, "uuid": "ba6e8991-1261-4d43-b604-4c369af03682", "comment": "Malware payload (Formbook)", "value": "e09f8065342a4c8664148bec4b0d9265e7e5842a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730188, "uuid": "bf196e31-7169-4d89-a9ed-ba10873f325b", "comment": "Malware payload (Formbook)", "value": "d81fe04e3a09a50ee702d7a352b43b16331fe69300e34bf31ee232771167d04ff9152701316a3553a1960cc2976a2f62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730188, "uuid": "14812648-5fb0-489f-b1a8-b26ff6ef15ce", "value": "T14F2412543A64C4B2D6A347722A7D43BF6B5FE21320A44B5F33182E98BD31781DA4E726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730188, "uuid": "83f2ed1f-9f7c-4732-abbf-ae53aa59e83e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730188, "uuid": "2b20b20d-b42d-4e55-87ce-21d8d7f26268", "value": "6144:HNeZmLfHg6+reKq0Uzme51aUUTzC92gBE:HNlLvX+12auAVTzhg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730188, "uuid": "866c386b-5cd2-4438-a0fb-f2c30aa9b57a", "value": 219317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730188, "uuid": "6b011b4a-0aa0-447b-a5af-60b27294f1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730188, "uuid": "bd813b1f-f32d-4e1b-9340-312e1291c8d7", "value": "6f111b596da1ac7d71c4362b18309648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b05d23b-cc31-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651727235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727235, "uuid": "bb74a846-3b74-4e7c-9c54-2ae9a2887a56", "comment": "Malware payload (RemcosRAT)", "value": "87d8b152be45d513040fa8002c93505c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727235, "uuid": "fe83b1a4-d75e-43ae-a701-e3e9b8992744", "comment": "Malware payload (RemcosRAT)", "value": "29b3fca9bde3c4e210a6cc8a90257b542a136485030d2fc208b99a83614b9181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727235, "uuid": "b0b84a44-1803-4a20-ba9b-2b383a30d3c2", "comment": "Malware payload (RemcosRAT)", "value": "52be0341bee6dc1b2d3027ba046c4c7fcc964a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727235, "uuid": "cc7bbbbb-021e-4bb0-af0a-5d38e5cc2be9", "comment": "Malware payload (RemcosRAT)", "value": "90674e852d25b038ed9c4d1feb05e4a0de19a662fdab3fca069e95d86b46f3537927800f596c52374dcc32c685da2bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727235, "uuid": "ac2d63e8-5dd6-49a7-8fea-7bf273d82e93", "value": "T1C7A4AF11BAD2C072D97251340D29FB35DEB8BD2029354A7BB3D61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727235, "uuid": "c533c6bd-6367-4fc2-9659-2f78bfd7d082", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727235, "uuid": "a2b3b51f-3eb0-4191-9678-a74f278a1e39", "value": "12288:NoCqKde3G314caiojGRoaOd+2sfZsjVg:uAdIG314cFo4Od+NZuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727235, "uuid": "8edc81b9-630d-4a82-a0f0-1d081c5f3a7f", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727235, "uuid": "28e67ee3-e5e6-4c8a-9750-49f6c9c2917b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727235, "uuid": "049bb5f3-4400-42ca-aca0-e505791006aa", "value": "87d8b152be45d513040fa8002c93505c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db48b9d-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651735830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735830, "uuid": "8ea14fed-fee6-47a9-a0a8-a392acc19f32", "comment": "Malware payload (SnakeKeylogger)", "value": "99a2be3494cdadab4a2aa33ff6191a50", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735830, "uuid": "8445bea6-4588-48ec-bcb3-3971dac03a2f", "comment": "Malware payload (SnakeKeylogger)", "value": "2ae6efe3facb1539b0135dc1ec4160efe85f8639835d827f29126a197d45fdfb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735830, "uuid": "e5f2e405-2eeb-4076-8be3-136b654d2ecd", "comment": "Malware payload (SnakeKeylogger)", "value": "6930365ad2af50ddde64ba52bd7eb8e64327d37b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735830, "uuid": "13913e74-ebf5-4590-baf1-515b3e307394", "comment": "Malware payload (SnakeKeylogger)", "value": "6cfeffbe2ef7c6be400c42c8568f3d14a561a75a81bf0f2aa85a9b320f1769aefdee772e00411b355ae9bdc438902f74", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735830, "uuid": "83b097d3-1c07-4f04-93a1-899ebcc4186b", "value": "T1C5D4231006CF31E4F52FE4D5CC899EA088A3FE48E7173D97F06D6636E01AA77DA46960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735830, "uuid": "9bd10b0c-1e50-4194-bb41-1f011fe9d441", "value": "12288:IDgYTSdjMc6HrVAELUSneygi9HeNrOPzdBYkar97s6aPgKiU5Fes+vWtfIxDE:IDgSSMc6H5AuneDiB/qIYKioe+tfOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651735830, "uuid": "2d90a0e7-2f65-426e-af8f-8fbab7096b88", "value": 641558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651735830, "uuid": "a9c33d25-4d60-43a5-88e8-211d720419f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735830, "uuid": "fafae642-9832-49ed-bc0e-741540524488", "value": "SCANCOPY.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1b342c-cc39-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651730698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730698, "uuid": "7048245e-3385-44cc-b836-f569be048577", "comment": "Malware payload (SnakeKeylogger)", "value": "9817a5e89259bf9f013aa41a2d03a25a", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730698, "uuid": "06571223-533b-499b-8795-0b0437f3a78a", "comment": "Malware payload (SnakeKeylogger)", "value": "2d166039ce2ce9377dba7883cca2b1d5a91040b1229d02fdd40dd183a7619f4b", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730698, "uuid": "1b6819bf-98a1-4a16-98ba-7b047c4553b7", "comment": "Malware payload (SnakeKeylogger)", "value": "d3ac1bb716eb210f1f0fd3ee29594b691e3704b7", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730698, "uuid": "ba50d0e7-62c9-4f9b-839d-8977c1657d5b", "comment": "Malware payload (SnakeKeylogger)", "value": "289d54b1ca8309894ab1e36c6c0abc1598bf9178babe5e27f61df4c28a2ed08054a66b2f75ec223cb2bff51249261e84", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730698, "uuid": "63759c09-6e27-4394-8d6d-8c3a3f440bf7", "value": "T1D542B0DBA395DB135E02EDDBC7ACE4D210256DB05B60CF0DF28B74A00898C66E5E4AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730698, "uuid": "10d230ab-b5c5-4cc4-82d7-2f7e54f5dd6e", "value": "384:VOLTe2RAEdr6ID1qpRVAWgCUI2MMZCPARc4g:V6TvGO6II+LJcPARhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730698, "uuid": "5e99c652-fdbb-4e6a-bd98-d0876cd78bf6", "value": 12401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730698, "uuid": "39aeb8df-592b-4620-b8e2-b8bf8dca6a2d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730698, "uuid": "8a57e870-aaec-4a4a-b3b3-789f50c2b9ab", "value": "May_Order.xlsx.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e477bb-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651727923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727923, "uuid": "aaec0410-e4b6-4697-9629-4e2644083235", "comment": "Malware payload (AgentTesla)", "value": "631be6aee8162faaf8263c3371d3eb34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727923, "uuid": "f48c5c62-e3b0-47d6-9d5f-5cf0fabef218", "comment": "Malware payload (AgentTesla)", "value": "2d85d5ab9350df81fa541a5d3d6e93b8207419cdd4f930206199d78239a7175e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727923, "uuid": "61363d2e-f306-40b8-978b-d53a87d518f2", "comment": "Malware payload (AgentTesla)", "value": "3b25fddc34efe7bda8bdf0bfca7154661b2782ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727923, "uuid": "8037657c-a8d4-4822-a057-87fe76c81131", "comment": "Malware payload (AgentTesla)", "value": "167bd4137ee792f62b0b6a7850984cfa843230584ed88d76760d7165412f898c074fd0681d1389b0063a4182c4830a3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727923, "uuid": "7df16219-f142-4cd1-a0e0-0c15eeae6a57", "value": "T1672412587BB29261DC27823A72D65E6C21FB8FFA988F40531461BE53FD3A6706438253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727923, "uuid": "13938b5e-37ba-4b87-96a6-65b3fbe4084b", "value": "3072:3o20hrVJE5rt9SZ4yQEp54TtXEtcCYuR659V7t/UTCXUGbgQ+YSTwKNfYEF15dXn:4ndVJ2rtkQEf4TtXoBR65TKAgHNAghn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727923, "uuid": "842c0169-23f9-4732-9eb1-444f475d3b30", "value": 210680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727923, "uuid": "2cf5a4ae-68bd-449f-a360-584fa58ee785", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727923, "uuid": "1d22bac3-7a83-448d-8e8a-d975297bf6d6", "value": "Supplimentary Order 04 MAY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21413b08-cc7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651759834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759834, "uuid": "e691a97d-b6c7-4476-b596-77ec2570f728", "comment": "Malware payload (Quakbot)", "value": "dd36a35ad1b505d254dd24f36a497bde", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759834, "uuid": "d35c9178-7472-4f55-a0e7-226d69e5fc11", "comment": "Malware payload (Quakbot)", "value": "2e568648636c1fbb913e2ec44daa161127686b41adaaf076aa23534e85571e16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759834, "uuid": "542a941c-9423-4518-a31c-dc12337b2d79", "comment": "Malware payload (Quakbot)", "value": "6ead9880d493d016f4b454472b6a5c072c646220", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759834, "uuid": "1e4eda98-b1fb-449a-957e-a36381b1c003", "comment": "Malware payload (Quakbot)", "value": "d5b7dc22f0bb3079535ec3f21e57b73b97863a2fec525b1ca0ea6879c8a9cab71a0506fe881d124e3509250c0cc5b0ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759834, "uuid": "6cf0fe15-b8dd-4646-9054-67d1c0762ee5", "value": "T104F48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759834, "uuid": "0566122e-977d-41dc-abb6-4f83ceba5b49", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759834, "uuid": "e589514d-2f4c-4dc0-98cd-8ee8308d396f", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPiu0Q1acvZRz5Bt:bUzrOKfQUDZCw1RZRdBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759834, "uuid": "362fe107-e1bb-45f3-8604-332a5b44015b", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759834, "uuid": "0155ec64-bf31-4843-9bae-e7c34c67f4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759834, "uuid": "367c0d0e-cfb6-439e-adba-6231ef6d5618", "value": "44686.6703287037.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261f047c-ccae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651780887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780887, "uuid": "022f7879-ef29-4f0e-95c8-d6b423078e9e", "comment": "Malware payload (AgentTesla)", "value": "56e9cadf8b0a8544a5dea1efbfd26bc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780887, "uuid": "bdc4d4d8-f293-45ff-bbb3-9aad6be48861", "comment": "Malware payload (AgentTesla)", "value": "2f649f9aa9da4d70e2b2ba94f9f04dfcc5ffa8e1b53cac8db047ec6ce1edcd3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780887, "uuid": "c9eaa4a9-2020-4723-93ec-41ad1807cf85", "comment": "Malware payload (AgentTesla)", "value": "1b03012aec71350bffb39d007eb7a0f95f3fc8b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780887, "uuid": "22804c36-a042-4d26-b9a1-d8efcf45bbe8", "comment": "Malware payload (AgentTesla)", "value": "48c5d3af88e188c8ee34ad0371be2e30cbc17c6ecb50c36d4b32459ad8ae1fa8b2d7caf9c72cd297e12c1a017df55f10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780887, "uuid": "4ebd5bea-54f9-48f1-9551-13ada1d6e73c", "value": "T119C423443281DC63B7177048CCEF6A844D4DEF53A7D12BA9F6875E8FFE86A91C211885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780887, "uuid": "576e8016-c6db-411c-89ff-43ab4ccd24cf", "value": "12288:4I9tEfcLntCsKdkZ4xVM2MC6cSc++1U+rCaEujb7/EfnxLw:j9tEUJXZ4xVM2N6b+uaJjb7/Q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651780887, "uuid": "c1bfff0c-a5ff-4b36-8592-1fa7d1698d79", "value": 571176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651780887, "uuid": "fea8e304-f990-40a6-9e1f-f9a392e8c596", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780887, "uuid": "f1aaa48f-04f4-4a19-ae61-12a0e29fe209", "value": "Proforma Invoice #15032016-A001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0395692-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718896, "uuid": "39fd78df-e751-4652-9710-e7e3bda63e9a", "comment": "Malware payload (Mirai)", "value": "3e67054276aea48945fca69dfc3bbb42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718896, "uuid": "b0287b20-d383-4c4f-9fc5-83d913fb22bb", "comment": "Malware payload (Mirai)", "value": "31d720ca7d4b9b6fa6fc33e7de8878ef1e507de54506f1173a1fedec8010f08a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718896, "uuid": "f185e980-e441-4242-a01c-821033f71710", "comment": "Malware payload (Mirai)", "value": "7318f7b25cb57e2c6ae9f2b01f95b5e3665d235f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718896, "uuid": "c6a59d79-c165-4650-a5df-8ff13392a0cb", "comment": "Malware payload (Mirai)", "value": "084c25cbb9fce9a336c3048a4565e125be7e93440eb15d7f8551af207854580880e2d2de36d7f024ceeb316ee77ec6c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718896, "uuid": "3482145e-9424-48e5-86f8-a96a59a7a72e", "value": "T1A4F2F134600C9021DA10ECB1DC6B86C3B792857CE937B2663AB68E4D53C1E566FFE467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718896, "uuid": "248a39c3-25d1-4f7e-a2af-aac997e632af", "value": "768:hdVP/ldUzeOVvFWH/sklrwmjfQQaVW1ea581r4WQuVZG9q3UEL5q:1LUKOVv4HRwmLQQaVW15GFrhLLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718896, "uuid": "50a911b6-1497-41af-aaa4-97af95c51627", "value": 34916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718896, "uuid": "a90a9f33-4c0a-4678-af16-d34f6b59b74e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718896, "uuid": "0d3e8063-a29c-434c-b59c-5addf4ffb74d", "value": "3e67054276aea48945fca69dfc3bbb42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bda535-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651727814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727814, "uuid": "250a780c-8c6f-4b28-af64-5b0a765208e5", "comment": "Malware payload (DCRat)", "value": "c5097f98c49b1a92ae0cb6171a63b42d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727814, "uuid": "212e0842-c484-4a7c-902a-ca80087f7e53", "comment": "Malware payload (DCRat)", "value": "32bf6396ba19b940a778f7ab4f62dd79ac1ddbf65524f9c11631b0f7690af0bc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727814, "uuid": "00689962-3129-459e-ab2f-f4c9e5fe5292", "comment": "Malware payload (DCRat)", "value": "88f2248464b44c0916e504a2bceee893445cc018", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727814, "uuid": "c414e218-4d60-4c88-908c-97a8277fdcea", "comment": "Malware payload (DCRat)", "value": "e54a4595fc19a64df32dd425bb94a79b59415f734f3f15796dd952075dca83ac0e479d6136115d6f00cde0a7b266fcd7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727814, "uuid": "cd3159fd-0f9b-418b-aac1-c06f5d50c16d", "value": "T1768584342EEA502AF173BF7D8AE47596D96EBAA33707985D00B103C60723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727814, "uuid": "6ab5eca0-555b-45d9-b737-6db579e62e51", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727814, "uuid": "8eda744b-9bfe-4731-bfab-670a1de7195d", "value": "24576:z2G/nvxW3WeyTMF3afCcS7VjnhewU2EyotgxkW3Ak/0MpqrZ2C:zbA3koFqKcSFnhKGAsEkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727814, "uuid": "78dfc81e-500f-44d5-8e8f-dcb7d71612bd", "value": 1788524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727814, "uuid": "1cb1259c-1407-4ff2-90bc-1bb7da561f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727814, "uuid": "7a012cb8-e83a-4dcd-ab2e-e2b31ebff2dc", "value": "c5097f98c49b1a92ae0cb6171a63b42d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8903242-cc24-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651721836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651721836, "uuid": "9862297e-70e5-4009-a4b4-7c0ddcd13848", "comment": "Malware payload", "value": "732132623989caae367e0878298b7e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651721836, "uuid": "271d691f-acc1-47d3-84f5-b808c313208c", "comment": "Malware payload", "value": "32f431ba791fcd1f53e53b26447c9dbf59983549f567bac43ea9578b98de4ca8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651721836, "uuid": "3ac3b7d5-f6a6-473d-baed-5fbe732d27dd", "comment": "Malware payload", "value": "e493be600aa8ecf7384ac3f23454daf6fdd1821d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651721836, "uuid": "99560e3e-3e1d-4358-a7e2-20b77a1c9eb4", "comment": "Malware payload", "value": "7ee68d90921804d990862636a69d7491819816d967236215ec27d826deff6b4ac25a5dab82f343746f707271127df0e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651721836, "uuid": "1049fe49-c20b-4e09-a08d-6eafa41e13ba", "value": "T1DB84BE10BB90C034F5B761F48A76C3A8793EBDA19B2455CB62D43AEE66346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651721836, "uuid": "a9a93d24-abfd-4919-9933-af84a23c679c", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651721836, "uuid": "1ce04414-5cf7-4de2-8b9a-5c3cae470fc7", "value": "6144:SOHGuNkVVlgz8djnAv3GsrCynHcyMHwLQ9zsF2RcS3+Xyiv+Y6itQ7VsS:SihyV368djA+spnHcyMQwSS3+B+QGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651721836, "uuid": "5608cd8b-c716-4816-9c5a-252fca156375", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651721836, "uuid": "6a6e0f42-85dc-42cb-99d2-a12104e59d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651721836, "uuid": "2b07bdf7-7e01-40ce-8cb9-0c03f1f76ff4", "value": "732132623989caae367e0878298b7e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9c9020-cc5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651745193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745193, "uuid": "19ea950f-d277-4518-bdb5-79071387987c", "comment": "Malware payload (njrat)", "value": "4140ab12d50a4f4280d4ca217504b67d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745193, "uuid": "8a2ffddc-5e51-44ee-867f-f1126aa84dbb", "comment": "Malware payload (njrat)", "value": "32fc444ecd68e5f289caa412faa0374d3ab85a8737f19846f46ad41c36c0032a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745193, "uuid": "3edcac46-acbc-4df4-9526-4444a23e1561", "comment": "Malware payload (njrat)", "value": "1c4179345b8433f78aa63b8d0a5aa1b2f4153af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745193, "uuid": "3388446d-391a-4e06-93c8-7e4b00051925", "comment": "Malware payload (njrat)", "value": "976a21adcb6af56ad630217ea224fceba09e8dbfbbbdf3f3b81b5e576c13287e837333b11adfd983515bd4d80fc72a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745193, "uuid": "f667d7cc-a220-4a53-a9d0-d53bc08d0824", "value": "T1BD74121646EA8737DF783BF21AB093C113B27E59B422F3C8AD5643ED94D174A0911FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745193, "uuid": "8444a3f4-73c3-40eb-adc0-e8db4d73b50f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745193, "uuid": "442e10ad-2834-4b9e-9a32-7cf0083dcedd", "value": "6144:ij2YuO7sTBMI9SnsjNDp1z/zyLGcOxWdOkDtlCq3CPlUMrjVipa+a4ySWwIcDx:ij2L2Iwnsjlzz/+1OaOkj8lUcREOshI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745193, "uuid": "474d1da3-f1a7-48fa-b1e9-ffc07d588fad", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745193, "uuid": "c7231984-ee8c-4519-ae25-1f66094e68be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745193, "uuid": "91d70e7d-3be4-4bfb-a637-b32dad05e29a", "value": "JoAnLHTh0FTGIiB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815c803c-cc63-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651748828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748828, "uuid": "622e239b-85f2-4ed5-ba1c-f8d4b3d4fc66", "comment": "Malware payload", "value": "11d6fb5053b2f541492121450e8b8bba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748828, "uuid": "2d76573d-0ebb-4caa-9c6a-61883041fc06", "comment": "Malware payload", "value": "345ffe9aac541522b41a48a74318e896e6333a2f02c57a0ef47ec49820d225f4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748828, "uuid": "d2b26c73-33cf-4378-abbc-03ebfee374af", "comment": "Malware payload", "value": "bdb841068a9e0302f7316a81e70a93361e41ab0b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748828, "uuid": "283a4e06-053a-4a15-b1ea-bf49f9d7f49f", "comment": "Malware payload", "value": "d6ce870b65fb1f0ba8862d154e8e214d63a39f0947018d2aeb9f705602a7e1293b4e3de8278d7f6a2383944352dc3475", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651748828, "uuid": "53b6b079-a074-4160-86fe-7794ca3a0389", "value": "T137744C07FF40AEABC85ACE3509BF835102EED5AB16C6912772ACC94CBE5770D86539C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651748828, "uuid": "a70dbefa-068a-4ec3-9f8c-310fd4fbc3bf", "value": "6144:y7YbZFkFerS/2MFLtjb3JQ0XPqpfd5iAf1Lk56DscnROQIviLuTWAiBCiLQ7249J:ZnkFerS/2MFLtjb3JQ0XPqpfd5iAf1Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651748828, "uuid": "03c12134-a7e3-43d4-8921-7f1dcf2793a8", "value": 341872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651748828, "uuid": "9def89d9-3ba5-48f1-a67c-758e1be8495f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651748828, "uuid": "25a67c7b-7888-487d-9246-0e3a9c45ca9d", "value": "hajime-like", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0951376-cc21-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651720668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651720668, "uuid": "1f0573b8-a9aa-492a-90ac-20e10d335f5f", "comment": "Malware payload (Loki)", "value": "450cb3eedab7e0518edb554eec84f954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651720668, "uuid": "83c41931-4da3-464f-b4a7-53cf8139e2ad", "comment": "Malware payload (Loki)", "value": "348f2b5862c7c23c20796418f8fd234f91ddb5a8dbf88c0115df2937bce6179f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651720668, "uuid": "e667bea1-84fc-4735-97a2-78dcf6d319a3", "comment": "Malware payload (Loki)", "value": "435f476198bfbe138f8dc966763f7dc901396b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651720668, "uuid": "e52b830e-fe6b-48ef-be24-16c358c1a55b", "comment": "Malware payload (Loki)", "value": "e87d2c82f927af5bb8b6cd627534be7510f0436c87e2fea1e9d06b2cf9db76cc8448fd96b5e1c0947d6b841b3585531d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651720668, "uuid": "667b5de2-c2a3-41eb-9911-2afe5c637cca", "value": "T1A0A4015876D9DF51C36445B5C1E7142403E2AA4FBA33C7A63E8906C60E413E6CECABE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651720668, "uuid": "02faf717-7a23-4d8e-bd3f-16916eba444a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651720668, "uuid": "fb0a1d94-b67c-4a13-900b-b73041eceb86", "value": "12288:JszQq20AVRY3UIMZRyPv9mRk8ATgWfp8V0bU:e8MAVReUhZU0Rk8ATJ00b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651720668, "uuid": "e3f2b1fa-fd51-4b5e-bd77-fd90593b52b0", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651720668, "uuid": "13815a8a-681b-41fd-a3aa-45c2c0670054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651720668, "uuid": "a30ed399-a908-480b-8f87-be2f1af61601", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d1ea46a-cc67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651750566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750566, "uuid": "eb1ce57a-5f24-49cb-aa2b-15652b6f8683", "comment": "Malware payload (Loki)", "value": "35ff8097c821bac24a333b7e031c7063", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750566, "uuid": "4cc3ceed-3f73-41ff-b9b6-dc43b603eba0", "comment": "Malware payload (Loki)", "value": "34cd1e948f9c7cb919b9c450a0ba5a8ea4877cf990feddc2bb4a4805e1d2f7cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750566, "uuid": "48eb67f9-2fd0-4f7e-ad3e-cdc3f25d14a5", "comment": "Malware payload (Loki)", "value": "6d981406b1c1036ff817ff5baf4c035545e53484", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750566, "uuid": "6417996a-49f8-449e-a101-f75f9ca6ef34", "comment": "Malware payload (Loki)", "value": "06194db7acc4a0b1b1a7bc681170bd3fe52eb4cf4ce6fd27e2b4d699dc0e2382e81022f25509d523919f216c175eb393", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750566, "uuid": "9f8681b3-426f-4356-b482-c905b293f039", "value": "T115C3F21166A0D457D6B31A303D3AAB3B5BFED91224B4570F1320AF1D3E77A41AE0E726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750566, "uuid": "b418a6ac-ed9b-4b26-a9f3-1eadba8591e4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750566, "uuid": "95aefd72-15e1-4dac-b3ae-d2c2a5b3f596", "value": "3072:l1NjcVVnLpPunbliHkSrzzkWyzpq9nHm8iK8SJqQ:HNeZmnSnzkzpAnGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750566, "uuid": "4f5772de-3172-4145-987a-8cc241fbf249", "value": 127062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750566, "uuid": "0db0a1c4-821d-4efd-b1ad-b586526a264a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750566, "uuid": "a01922de-29c3-4a9c-868c-60fec4089363", "value": "35ff8097c821bac24a333b7e031c7063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22df240c-cc70-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651754253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754253, "uuid": "13a1c6f4-6bbd-44aa-b721-74fc3d08bb94", "comment": "Malware payload (Loki)", "value": "5359cbd5ece040513783eabe74a43158", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754253, "uuid": "c2a7274c-b5c9-4dcd-8415-51b9aa174a88", "comment": "Malware payload (Loki)", "value": "366d52b4d1191b7cc3b5ebbc5da9d17c999f5db60824bd582df65d4b77717cad", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754253, "uuid": "06a1678d-89ae-4177-9cb8-3630db93dd25", "comment": "Malware payload (Loki)", "value": "b34257081062e057550d9fc3c2e57db7089af765", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754253, "uuid": "5e00c4dd-38a7-4728-82ba-9f2c73a1c0a5", "comment": "Malware payload (Loki)", "value": "6517d568e3ee6d3344341ff39c39c38cad7377d3b2e62cb41497a0f467709afce70b9175e54e5f8b70389611322fb6e5", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754253, "uuid": "84baef80-82c4-4a37-af9d-36b2cec875e8", "value": "T1D3C423B2E4BFF20203DEC618CA612234571B6DBBB0385062DF0DCA675715A7B66BD4B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754253, "uuid": "4e9563ef-650c-47ad-b586-a6799386a58e", "value": "12288:SJ/aRqkcQiEacCPO7nuzCmLVHfzNKg9nGKycF:ShaRqVc97BmhbNK0GyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651754253, "uuid": "2c687d55-f4ef-4ffe-93f6-f8ad8c7129d8", "value": 550034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651754253, "uuid": "c87331b2-6ce6-4984-ba4f-922a9add61ed", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754253, "uuid": "0125bea3-6c8c-45a2-b774-57ebab4033d1", "value": "Invoice 6581587865.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e8534a-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651733944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733944, "uuid": "7aab6b90-bc2e-4294-84f9-c559abf426d8", "comment": "Malware payload (AgentTesla)", "value": "186652d7ffc900eb5bf55e72c7ff07d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733944, "uuid": "97e158c6-12fc-4eba-bbd0-c055836c1f21", "comment": "Malware payload (AgentTesla)", "value": "372f3ede21d2dc6c7f2ef29b36a29f8473ddb9d069c5a29cab5d26f9b6f3ecda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733944, "uuid": "6b4ab88b-6a3b-4d5b-9813-9a99413466f6", "comment": "Malware payload (AgentTesla)", "value": "a298ae3f26515bf2795dff5e415f01184e00fee0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733944, "uuid": "eeb5780d-a6d6-4199-b92b-e33e23979a7f", "comment": "Malware payload (AgentTesla)", "value": "2801b217253fddc2eeed22d05751adfb2e3059d7728148f952b84775fa7eecc6dea18c136943837c4ca24b73416c1163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733944, "uuid": "28f192bc-3e4d-4e88-b552-b69c91b4a812", "value": "T12BD4D09C7661B2EFC867D4B2DE980DA4FA55397B931B0243E02316ADD90C49BDF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733944, "uuid": "52a37ce3-6e0e-451c-982f-f09c99ccea53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733944, "uuid": "d63727c5-ba36-45d5-b8f3-0e6428f1c3b7", "value": "12288:kSatuEQ+PG9gTs8J48y12L2I23fh3jCjsu68jpCr6p9qgBX3:kSa82wfVOsuRjMrIq6X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733944, "uuid": "d02dfcd2-513c-43de-baad-233a587307d4", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733944, "uuid": "6686cccf-a6c4-456e-9901-3aae747e51b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733944, "uuid": "59e49d29-30cf-481f-a1bc-ee8f03c2fea0", "value": "186652d7ffc900eb5bf55e72c7ff07d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6509c4e4-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651757370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757370, "uuid": "c5747970-9198-4fdc-b178-5c1199c51ba9", "comment": "Malware payload (AgentTesla)", "value": "cc69b119e62b3b15a34595cfa912d3c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757370, "uuid": "635895e1-278f-4f20-ac46-a4c39b2d9222", "comment": "Malware payload (AgentTesla)", "value": "3784c2d45c2934a03655c9df964800bd30d987ebe27e783d111f2d6910aa7f59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757370, "uuid": "8273481b-05a3-4b08-8684-18519eb3d00f", "comment": "Malware payload (AgentTesla)", "value": "10947ad07e83f71e7498c53f518741e14cda7f77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757370, "uuid": "17ba99eb-dcf1-4d2e-949c-3ac4b180c51a", "comment": "Malware payload (AgentTesla)", "value": "681ef8bcabcc62207dab855e5ab39ed11ac6020f6368f40dd8ec70be643cc912f60e8826da617fd31b5e1225f9319e14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757370, "uuid": "19cab5eb-9e80-4ab0-b057-c37cecbeef52", "value": "T17D2412B27424C947C5E6D5FD1DEA8B3445FCEF0A6900830F7671BD3B0A33AA0B8655A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757370, "uuid": "c7d8cd74-726f-4ae7-8cfb-474e9bfba607", "value": "6144:Bcd2X+BqdZHIGcRNSPEUo4U0JYb79FfTic0:BccucjooP7DJYjTP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757370, "uuid": "3a079d12-f255-4ca9-a389-a7c3ab114695", "value": 211464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757370, "uuid": "60856c33-73cd-4676-b8ad-8dc9b37bc53e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757370, "uuid": "38236031-2094-4f4c-9c06-97da152af4af", "value": "DHL Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc182867-cc90-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651768254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768254, "uuid": "1cf09e2e-a94f-4924-81a4-f50c84410fec", "comment": "Malware payload", "value": "39e1cf2850b27d2682bbe4bf0201ee9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768254, "uuid": "b85b1d17-72ae-4975-a8e7-3c262d6557fc", "comment": "Malware payload", "value": "37e3a3e4a0b161fbfd16602bb993ceeb34a7f25f2fc6d36459cc35afbff92363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768254, "uuid": "85ade84b-37a1-420f-9891-5f918bbbaf1c", "comment": "Malware payload", "value": "d42623521871430fff894acc667bbb1b5f657375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651768254, "uuid": "cd8998fe-8f01-48d1-9b82-7f7461b504fb", "comment": "Malware payload", "value": "85203163f14a0e89d21027c3bf37d3eb9704f9713b6cb75e0d31c5d9eac0b0940c57c59bd49c5b1d5d925f897f9a396b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768254, "uuid": "23e91101-80c8-4c15-9ac4-152b6d359548", "value": "T12CA25B2923D5C773E4FB4B3355E70A90A7B1D6255637C70EE8C5023ECA637060A97B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768254, "uuid": "231fe7d1-e61a-4ae3-b073-f7283e2d11f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768254, "uuid": "a732583e-9e33-41cb-a2b1-15413a2f49e4", "value": "384:ZUwBG9iQYIe/U5dup48Nffa/SUaepk0OOyd3zDzYHK:ZUwNAvSUaq1LyJPz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651768254, "uuid": "aac0a9b2-bee8-452d-9665-3cea96ef1245", "value": 21504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651768254, "uuid": "ba0698c2-8d66-419c-b879-37d8f9a6a21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651768254, "uuid": "1cdf6895-fc69-42e9-bf18-7bc7b2ce6712", "value": "SecuriteInfo.com.Trojan.DownloaderNET.375.8931.18470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4085b059-cca3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651776207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776207, "uuid": "59060180-9f50-4953-8e49-334d1ae11c8d", "comment": "Malware payload (Mirai)", "value": "a61d46af9a72dce970140a5ccc162c5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776207, "uuid": "dbcd2547-52f9-4fa5-b277-c0c7b1a0b5ab", "comment": "Malware payload (Mirai)", "value": "3a14c5f124ebeb422aaaa783ed78e323defb72bc020673adab6040a7ea3b1723", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776207, "uuid": "a72432cd-10bc-49a6-af87-7ad01e37cc86", "comment": "Malware payload (Mirai)", "value": "9d7c6f5c5c4e08d539e91eafc24951395725dce1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776207, "uuid": "61b08104-414d-4aab-8632-9d4500738786", "comment": "Malware payload (Mirai)", "value": "d66a93d40f38014cf98cbe34d3902ecd7437c42e282fafe9f6225ea91f24915dd7608d114062e030757ebb5774e7daaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776207, "uuid": "3efe74a3-6f43-4ec6-924e-4438110b6023", "value": "T1A9C2E0AD271ACAECC0A950FA4354173A5E110BA5AD83DC0346E9F5D7DE0DCB07587DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776207, "uuid": "246eac5e-51a0-49c9-9b7f-0ee31ac054c7", "value": "768:12G214DFyos0+aOIRRa3bkz2uEgJgGlzDpbuR1Jg:12GdDgosnanRRaAz2uEgVJu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651776207, "uuid": "02d5d91d-9602-447c-ab45-01ccfc8aeb6b", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651776207, "uuid": "83103e36-241a-476f-84e2-89e26cc2f795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776207, "uuid": "2682fa4d-de92-4fba-a730-3d002ef688fb", "value": "a61d46af9a72dce970140a5ccc162c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4761fd70-ccbe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651787815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787815, "uuid": "e5736d86-a1d4-4146-bba1-de752aeedbdf", "comment": "Malware payload", "value": "baab8006cb498208891f0230c603238b", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787815, "uuid": "6b9808d9-7b17-4a14-ab3f-bc58bdb1bea0", "comment": "Malware payload", "value": "3a184d0d83b8f5fb23e99b04683716eb5c556347a6a323fd88082d21d429f3bd", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787815, "uuid": "77acbf0e-c89b-4429-9407-98bf70ea66b3", "comment": "Malware payload", "value": "aab140b44bf00baf17a235be67d0ed2e9bb48ffa", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787815, "uuid": "36cec2ca-c2c0-499f-8d5b-2a179c17ac9d", "comment": "Malware payload", "value": "f6d5fcc9aca86a61ae5f056a477587a8da2d60456aab715a8081ba03b456ac5c228ea4d55f1dcd8b2226f4aea50b9f7a", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787815, "uuid": "a7e4c86b-6bdb-4b4e-8efe-1cbea22f9f5a", "value": "T14D83023EE91D447ADF6BF07E2B68327C473E7B834480EA246359159D2439887E27690F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787815, "uuid": "ec459b5a-b711-467d-a684-3cf78ebf8610", "value": "1536:BRRoRtd5uo+p/yW2n1BfCqr+JEVvgCUCusYWOJOYK3Z5cjyhQTpxg:je35uB/67L+aVvgCUCuLBKpeEQTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651787815, "uuid": "3c1df8ed-49e4-498c-98d5-2f8bf82d3d69", "value": 87660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651787815, "uuid": "7fb8ff4e-5329-4828-b902-dedebf93e8f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787815, "uuid": "30d6459e-458f-4ead-a080-9fd554a520f2", "value": "a asset transfer agreement(6534).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609d9434-cc76-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651756934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756934, "uuid": "6592ce8f-807c-4110-ac77-2e32bd2ac218", "comment": "Malware payload (AgentTesla)", "value": "c46d4855883f83910f7b1c36a6c6613d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756934, "uuid": "26e363bd-8ec1-4e7e-b256-0c2066f21421", "comment": "Malware payload (AgentTesla)", "value": "3a1879e72af70613cf2db7801061509b536e42c1004a57e9572582d495414ad3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756934, "uuid": "3e5d843e-a9a6-4826-95b6-4b7d65739ed1", "comment": "Malware payload (AgentTesla)", "value": "190c2a28b5360402833d2367328b29f43687625c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756934, "uuid": "6c96f68d-f8dc-46c8-a903-1d59d6b6cdfa", "comment": "Malware payload (AgentTesla)", "value": "38e374264109796087c312b2c0389fae93a692c2949df88ca4f90317d665604ac54de7b1488adfac42829767c49053d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756934, "uuid": "7b8b6e01-fa0b-4611-a88f-a5b89f5e3b35", "value": "T1AD04C423A17CC5F2F89C3DF45A0997646AB16E920238F147E94FBDCAE8B3623C2055D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756934, "uuid": "0ba55786-d97d-4007-87b2-d253b5e74497", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756934, "uuid": "32d6652a-e136-42df-b4b1-56c02cd2995c", "value": "384:HSwBzUzD+G5dG8cwiZffhwSKsMrQpjVBjN4IXQxxkSlSlSlSlSlKlfalfalfalfW:HSwNsD+fwBXQpvuGsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651756934, "uuid": "653698b8-5b7e-49be-80f0-26105d6a1077", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651756934, "uuid": "a75719f4-c7b6-4b4b-bd60-e13bb89a68fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756934, "uuid": "2382be16-0195-41b7-8936-213c6114f180", "value": "MT5070610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd85c89-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651728099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728099, "uuid": "dd4ae361-ed54-44aa-a798-f770f41c4e8e", "comment": "Malware payload (SnakeKeylogger)", "value": "4090b2be7761d8fd21e9517f81b10871", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728099, "uuid": "8e260f7e-4a05-4c08-9087-9f37488f1b03", "comment": "Malware payload (SnakeKeylogger)", "value": "3b61599315b7b2f3c545912e143e618eba3cb8a494540d603f35df1253b1eaea", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728099, "uuid": "866a8cbb-f8c1-4336-bfdd-f1fccf33bc73", "comment": "Malware payload (SnakeKeylogger)", "value": "28a8662aabf580aeef219850a766167871b7594c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728099, "uuid": "b60cc630-289f-40e9-b051-ee35807a8db0", "comment": "Malware payload (SnakeKeylogger)", "value": "02dd1a3678fe4702125c3cbc09fa7978fd0a25c4b1bd5bf890b7b064507f6db84b60152611691df413f08a4ba296d2c9", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728099, "uuid": "43453e94-8520-4add-89d0-2d584a7558ba", "value": "T1F045F167E3C7FA70E6AE66BAC6B5DA68176E74A24175B74DB6404CCD39203438830F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728099, "uuid": "14ef00b3-c3f9-4a3d-ae12-5592be12bc45", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728099, "uuid": "66e43849-0036-4da4-9939-f97b93a3bddd", "value": "12288:hnnnZq3Z2muWdP8bzbBSre7EA3FgGd3BfLpZbAeb40KR+OuLBjMa0q/PeGAPUXfT:hnnnZqpdRKX1QA6q9tfN/0q0QLiNo8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728099, "uuid": "b3e0d73a-2d95-46c5-a48e-52353673337b", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728099, "uuid": "3451ddd8-152b-4553-a620-720f83bb8263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728099, "uuid": "68782fe0-72a6-404f-a3bb-6f7203237bca", "value": "AW30648200444.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e737be0f-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651718934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718934, "uuid": "59211329-d494-472b-94a5-ae9f4af4b40f", "comment": "Malware payload", "value": "9725aceb71e4cd21611770798feffb54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718934, "uuid": "f7f34862-2e1e-427f-bee6-9de233ef9919", "comment": "Malware payload", "value": "3b7d7b661eff312dcb5b4d95eb274b27b5b65e35f2b9bc57b65a783f9caf6a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718934, "uuid": "aab9b815-0e18-448f-bf3e-f7151d22a5af", "comment": "Malware payload", "value": "9e5ad1908d51b2ab73521bed6c5a79dcde9103eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718934, "uuid": "304c454f-ebec-4951-8b07-64fb1a105652", "comment": "Malware payload", "value": "0fc8689bf2e85747bdd69d5bb7c5854f2fe38ed14b32a7028af9f2162bc9f72369205b1e791f938c4c5855e29a780eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718934, "uuid": "a2aa4514-b58c-420c-b65c-654ec6e93adf", "value": "T1B284BF10BB90C035F5BB21F44975D3B8793EBEA19B2455CB62D42AEE66346E0EC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718934, "uuid": "2928d3bc-3050-47a7-af25-a1b50be3703b", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718934, "uuid": "48936fdb-0f16-4630-8b53-3723236eeb45", "value": "6144:/pbGyr9ZrrDmNUm0uW+T4VIMvbsnj+rfES3heGI/ZVj5AwIQ8h:/R5xZX6NUm0u14VBbRrzRe/nj5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718934, "uuid": "9b6a517d-650c-41ad-abc4-9a915ca2a649", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718934, "uuid": "6811f41f-d52c-433a-9146-5816d344bd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718934, "uuid": "d310e758-b082-4aa2-9e48-fb4de638d4da", "value": "9725aceb71e4cd21611770798feffb54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d35711-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718925, "uuid": "c4980280-af89-45bf-8393-7f2bc49730be", "comment": "Malware payload (Mirai)", "value": "c3a79334375ea149364d86b6d6cf0bff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718925, "uuid": "136da144-bc80-457d-903e-b71be5e84264", "comment": "Malware payload (Mirai)", "value": "3c3b05f7f0d0606c85d0d6d9a4932e9e7fff1ffa35ae13a6e4eb5ee4f7b8ae81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718925, "uuid": "4e209b50-0d88-4d84-ac05-75c96cae355e", "comment": "Malware payload (Mirai)", "value": "bf22c2089efccbc83be29b3ec8c124c39bd6f528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718925, "uuid": "0d49401f-995e-40cf-b41a-bbc49dfee3bc", "comment": "Malware payload (Mirai)", "value": "633ea8e8c0c643fe257b9cf89fedf0c2e4d832f7e44518ab93a12d21e303117562096dd7a2eb2ce4a1120371c1f99dbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718925, "uuid": "7a1ec446-8101-4e58-84c9-ff00df1c98a3", "value": "T149532B8D54022D1CEAE798FD90754F09CD551321A0A31B1FA6EBFDC33DB32A9EE16648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718925, "uuid": "383952a8-2521-4feb-aa00-998324810dbe", "value": "1536:4/mcGwksHFa4uWyg4w4qDWd7VoLg1paJs2VB:QmGyg4wx2oepaJsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718925, "uuid": "ff33f9c7-a0cb-4bb2-9f88-93d9e18f18aa", "value": 63108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718925, "uuid": "42ece8da-bcc6-4788-bf20-a38aa026c824", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718925, "uuid": "01b7d859-6614-4f9c-95ae-a9fb31f7e740", "value": "c3a79334375ea149364d86b6d6cf0bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deaeaaf-cc68-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651750997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750997, "uuid": "feed3ae1-b044-465b-9929-67c9b2130057", "comment": "Malware payload (AveMariaRAT)", "value": "ef65f094febd6189df397951e736f027", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750997, "uuid": "41fbf0a5-39f2-47e1-90ff-3b229add2e33", "comment": "Malware payload (AveMariaRAT)", "value": "3debd7aaeb15f48d0de939f185bda069d3120082b54864bfe91be0d6da59ce88", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750997, "uuid": "0d504dae-ea42-4a38-baf3-ac42438631cb", "comment": "Malware payload (AveMariaRAT)", "value": "03d9871b891dd5214ed6ba3b714d7947c8b09f05", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750997, "uuid": "0eb588f8-cc33-4575-97de-c0ab091439e8", "comment": "Malware payload (AveMariaRAT)", "value": "76b59688b66ac7b4d50d95ccf0060b1a1311826fd8f7bb2a62c55cf27e47ac0ab70ba945c040b7703c2eb31c89ea7c99", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750997, "uuid": "b7af5eab-bc37-4fe7-aaea-31823395b697", "value": "T1CA652B153388CE12D49D3236C3FA25D52BF1DED61B33C719AB89AFB128522535D0A39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750997, "uuid": "61e1eb32-e46e-4e21-bd40-36bd60ce0a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750997, "uuid": "a6b694e6-32d2-4d9e-bc44-f6cd3b7e234d", "value": "24576:v7Tz/6fl+kvXlh70cax4V1hxgD1qSkX9mZzQiJmd0BFOfMEjWrlThqdRsaJdxndr:z3oNvXlhcbDsSkX9mZzQiJmd0BFOfME9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750997, "uuid": "aaca76a4-59d0-47c6-af62-664a5cd00065", "value": 1474048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750997, "uuid": "cc49cc89-531b-437c-8ab9-3b67dc131b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750997, "uuid": "febeb7f3-d681-4171-96f9-36a06ef710bf", "value": "Purchase Orders for Invoice 05-05-22_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7456a8e-cc4c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651739094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739094, "uuid": "95a377dc-6ff0-4f98-9fcd-8b3a72919d61", "comment": "Malware payload (SnakeKeylogger)", "value": "07a44fa6e96c5729f931230202f3bcd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739094, "uuid": "e8d636fa-f576-4a7f-89dc-b59f8a15a656", "comment": "Malware payload (SnakeKeylogger)", "value": "3ed784e2416fc7dcf34cd2cd342228c45d26323b664fbb9c7a0ba767ac15fcf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739094, "uuid": "303a5981-6591-4d90-b1ee-a7e2b5445882", "comment": "Malware payload (SnakeKeylogger)", "value": "367d0b3ee64a54539b31b658aef5e0d85c1c935d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739094, "uuid": "b74e324e-0865-4b87-bcae-1da3404e0d09", "comment": "Malware payload (SnakeKeylogger)", "value": "22c00f3176819ba2a7bac49a8e77b06f67b225a5702f2fcf5b0d98ca3a87b46c56d57ff4cd872e09e350b3f0ea201c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739094, "uuid": "83ad0ff3-bb0c-483f-a032-4d7ffdf159e5", "value": "T1BBD4D08C725072EFC867D4B28A681DA4EB517C7BA31B5153A02736AED93D48BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739094, "uuid": "7f9642dc-d936-43da-816c-6eb0b1b2f9df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739094, "uuid": "46742419-02b7-4fea-bf1b-01e156ae1abf", "value": "12288:nmBdIt8RC9aYPu3ImC2L2IG7E3a3f6f7DvS2Hsbyo2zX7Z78FQR5NccC0S2FeQU7:4dIV2aE3aP6nvS2zpWQ5ccTS2FeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651739094, "uuid": "f9c22344-5b6e-43e8-8dbd-e15ba7c5311f", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651739094, "uuid": "43a4b1fb-68f2-43db-a757-5b418d039433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739094, "uuid": "4ef3b607-0840-4bdb-af67-ebc8f8dbfaf9", "value": "RFQ - PR# 1010690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c2a4ba-cc1f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651719771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719771, "uuid": "a277e8b8-4a6e-4dc0-8c1e-4b6581408c45", "comment": "Malware payload (Mirai)", "value": "1028314ffb64a8116dc0bd5d1e2c6dc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719771, "uuid": "a41d924f-f6e2-497d-9f97-0563a5a9e4b4", "comment": "Malware payload (Mirai)", "value": "3f34cb4ca0913dcf3dc1fd231cfb37bc9de688dfd28e7a07393da14429614502", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719771, "uuid": "7dae3f5a-22b0-4ab4-86f6-91a9657698b2", "comment": "Malware payload (Mirai)", "value": "eaa08fe995c6588a0d462687b79a949ada73a8b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719771, "uuid": "52189a9d-7087-4c08-ab45-c4040ba0fcda", "comment": "Malware payload (Mirai)", "value": "97190e6c258128b31cdc7203f14743c7874dc69b6508778accb3dc59b9655ecea11f09e151ee29f5d41a95e21407f927", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719771, "uuid": "d48fa234-3c4e-45e2-9f3d-86e6ba9808a7", "value": "T120E2E17FF1B52CC6CEA61C7AA0ED59E89581B046725F5F3CEF120DC89A1612798DC0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719771, "uuid": "a9734918-8427-4344-85d6-01f5f5ec264e", "value": "768:V/tv3D1sZ4LKFDvljx7pqplx5Y3E7EH+peB/bvfjIrxYfW1:ffD18nFDvlvysZeSDfaxYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651719771, "uuid": "a4cde7fe-64f1-4838-84cc-912b428189c9", "value": 32468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651719771, "uuid": "0952055c-7b3f-46b6-841f-ce8245916d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719771, "uuid": "cc34254b-baca-4b90-893a-66184f7aeef8", "value": "1028314ffb64a8116dc0bd5d1e2c6dc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33d5922-cc80-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651761394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761394, "uuid": "7664e60b-424b-40f7-9666-3e5a1b82eb94", "comment": "Malware payload (RedLineStealer)", "value": "79974e443337267758e76ec4f357096b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761394, "uuid": "00f5f5b1-5c86-463f-ab42-bd2f2ab798da", "comment": "Malware payload (RedLineStealer)", "value": "4230d52f1dc1a49fd9660931806ce700ca50a0c163fae4171ffb71a2f3ab6325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761394, "uuid": "1b5d09cb-7cce-4328-a225-64be0668cbe4", "comment": "Malware payload (RedLineStealer)", "value": "952ef2749a81f2f9af1877b7d0d97075519f3134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761394, "uuid": "8d6159a1-4dac-4421-afcf-89583b0ba890", "comment": "Malware payload (RedLineStealer)", "value": "c340167c51f1fa104fdae5f6d63f1615142041f33032788540aa0c4aa9f7840beb70bbe046c636c87e9bd88c079c86ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761394, "uuid": "3f746507-5861-44f4-90e8-79c633ce3eba", "value": "T1DF85C0E38742411BF1136432802FAE5DA1721B31578FB8B767C95EE9932B3D0A639B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761394, "uuid": "cd032e7a-28e1-4d0b-843a-e2f34eb8d27f", "value": "e9626794517ae5f9ef503b6366d80781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761394, "uuid": "afda9f6e-7d27-48aa-8bd9-5b8b1bda81c9", "value": "49152:zmWf26R/eAj2IRmqR6aU2Yru7o6/OIvpoFX:jR/eAj2IRmqRm1rCo6/OIxEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651761394, "uuid": "5714084f-8945-40e3-99ac-5239cc059856", "value": 1838696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651761394, "uuid": "92d037cd-e902-46f3-a6ac-7a86cdd400d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761394, "uuid": "0d224686-eabe-4e6b-836d-54d74824edb6", "value": "79974e443337267758e76ec4f357096b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a644bee-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651730160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730160, "uuid": "bca9f5e3-09cc-4d0e-b0c2-47ca3b9cec32", "comment": "Malware payload (Stop)", "value": "b3b85f15807072f64500c8839823fb3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730160, "uuid": "899cbae5-ee93-4d31-94b6-a9488e603777", "comment": "Malware payload (Stop)", "value": "42317469476d082efb2eec70b76f0c60080a38825263dffbf419528890771ee7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730160, "uuid": "f7508eef-831e-4019-b6d5-635e88b9acbc", "comment": "Malware payload (Stop)", "value": "4ff8d1ba9f2a16eb6bd78fee0058f59f30a3c6de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730160, "uuid": "b260fea7-b266-47d5-99ab-8adfe84edb80", "comment": "Malware payload (Stop)", "value": "8e502a69d1c4a58803409000497fe46db6c53082bca39f61273ca9905dab07b69c52f1a5398cc7888b14e000e9e3ef30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730160, "uuid": "fc6db38b-c3ff-49f5-8217-069f67d67dab", "value": "T18D050100B750D035F2BB52F0497AD3B8B92D7DA1AB2801CB62D82BEE56346E1EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730160, "uuid": "469990f5-f0ee-481e-b295-327d33ef86c8", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730160, "uuid": "2c3cb939-3816-41da-8e60-aa6d79867268", "value": "24576:Y/zcW+A7Y1h28E4Q4eAlOjCJskewoO7Y:mzBM1hHET4LlOeJvvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730160, "uuid": "88e772db-d8c5-4d5d-999f-f3eab3af6dd9", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730160, "uuid": "8021e488-2796-4d33-98ff-cbcba76e3a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730160, "uuid": "b3ca223a-870a-4f93-b247-270d8b52a9e9", "value": "b3b85f15807072f64500c8839823fb3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c43f96a-cc93-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651769409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769409, "uuid": "2a2d2820-8088-4f3a-88d8-33209b1dd742", "comment": "Malware payload (AgentTesla)", "value": "44502e16af1635f21487dccc594cc9a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769409, "uuid": "5d10ed77-0a49-4063-8514-7368cea56497", "comment": "Malware payload (AgentTesla)", "value": "42512dafdba550788ac548fab586c0f1790c5683c6613e57f5105a3e85ef6577", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769409, "uuid": "692a5de7-40f9-4eeb-8c60-1480d0f1ccce", "comment": "Malware payload (AgentTesla)", "value": "3c84e1bc8d6960caf3a16db994407a45d8317507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769409, "uuid": "b01b110d-a576-40f5-8c61-378054f8e3b9", "comment": "Malware payload (AgentTesla)", "value": "28b0aac2f2a26fc2664e0e2551f6af456723b46eb87d4c35ce0f6baf66f2a467c800cdacf6539871d12d5fab25dd9d2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769409, "uuid": "bbdb5b98-0fb2-4809-b15d-79555a8b50dd", "value": "T19D05F0642A1D6901C9BBDF314993C17583B3988E7E62B03AABE3BD7F7415741C263A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769409, "uuid": "ad38ec2e-a54e-438b-807e-96f6b8af060e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769409, "uuid": "71d91785-df9a-4c0b-b5b4-b3ef17020bb7", "value": "24576:gXeFhV9sqN+TXeQJqdJ74IYraJDN2Tqd:yeFPqqN+QdpYrmITqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769409, "uuid": "7d9f64bd-b444-4c56-8593-20d1c56fe698", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769409, "uuid": "59936d8c-3607-49e5-b05a-3406370f0683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769409, "uuid": "44015fcc-84b3-4806-a0c3-c42db59fd765", "value": "Payment_Swift_0095.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379a4148-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1651728088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728088, "uuid": "ccad7400-75d6-4261-aaa7-badc78788cc7", "comment": "Malware payload (Smoke Loader)", "value": "860c105df7bee24d82fb148b1e911751", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728088, "uuid": "1fc52190-ee7e-4198-9513-1fe89cf00a3c", "comment": "Malware payload (Smoke Loader)", "value": "42560389433675fab57a669923a7287010c6d49eadb8c07760d0a97fc9bdf6d5", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728088, "uuid": "d13366d6-4352-4a69-ab76-1094b6a80c02", "comment": "Malware payload (Smoke Loader)", "value": "fad0221c0d68d74d01ae521ea34269e11e3dbf3c", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728088, "uuid": "5d578bbe-856d-4f2b-825d-b9214382aed4", "comment": "Malware payload (Smoke Loader)", "value": "dfbd78fda4181a6d4bec9bba38362ca687f08558d87edb3b96c58600d805129c594f3d68924106d074bb92b53116dda0", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728088, "uuid": "1c522ee1-7e35-448c-a63f-4ca427d289c1", "value": "T1B7124C62FFD149F2CF2C03F56876592B866C77208FA10712BB7E661E2F05441FA1896E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728088, "uuid": "744aae97-ba41-4df7-9b49-399d0b2b7a75", "value": "5b93d93d32cd48b4478e2218c8053334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728088, "uuid": "9d6d9246-6cf4-4038-86b4-b2e99a7c7baa", "value": "192:ofuuiX0ubSoDQMXmA2WjO9r9YawFryrJot6:bhgaXmxWj2RwFWyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728088, "uuid": "ccaf7705-7d0c-44f0-b918-b029e3b90d6e", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728088, "uuid": "c6d2cb23-2100-4727-bbfd-3bae16f88b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728088, "uuid": "33b069d9-2aca-4879-a893-b279faa4e9fb", "value": "ZK PO No 20220429001 A860 mego.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b564c39d-cc1e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651719280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719280, "uuid": "a733c2f9-f226-4484-87ff-410979950c25", "comment": "Malware payload", "value": "836ab6f1aca9f5716228977ea6ea143f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass IATA", "colour": "#37175E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719280, "uuid": "e46fea42-f768-4da5-aca7-c6d7a16a8a10", "comment": "Malware payload", "value": "428680b50e046073df7f0aaf095f99aa41dd2964d9090eece817d0b6f6d1bc57", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass IATA", "colour": "#37175E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719280, "uuid": "af45aba9-3938-4be2-aa0c-014a5468285f", "comment": "Malware payload", "value": "27a326e70afc2714f9768ec4c823661709637245", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass IATA", "colour": "#37175E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719280, "uuid": "cdfb06c3-18e1-4ac6-857a-584957decead", "comment": "Malware payload", "value": "a533c1317ffe20016c6f8a58a9335e598ba97b1876eef0de2401852a92049aa1edac2853ae579e4758f15cb9526e6d41", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass IATA", "colour": "#37175E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719280, "uuid": "568ea387-12ff-4a0d-89d9-546f36dcfd5b", "value": "T1C0D2C018777DED64C44507B5DC934521CB4D6CA38FB0EA27A36276DF14743D52BA1B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719280, "uuid": "f1b1963d-8b55-43c3-8d41-7887bf0530f5", "value": "384:13NfZyZuJLEGOmaCL/yxMCjl6WwtSp1xOx6AML4/OKagqQ8FmiGQ:rmulEGOOLKSCQWBrIi4mK4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651719280, "uuid": "eef2e4a5-ef75-4130-b613-fde9b4ac534a", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651719280, "uuid": "fb3b6dd3-e5b5-4540-a717-0c49bbc2fa7f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719280, "uuid": "c5beeed6-a0fd-4a80-96eb-9235d03268cb", "value": "AGENCYXCONTROL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d4409e-cc56-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1651743084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743084, "uuid": "6989d6e7-126d-4223-9df9-0235f1bab38a", "comment": "Malware payload (AZORult)", "value": "e92dfdc1e9f165803c56270f27328f5b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743084, "uuid": "ffab01f2-ecea-4139-bdd7-1c57cb208018", "comment": "Malware payload (AZORult)", "value": "42d6ad70b55d487b04cb7681d6e1b6b7020a9ec18bd79fc02ee6844fb522f0d9", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743084, "uuid": "cd5abb15-8a12-4715-9277-4e7728bcb651", "comment": "Malware payload (AZORult)", "value": "b148cc1aca9d48bff55daf27d4da3af27dae9187", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743084, "uuid": "b5af1c27-0e9c-40cc-a0ee-af0f9e7a6386", "comment": "Malware payload (AZORult)", "value": "aff1e0a258bc37f3d9e12c758c33bf7e6461c902ab9ce8ea91a9e3b6a1a667f717444c00a95b9d0a16b01f6ddcbcdec7", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743084, "uuid": "f86e40d1-de57-44eb-a308-b2ba516df107", "value": "T11CC4222402E25337F6B437BAA5D046903BFA6E1DF6A1F6E93DA031ED0D5270E0925B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743084, "uuid": "f51051df-aad7-4b11-9745-d2e9ed6db273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743084, "uuid": "f0cff647-23df-4628-b3f7-97f366fbfa7f", "value": "12288:f/oIpAAYywCu86cU+ICr9IzWlMp452HMQ58gYOMBOB5p/haak2L2I:XoImYIXcU+fr6zWlMp48sQ58gYvI5Bhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651743084, "uuid": "ce8e6aac-4ed6-404c-94ac-b53466b6fe4e", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651743084, "uuid": "eabc75cd-8b79-4989-b542-366e298b676e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743084, "uuid": "e8987108-de41-4acc-8c0e-dbdfc5e33a2b", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981cdc39-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733404, "uuid": "e6eb2d5c-4ffd-4842-9292-b7a2231e893b", "comment": "Malware payload (Mirai)", "value": "2d76898cad8665615d2a4a000fc18e93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733404, "uuid": "d37d92b0-50ac-43c2-87f0-9f8be80885d5", "comment": "Malware payload (Mirai)", "value": "43b324477b915a080803cf9d3ca8508e53a7cde5d3d322fdd57d31aadbe7551f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733404, "uuid": "47828c6b-dadf-4261-8a53-98f5d88952c6", "comment": "Malware payload (Mirai)", "value": "915c0bb391d9046b80697f01faaef4628b875f4c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733404, "uuid": "b6e4a613-03e9-4197-b382-bc85db156a5b", "comment": "Malware payload (Mirai)", "value": "cdbe6f9faf125686e62c34b6d96ba9e305c32112bff61e0ea0057cde0e40e53201f9010a34aea2f1227b6e84a2dc47b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733404, "uuid": "8224c941-0b27-4133-8e02-5dc12bdee641", "value": "T1AEB2E18E16EE0602C051033EB52F025AF72F757A9C15BED828DBA688135B4CF7972C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733404, "uuid": "a14184ce-7314-4e00-bab1-7edfe28ab6b2", "value": "384:MhT44eyTGkYNxGdfVlAS4+w+YNBaa6e/qcG7evCxGB1Lv1RS:2c4VTqxufVlp1w+eaigOCxs1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733404, "uuid": "71169fcd-7845-46a4-b78d-7710b23e2dfa", "value": 24748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733404, "uuid": "6942146a-bbe8-4b82-b8ce-4761c0270703", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733404, "uuid": "36630366-4517-4f03-b01f-a629422789b5", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "761b55b5-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1651727764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727764, "uuid": "00dc6dfb-d3a3-435b-882e-58a63084c1ca", "comment": "Malware payload (Amadey)", "value": "796d1d6b84cdc37e7aafdcce92332aa0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727764, "uuid": "93ac555c-2ba0-4577-b73a-9c6c3a60d73b", "comment": "Malware payload (Amadey)", "value": "43b75e8257761d5ecf09465accfd778bd07ea70c32995a2f15aef33801f21b94", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727764, "uuid": "da1f6382-dcb0-400b-9b96-b4d53a7b3a4a", "comment": "Malware payload (Amadey)", "value": "5cd6580ac6d41889493b0334f3619ffebad7af60", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727764, "uuid": "28a0369d-eefa-4c74-83dc-7dcc74607870", "comment": "Malware payload (Amadey)", "value": "185c84637b996d30d7646ecd26aec6aeadb6827d95f6e3e3ebdf67a0db5d05a08383040ba6b52e0a450202091813d6ac", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727764, "uuid": "51ecdeb3-52a0-43ac-8a20-22a6603c1319", "value": "T145C36D73F1D08972D0B10E7CAD5AE6986A2EFE202C351557B6E94F4C2D3B6C2291D2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727764, "uuid": "69a15c6e-a731-4319-8d82-9f027138e347", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727764, "uuid": "74217744-0a59-4ae3-9d3a-8e053ca97eed", "value": "3072:Ix7p5EJTJY96Xx/PTK+uuHGSVG4+X8KfLgS+UCOqHzgy69:Ix781Y969TKtsKfsSdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727764, "uuid": "43f05035-bab2-458f-8d11-badbf36a8ac8", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727764, "uuid": "9fa27b90-5287-4a5c-8ef0-b2b2d806bd79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727764, "uuid": "37bc5ed4-1266-4140-b1dc-881a94abde28", "value": "796d1d6b84cdc37e7aafdcce92332aa0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91a9886-cc94-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651770021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770021, "uuid": "0a65d170-5d4b-45b2-b5cf-d43360e5587b", "comment": "Malware payload (Loki)", "value": "59387201bc0ad16d5a08ace6112ad405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770021, "uuid": "fef92588-9937-462f-8fe3-a1f967fecd34", "comment": "Malware payload (Loki)", "value": "43e23dcda71a6adf6eefb6c5c4926d2766b739b85bfafb17f5af0bb288efae8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770021, "uuid": "e14acdef-5f82-472f-97f3-5e4664d8da5d", "comment": "Malware payload (Loki)", "value": "0228bbbc27c6d57518b63eacc30cb3580f4c9442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770021, "uuid": "2bd63ed7-a87d-42bf-97d0-7682386ab666", "comment": "Malware payload (Loki)", "value": "3a029c832152130c73b5da81410db9bc6a9be1feded8bc9b67a37a255b226ee394976d48933d411c0fb102e77d76d7fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770021, "uuid": "3171b0e9-1691-491d-8b26-fb4b314fddc9", "value": "T1F6854B287198CB42D8FD363ADBB5621213B698C69F35C648F79E22618C631C36C5E35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770021, "uuid": "f4f522c1-c90d-4eff-af97-0c5482d27bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770021, "uuid": "b907da18-6aae-492a-a6b2-c9d478474804", "value": "49152:mP3gOL6bSxZRc6tOAHOSGjTJsudeQKKYoFLiYrRS5xyScnOSzgTxlpKMLrBur3Ev:mv3VYUKnnYjy/ipWk/bHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651770021, "uuid": "1c3c188b-77f7-4432-a212-65bfa3828e74", "value": 1753600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651770021, "uuid": "56798e3b-7df3-4045-9963-8f22c5e25d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770021, "uuid": "a96d9d1b-2049-4bc1-af24-c3a6692a0689", "value": "SWIFT USD 54230TT7363448474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8b61ca-ccae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651780950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780950, "uuid": "872b2507-0c2e-4467-8e57-e7c3874c51dd", "comment": "Malware payload (AgentTesla)", "value": "42bc169d645600728b2d3525816b5c89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780950, "uuid": "3893f81c-df09-4521-80e2-f28b5a218721", "comment": "Malware payload (AgentTesla)", "value": "44829476e3430e49e0dcd0df14543f8ad5f13bca99b7a4806b48801205a1f1d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780950, "uuid": "6ef06ec0-2322-447b-b330-6b2ad15979c0", "comment": "Malware payload (AgentTesla)", "value": "731b398efa3a22fc5299764dacd6e477561a8827", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651780950, "uuid": "9d41a8e0-8e3f-41f4-b007-352e55c2c115", "comment": "Malware payload (AgentTesla)", "value": "0685175a67f24afcad992a51bf7f65485649b96806295aaa72b951009467da09ee2dd7e6c9f330ee046186d09aa06a6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780950, "uuid": "8fccabc4-b613-43c0-8748-7e276e07c9cb", "value": "T1F64423D2FB84888129319B24BD079E3CD04F54666DD8FEE7C0578267BE05E887470EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780950, "uuid": "57db3b69-4727-461d-9a66-bd1848c5568d", "value": "6144:UnawrzBbpphnKWF3SPQQxxGl7bCvsR0vXxIiDWM6szonxl:eayBpDnKgUQQxclSOpiDtHoxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651780950, "uuid": "d286a557-aa37-4b52-856f-807276084675", "value": 255681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651780950, "uuid": "ef8162cc-dc86-4ef1-9d9f-f6bdde437a42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651780950, "uuid": "3b1e85af-4490-4a2a-9ed4-43c6aab2e023", "value": "documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613f5db5-cc7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651759082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759082, "uuid": "2c823524-429d-4e5d-ba95-90d9e57345dd", "comment": "Malware payload (AveMariaRAT)", "value": "41de3c5c2d0287f9e5d108ac44245d95", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759082, "uuid": "d5fd42e8-2d85-485e-ab48-ab5c7f7bc504", "comment": "Malware payload (AveMariaRAT)", "value": "44ee7cc7af264762739d99aa75cf65be3ceeab8b1244ae38e08c56f523d0f9b9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759082, "uuid": "4a119f54-c9a5-4dd7-9530-8b5b4a5aec04", "comment": "Malware payload (AveMariaRAT)", "value": "f36349de5f6a2ed2d14c53eedab2b0669591507c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759082, "uuid": "47b47d69-a973-4a77-a099-58dc43a265d1", "comment": "Malware payload (AveMariaRAT)", "value": "ccd216eefc72367514b0a8bf0b13c1a15a495ce9ecfdeb7e946ab75f8f5ac0f161bff015536354accdadf65bce3f9d9e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759082, "uuid": "cc863d61-0c92-42f2-9975-fc4badd8f89d", "value": "T17FD4D08E67E8E814D13E77746E78709883F1D6CB177A976B008583E4BB7138A36531A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759082, "uuid": "6c7a6dce-f56e-41bc-9731-b24393e4bed9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759082, "uuid": "144d47bc-7bd0-4ec8-a885-62acf48d91f1", "value": "12288:1NhFdtq0Gme8HXdEFa/mbsSml0oo0GkEnYo:fhFdtl5R3a5Idw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759082, "uuid": "fb48901c-044f-441f-b338-6759f3ee84c2", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759082, "uuid": "1a21f13a-c0ff-4636-b850-503c80dc458c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759082, "uuid": "39102caf-dbc4-4565-981e-288219d92798", "value": "Urgent Quotation Ref-JBG11008163382TQO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99194bcc-cc94-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651769913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769913, "uuid": "ba12ea08-2c63-4c91-9370-e5bf988be92e", "comment": "Malware payload (Quakbot)", "value": "e0af488d21a58e77ccc509f2a0f6e204", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769913, "uuid": "5e8753de-5d21-4e40-8221-33711748be1a", "comment": "Malware payload (Quakbot)", "value": "454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769913, "uuid": "240649f8-594f-48fd-98d1-5df476d1b303", "comment": "Malware payload (Quakbot)", "value": "d7c417ecd18f6e492301b1d0d582639841cf0792", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769913, "uuid": "fcd6df61-6382-42aa-9f25-d308752c6f85", "comment": "Malware payload (Quakbot)", "value": "f37c3277c3b48d92342095a3329397728eca1284e58c63fe22c217e3c681e33002f48654f6bfab178206b8e2d9c270c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769913, "uuid": "e2046197-0eee-4d8c-b558-3e74a228b209", "value": "T179F48D22A3D34836DD77163D8C5B97949825FD013D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769913, "uuid": "5bf0fb25-a029-43b7-ab0d-66daa0726f61", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769913, "uuid": "485e4b58-79fd-4209-956b-13a7d8577b39", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPi40Q13cvZRz5Bt:bUzrOKfQUDZCi1eZRdBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769913, "uuid": "fa866933-410f-4c8a-939b-4b37880b2d13", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769913, "uuid": "a0a51d9c-bd5d-4948-b613-42e1953d3d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769913, "uuid": "55aef981-d8c8-464f-bf11-1c9fedde5164", "value": "454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d16095-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651728039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728039, "uuid": "596b1ab6-bbd0-417d-b274-699f348a8169", "comment": "Malware payload", "value": "62610680349de97db658a7d41fc9a9b8", "object_relation": "md5", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass SSL", "colour": "#49527B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728039, "uuid": "9a8b9e1d-ec38-4e91-95c6-0c5976ae340b", "comment": "Malware payload", "value": "4594ab93854f59d72ac1231e379bd24abe92336e6808ab2ac0251e5db8704a57", "object_relation": "sha256", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass SSL", "colour": "#49527B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728039, "uuid": "def7c079-9dc4-430f-b247-0c0f06ab2c79", "comment": "Malware payload", "value": "e7860d1faa381d6be9aca9138c8181ee86160242", "object_relation": "sha1", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass SSL", "colour": "#49527B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728039, "uuid": "a4c79f62-02e2-428d-bc40-7f46ae19ee40", "comment": "Malware payload", "value": "db57db07cecbaaa4b078f9f69b7f3490313784a0ea6424d98eb415e5c6455f6abfa4584b063f075c11dd8dbcb6b48f6d", "object_relation": "sha3-384", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "pass SSL", "colour": "#49527B", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728039, "uuid": "313aa291-f7ee-4448-b476-84550c803667", "value": "T11684D01389099E9BE959C3F4BFB63D650F9EAB15864878DF007C1F0B3BA4805E98B11D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728039, "uuid": "574bbbe5-6b28-4d5c-b34a-736448c0b8ce", "value": "6144:iwsM6ctbsM6cyzcSfsM6cU18sM6cZesM6cok5:iws1ctbs1cy4Sfs1cU18s1cZes1cok5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728039, "uuid": "f25f5647-c371-4aeb-8914-3f8a7038c3ef", "value": 385584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728039, "uuid": "3e637039-2686-4a52-804e-cb528c45d12c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728039, "uuid": "23a78d50-42fc-4192-b7a2-96825bb1a02f", "value": "FINE.PDF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5ec4aa-cca3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651776224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776224, "uuid": "2cb4d31e-8220-4d61-a60f-7a619791b44a", "comment": "Malware payload (Mirai)", "value": "210877955bf01da8d4f0440e2e980a67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776224, "uuid": "e34b8c68-90ca-44b0-ad3d-11c09fff5661", "comment": "Malware payload (Mirai)", "value": "46dd84f60c584e5205af9daa0ee03307f164d88dada99cfb35781c21417f952f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776224, "uuid": "552b3b33-fa9f-4951-8e0f-0482ddbb89eb", "comment": "Malware payload (Mirai)", "value": "19a08f1bfe6c1f4676622d96a04b385b48255abd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776224, "uuid": "45b2027c-6c96-41a2-ae9b-5b6440a134c0", "comment": "Malware payload (Mirai)", "value": "d2c35ab934aa19feb806ed6e29675e0f09d1d4be6ac615228269e5b3aae69272cd440fbe6156237d2e556454ba6e8815", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776224, "uuid": "89998abf-5857-4e02-9d0e-3801c0fe0727", "value": "T135D2E0625A11FEF2D5F15738F7368ECB617A1EBAD154308A3B7944E8E485B085EF8403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776224, "uuid": "3a747ed1-040a-40c1-9046-8e8e215fee65", "value": "768:7usHfRavjycYC5HkU82CgLOQcVyaWn4RNSQH9q3UEL4O:jRwydCRh8mKQcVblTtWLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651776224, "uuid": "0e96d38a-1d3b-405a-93c3-3556f344ccaa", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651776224, "uuid": "68403991-80e5-4010-a125-968d0118532b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776224, "uuid": "51a2a8a9-a518-4ceb-a07b-5db3aaaf5d19", "value": "210877955bf01da8d4f0440e2e980a67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c9574b-cc30-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1651726904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651726904, "uuid": "1b9f15a9-5b8e-4631-b2b0-12d85a013051", "comment": "Malware payload (STRRAT)", "value": "4975e096a6000dc029dac47f93c3d390", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651726904, "uuid": "3948fc83-5361-4726-996e-98857ebde473", "comment": "Malware payload (STRRAT)", "value": "47961f207e4ab52d61abb8588caf76d9591feeac8b0172ff4dc2689aa8b5e17f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651726904, "uuid": "31b0267c-c360-4da3-a105-42bc22aff639", "comment": "Malware payload (STRRAT)", "value": "b566ae86165d5d661be610118876e967e9ebb4a1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651726904, "uuid": "03c08823-4205-4796-be4f-b0969c2cac4d", "comment": "Malware payload (STRRAT)", "value": "9564925e98575d5b4785e30ba98d58f46d27b4a96e01cd03cd1c0869a612408bd80269ff5300ce9712acd70b936afd4b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651726904, "uuid": "567b1643-0b38-42cc-b884-22b6b1fb8ef5", "value": "T11904F1067EA396E9F64F80311128D412FA9D16B8E919717F76FC0C4D2C71CA92607BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651726904, "uuid": "296588f8-c83d-4e22-a86a-2de879bd928c", "value": "3072:VIbjKZpEPiqusAF4NFnabRi8OK4UIa6LwAUEYC:mjKZziwtyxTcqYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651726904, "uuid": "78b759af-9e4a-450d-99d0-627fc3b70914", "value": 174476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651726904, "uuid": "f5e6aec1-cdf3-4a01-b093-82e4fa289504", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651726904, "uuid": "d7c38ac7-619c-437c-b69a-c0ebf499f3ff", "value": "Purchase & Sale Contract.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5159985-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651736003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736003, "uuid": "c27fb230-6118-4b79-bc88-086ac274866d", "comment": "Malware payload", "value": "323396d6b689caff1378090a11a209ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736003, "uuid": "5a243f9f-bd90-423b-9694-c7297403537e", "comment": "Malware payload", "value": "48b87eb4ae33650b8eae8e4c3927d6e3e2b5e6f4e4fa7afd6b829992a395ca79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736003, "uuid": "ece59491-4695-4302-99e1-0e38ecaecc22", "comment": "Malware payload", "value": "2b02e2bb35997d38a370c2612679d672b70b839e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736003, "uuid": "d1c8537f-099d-4e2a-8759-71f98d781809", "comment": "Malware payload", "value": "1584be74556dcd0ffaba42a4eb38e550e95f3bfb5cbf25fef3cc8a101c3448a1744558fd94815df14ad25dda01b348c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736003, "uuid": "a7b176f1-ac3e-4e9f-8a1e-760e7be2ed30", "value": "T115653BC376A2AD62C109973BC4EA052947E2C6435693FB0FBD8913644C8B7FD4A4DD2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736003, "uuid": "1aef8f35-25b0-4c71-95a2-44f756c4aef0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736003, "uuid": "1693c7cb-b1c3-46b7-8d53-121e22412cb0", "value": "12288:8CmhbYpSuIUfmI3YMFeAxTYVaFaUEJErVPxtzYO7YBS4dmz9JvizqaNjXxQ4PQQx:jYBDiWwWtlSFen5eiQptS0X5Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736003, "uuid": "8bbac7d8-b0ef-42bc-9ad4-e3cab30f7b84", "value": 1460735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736003, "uuid": "08ef762b-5118-4357-b27a-04126e5e9b89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736003, "uuid": "589eb34b-76cf-4bbb-bcf0-4467ad61785f", "value": "2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e79d413-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651746273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746273, "uuid": "02843d20-bd82-4b1a-8e72-e3cebfbb7f90", "comment": "Malware payload (AgentTesla)", "value": "936485ea9204b616fd7444fb520e0248", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746273, "uuid": "fca5617e-5b27-46f4-aba3-33fb8c04c93d", "comment": "Malware payload (AgentTesla)", "value": "4a38b47a6f414edebba7894c644b1e102e70937c3b658e5f886dad299ab65c90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746273, "uuid": "a8920434-4ad9-495c-98b4-f6e62d1e69c0", "comment": "Malware payload (AgentTesla)", "value": "ecb199b61b3a1735452038798ea41d98d01b473c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746273, "uuid": "50ad0787-38d3-448c-9049-31380b176d35", "comment": "Malware payload (AgentTesla)", "value": "b8f35b43883bf0875464c25985521ff0a1da672aae32c99bb1b11de1122b9851b3185962a5507b6d5e812e24b911c7c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746273, "uuid": "644fb353-9a20-4c4c-97b6-e6a663122175", "value": "T1E1C40249BB859711C95F94B0C0E7413043F2B98B7636E78A3FCC45D51E42BE49ECAB8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746273, "uuid": "4152b28f-0430-4209-a8e2-5e8bc14674b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746273, "uuid": "fe1ef681-921e-4cfe-82e8-1892a670e2fa", "value": "12288:rlZy2mLVC251GbeUovDEvRWgT5yrmEc3IWGUE2bWECm6eTuWRQh1Dl+/m:rLDmLMIgbtovDEvAgUCEEIHUE2SEjXTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746273, "uuid": "752e1e19-8a3e-4182-b624-b712cc28bde8", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746273, "uuid": "06fb4753-b832-4433-8dff-41aa485e6ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746273, "uuid": "6e58228f-5db3-4889-b741-035d5e24d7b6", "value": "DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7442d0f7-cc66-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651750095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750095, "uuid": "30d2da5b-e8c9-423d-a81b-dbe28da77738", "comment": "Malware payload (Quakbot)", "value": "21538116c5deb9a60e95947eec04c986", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750095, "uuid": "39a0bfd8-9936-4deb-abfa-24d67dfebefe", "comment": "Malware payload (Quakbot)", "value": "4b40c30bd19d2fe3052397dce9015e26755d109ad3cf83c5cf23a695a13bce4d", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750095, "uuid": "7ed849b8-8ab2-4583-800c-4500f0e17ac0", "comment": "Malware payload (Quakbot)", "value": "3760e6acc255d0bb1a44cc39ec4a29768cbe1e53", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750095, "uuid": "5faa733f-499c-4d7e-ab89-102c3a1d130d", "comment": "Malware payload (Quakbot)", "value": "2a3aa1349277466d418a1b1c412b038d95b3a9c2433b53c872f6e00eb387ad6ce718e5dd4f5edd6d9f4c91aabb1463a4", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750095, "uuid": "e3e955a4-5a91-4572-a344-d399acbf7754", "value": "T17934E01A6169A079D5ED677039111942C0EF302BE956FC259F4287FA3F832B74E2D3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750095, "uuid": "f69a4cc2-c4ee-436a-b010-b94db210901e", "value": "6144:P/sXnHaBFeZeUr94jYSJ19FFDA2P94f+mt8Fu2:P/GHaB0XSjYS79Q+HFu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750095, "uuid": "d4a45f65-3b79-4eba-95dd-68ceab0769ee", "value": 245903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750095, "uuid": "6d9e7643-5c10-4438-b6a1-7026d9d1b780", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750095, "uuid": "59c36dee-833a-42b6-8a1a-cbd271529019", "value": "dehnf_3406269339.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef4c74e-cc3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651732449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732449, "uuid": "fbb00700-b373-421a-9eab-51a4fefb54c6", "comment": "Malware payload (AveMariaRAT)", "value": "ad99577a0ae27ff6df631d21e081e972", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732449, "uuid": "73f34008-7e0c-4232-8e2a-87ae2b4eec54", "comment": "Malware payload (AveMariaRAT)", "value": "4b98ec32fb342b8441bad481853afc9345fc99ccb849b76e5ecce784739855d6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732449, "uuid": "c6e47b00-9119-4f56-84f5-7b1b7e5268ee", "comment": "Malware payload (AveMariaRAT)", "value": "cd7679b6556b6ca238b41fd8a5b9653dfba6fef4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732449, "uuid": "eab0c588-e091-4841-9a35-c3dda4f1a1c2", "comment": "Malware payload (AveMariaRAT)", "value": "49b8b4c1d03ff068a764ae31e50b1b29540d9d6cba954855cc1bb753530f0bfd8330fa8821d5bceb9073bcedb8a18c5d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732449, "uuid": "417884a4-faa8-4f23-9c1c-052ade8b238c", "value": "T174B26CAAABE44E27CF3A9F7128F1A1091730B351F952CBDF8848C04C4F427D575957AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732449, "uuid": "ddf23c07-bdcb-45fd-9ab5-9eb924056c1a", "value": "384:gVd96CtnXMi7Nr4nB4MhRJI7wqeW+Z//CZyEPOMK6j/jo:gVxnXNBwPowqeW+ZnEKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732449, "uuid": "613344b8-f393-472b-9494-d92583a4dc81", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732449, "uuid": "a6094feb-74e4-4286-942f-742226059612", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732449, "uuid": "172a2d51-5227-43d7-a8db-97457dcb82f4", "value": "order SW 220504 37.tar.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2d5613-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651759668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759668, "uuid": "078219d0-c44b-486a-a51c-af983da20844", "comment": "Malware payload", "value": "110c4ae194e7b49ed3e3b254d599f7f4", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759668, "uuid": "32e10f71-3b42-4f10-9c30-d192c8af3a52", "comment": "Malware payload", "value": "4c68c840ae1a034d47900ebdc291116726fd37b3ab0b7e026fad90eaab84d820", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759668, "uuid": "3f5747d8-03e0-4a16-b64d-33a3e609ae60", "comment": "Malware payload", "value": "c9a5314eb247c7441a5262a7cd22abbe1fcba7b6", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759668, "uuid": "f1ae221e-cc92-4055-842f-c27eacb0b115", "comment": "Malware payload", "value": "622e56bcf4d99e57c8f8b6e544dc0f6765a3cd35d7fc26d8cbdc60e23a2fe0a1a182a08b8528c8bfe921ea7a12fc5fdc", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759668, "uuid": "5be6f66e-105c-4d88-a3f7-b8dc8839f259", "value": "T12945050672984FBAD12F8178C5A24556E3737C058F2187CF32AC6E5A3F37690AD7A613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759668, "uuid": "bd34359b-eda7-42c9-af86-b65c0b0b08a1", "value": "6144:xC+1pTCEnVasDjNFHIBFDlyI0C6Og9CaD7VR2X+sbzXux48j1Agb/Jvpoed5baay:xC+vTCy8sX8Y2Y1AgXoed95zcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759668, "uuid": "1a9a6d48-d88d-48f7-acdb-21829e8b1645", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759668, "uuid": "241a1dbb-0bd8-42ee-b8f4-a94e0e0611c5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759668, "uuid": "02ea8f5b-272f-45df-819a-19df52addaf3", "value": "4c68c840ae1a034d47900ebdc291116726fd37b3ab0b7e026fad90eaab84d820.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7938e7d6-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651745808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745808, "uuid": "9872fdf9-d78e-402f-b316-9ef029e5c98a", "comment": "Malware payload", "value": "f724b07301c2a44a670ef7d8e42cf976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745808, "uuid": "29b3d0c8-afad-47e8-a48d-6acbeb493b3a", "comment": "Malware payload", "value": "4cdcefb9d608612a1b2791b3acbaa1733a76944b7add68a62c091744ebc248a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745808, "uuid": "edc6f19b-34de-428e-b592-efddf5644a85", "comment": "Malware payload", "value": "94c98613cd34b892193ddd60ecc8641dca660814", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745808, "uuid": "46225eff-c57a-44cd-84f1-cfe70a89ba3a", "comment": "Malware payload", "value": "df300219ab2928be7c0a3648e739f85ec571423c807df77c9225f36ed9bd400d4f386e456290d9b0b14c5eced2f33048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745808, "uuid": "1acd9033-254b-41be-907d-0ec0270b6052", "value": "T16AC2503BF29FF656C5D4B278F5C1510102E64D0DBC5CAAAA3854AA19E8B2E087F43F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745808, "uuid": "4b1ae95a-4257-4d26-88cc-842aeabcd11e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745808, "uuid": "287cf3ed-440d-40c6-bc94-c28cb251f023", "value": "192:wRlKbBpqGKDOeGklAjH26Sg76AgTHzVdz0LzIFI49zff1LDRQf1Znj4f4sd+Rwvk:MlwBcDOePTAgHVdQL0N9zff1fR1qwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745808, "uuid": "7ce80e81-d467-45a6-ab1d-aa717a72a9bd", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745808, "uuid": "34fd9a9f-16fd-486e-a4db-c0b8d7698a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745808, "uuid": "38c987ba-ef08-4a15-bdb1-664d2f0147fd", "value": "f724b07301c2a44a670ef7d8e42cf976.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baec8484-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746348, "uuid": "1f3f3446-6e13-4e99-8bec-d326ef392dad", "comment": "Malware payload (Formbook)", "value": "3fa52c2c563148fcf3adc969c127e5cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746348, "uuid": "6930f460-cd67-4587-ac84-d07dc379c595", "comment": "Malware payload (Formbook)", "value": "4edcafa6dd742ab17378bf22a62abc6945c095b30a659fedba7b4eb1ba4f1ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746348, "uuid": "4661ced0-f5ae-4060-ad33-5f405479f715", "comment": "Malware payload (Formbook)", "value": "0b6fe0d1f846dab03450ac60981818da67b0176f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746348, "uuid": "7d13627e-32af-4c9e-9a68-60e54f13b621", "comment": "Malware payload (Formbook)", "value": "1a62d46585cb96704fd13f1259efcabb769524630c0c2c49604e1bdc828fd436f18f17278679b37e2420303e9f70a2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746348, "uuid": "1d6d9759-55fd-4683-8196-6e005ba53eb4", "value": "T17D454951660A21C5D8FDF6BAC35BE79C03F7AED3CD392C4839A827E1A1231531EC6649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746348, "uuid": "f946fb80-b17d-4c50-9faf-66979ff81c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746348, "uuid": "c48b95b5-e353-44f4-b788-72b408fa9df7", "value": "24576:cysE3sOCcii1USm+ICe2ClcHmDAlGqYxwA9Nq6KnYa81Mqx3+6zF1RNc+:Zr3boi1UkClcHmDAlGqYxwA9Nq6KnYai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746348, "uuid": "8d1c14d6-cfe5-43c6-b611-d4822416db8a", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746348, "uuid": "b25740bb-a14b-47ef-871f-828cafad126f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746348, "uuid": "8956427f-fda1-413d-ae7f-c20007edeb7c", "value": "Yeni sipari\u015f _WJO-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0a188a-cc1f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651719779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719779, "uuid": "a09e1b3a-95b9-4488-b8ce-12b53d1a4d77", "comment": "Malware payload (Mirai)", "value": "e6f2e946e02506ba48f727186641fa31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719779, "uuid": "f58d1429-9b11-4884-bdee-95aeffd350e0", "comment": "Malware payload (Mirai)", "value": "508a8429a71bc9252f55db311e9b9c35014730b552206b2150d4a3698a4840e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719779, "uuid": "2be4695a-7414-457c-9bbe-e02b7b52aef0", "comment": "Malware payload (Mirai)", "value": "70624b68c8244e68715c552b0a2103ecb3684c11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719779, "uuid": "4ea1135e-d84e-49b4-bb46-297d200d4636", "comment": "Malware payload (Mirai)", "value": "0a159176a12ec0e3eb7b46bbe1fcdb13ad946956c585500b3bf137e27717b2d053a598933f340f77ad6ee78c3151f9cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719779, "uuid": "6d4839e4-07e1-4b04-84c5-e06db3c75c97", "value": "T174D2F164E8552963F568BC353CED800B494B4568C8B63FF4B31B196F53D218E24BF29B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719779, "uuid": "32846a08-50eb-4b31-895e-27887c519c8e", "value": "768:T/u9/vp7GNpycB454GdOcM7ckv3Aa4c9Ls3Uoz1:T/hycC59dl+cOAauz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651719779, "uuid": "0c7e66a7-601a-4a0e-a804-a41f11208414", "value": 30308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651719779, "uuid": "df0b6619-3674-4f03-bcd4-7944bc73f654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719779, "uuid": "c3f7556f-a923-4c3f-aac8-fed94b10f845", "value": "e6f2e946e02506ba48f727186641fa31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1532a81-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746358, "uuid": "a2ec66d0-fc1c-4c6a-867f-f0a34cf377d7", "comment": "Malware payload", "value": "9906c54f58ca6940117b24c53a039739", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746358, "uuid": "043253a2-dc56-4ee1-b2d8-8ff4f772dd65", "comment": "Malware payload", "value": "50a63763869837109a18b4f641550c6e04a851dcc0108ca02b44bc7d56702b3a", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746358, "uuid": "671d4d9e-cd5a-49a2-9aaa-7e28ee117f30", "comment": "Malware payload", "value": "c0bc4bfe695c35e375627d8f4035173adea4803f", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746358, "uuid": "85939e48-eeed-45de-9ad6-7cee2d3f72bf", "comment": "Malware payload", "value": "a75097e6b204a607b5535c10cf1a3d9ff8d61ce734fd2d90c7e2f85f6faecf187d6be7b61eaa52ffc9ce389ffd8b8687", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746358, "uuid": "901cb896-89ea-4c00-aed1-7e240e472c88", "value": "T17E45F167E3C7FA70E6AE56BAC6B5DA28176E74A28175B74DB6404CCD39203438930F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746358, "uuid": "fbebb101-1a94-4de6-a924-77e51b5d15fe", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746358, "uuid": "0613110f-402d-4341-b9e8-6db40dc69e98", "value": "12288:ynnnZq3Z2muWdP8bzbBSredEA3FgGdFsZbAeb40KR+OuLBjMa0q/PeGAPUXfQELL:ynnnZqpdRKX1+A6qwfN/0q0QLiNo8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746358, "uuid": "f56fc73a-dc9a-4ee8-82e5-e5d1ff3062db", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746358, "uuid": "f4f5f50f-53fc-4f23-b49f-655a18e1960a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746358, "uuid": "955fdf84-5eb2-4981-bac6-dbee8308437b", "value": "Order_Nr25502.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e493850-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746192, "uuid": "2ae9d0e2-da12-4aa6-98a6-5418332eabd0", "comment": "Malware payload (Formbook)", "value": "5f3193b7b2f3a24bcd14a02516e1a236", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746192, "uuid": "660e7569-4406-41ba-a29b-026e407134bf", "comment": "Malware payload (Formbook)", "value": "514fcd3e34f82f443a4d791909fbe208696fea9a6fb93fb47477c9f8c60b2a21", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746192, "uuid": "41b7c877-6f65-44b2-b1b7-e997e28275e8", "comment": "Malware payload (Formbook)", "value": "750052a75acf508182b42fe16cf90ca2d6cddcce", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746192, "uuid": "2fb77f0d-2388-4880-bef1-95fa6d18d342", "comment": "Malware payload (Formbook)", "value": "eb25e98d3e8d909333ebdc416fee17bef1b9ab8a90f5ecf21851157d5751ee7173ddcdbbebfecc1b4c7c369e34e395bf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746192, "uuid": "5b2baf4e-0dc8-426f-8fe8-677f301bee67", "value": "T16A2412A016B7FE54D461ABFAB07BC94DB637DD449C08A08F1F8531F9B0B1D4148A5CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746192, "uuid": "6db1cf7e-c563-4b34-b77b-96fa955202e2", "value": "6144:tTsfVJigCrMGXI2Q99K7IdK1BZ1JTQc1KgId:tTsdJirRXI2Q3KhP5rYgId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746192, "uuid": "1c8bb184-b592-4768-808d-cb00278e86a9", "value": 211672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746192, "uuid": "c5d21bf8-d235-4110-8bd0-d401dc580f47", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746192, "uuid": "dc2c23c7-5d27-4413-a76d-0263464783a7", "value": "pedido_639.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962fae82-cc07-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651709349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709349, "uuid": "fa024df9-1237-410f-9d7b-c6a049076a1f", "comment": "Malware payload", "value": "4ba7d1e5e1ff414641a5ea5847b89a7b", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709349, "uuid": "6c59eeb8-6822-4690-a84c-6aad22651daa", "comment": "Malware payload", "value": "55aaeb94eeab9561578506f70c931a4d65a174bb038d0ee1e7eb775dde445497", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709349, "uuid": "5d7a46e6-22bb-4024-95b3-cd91d6b0d5e1", "comment": "Malware payload", "value": "4baff31c1d7cf53357b11a63b8dfc8a7de877f80", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709349, "uuid": "f8875192-efb6-4fb6-a52e-b63d6f4a8b63", "comment": "Malware payload", "value": "8af2e18663400ef91f3f73b6117b144657d80ec743b4763eac3187d2eef8ac5cfd659bd7b080c84c4a357de1b06a2393", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709349, "uuid": "ccbc5ec0-b3dc-4870-ac90-efcc298d50b5", "value": "T174642347E8A6482BE7E914BB460275B0D9B141D6D03F4C92EE81A01F61C6BE7E0F5F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709349, "uuid": "9491e4f3-a296-47a4-9035-3151fd14f146", "value": "6144:5uBjDULzYyKhQhG5RTeKffVGlfp0VwABgi/5Vz7VbWWHTaK5cRW:mULzBi+Kff62j33z7R5aKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651709349, "uuid": "95bd6a60-235f-456c-ba23-1428685da07c", "value": 316075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651709349, "uuid": "5ef174e5-2380-490d-af4a-c922302c0c53", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709349, "uuid": "a0cdba17-c7e2-4be2-b128-ef63b369b3fd", "value": "fnh.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b30223-cca3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651776236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776236, "uuid": "2c569cfd-eaae-43bb-b41c-a4aa10d91392", "comment": "Malware payload (Mirai)", "value": "dd1d7e87745e3af43d9efc83853008a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776236, "uuid": "4567e5d4-5d60-41c0-9622-a32263e64ac6", "comment": "Malware payload (Mirai)", "value": "561c9133625658934b679c90ebb3b6ceeb22c767627b358e03fee7ad1b6561e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776236, "uuid": "248062f3-73b8-45ef-8064-3de07338ffaa", "comment": "Malware payload (Mirai)", "value": "5f45da5bfd485f6a4df32c18d10aaa7e851373d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776236, "uuid": "db906dc6-559b-4345-b301-bf99a53a3029", "comment": "Malware payload (Mirai)", "value": "460902e91872f9756cb21dc3f76c6d9b91d34228fec7e0e56a587f2b6d5e972e89d00e1075600c450577168f19660916", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776236, "uuid": "2767794e-f4dc-4999-873a-bcb5bf5a9fe5", "value": "T1E1333AD6B902AD7CF99BE6BE80270E0AB13123541053073777ABFC937E32194D956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776236, "uuid": "bcaae553-2780-405f-b44e-0fcda3e4974b", "value": "768:ACeKEfhe5XdrbenaIDfN+EQnAUdgFHQaiPuvWeffpqmUJTkr6Lu380DO:hsfIBZe3l+UFQaimvppqmUJC6Lc8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651776236, "uuid": "b9db7e60-4b9b-49c8-821e-5022526e92e6", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651776236, "uuid": "961eaed2-9d41-4487-8363-83ecdaf5f68a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776236, "uuid": "1976f384-5acc-4267-a8f1-442b8f6cded1", "value": "dd1d7e87745e3af43d9efc83853008a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8978af0-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718883, "uuid": "4541e433-2e21-411a-9db5-4ae54104e05d", "comment": "Malware payload (Mirai)", "value": "5ed7aa27e1be770fd2a804567ab7621f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718883, "uuid": "afe4b57a-fbf9-4cde-8e3d-1861bba0c781", "comment": "Malware payload (Mirai)", "value": "562e9cee6209e1f0f6e22cb88bd4599dce740a6732870525609e6917bd009725", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718883, "uuid": "e24ce9d9-7563-4f87-8f22-f1cd50860560", "comment": "Malware payload (Mirai)", "value": "2d86ecf7a10cf17a3f4017480db9f0d6140d0c94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718883, "uuid": "64b85278-fee9-4f9b-a20f-402a01fca06a", "comment": "Malware payload (Mirai)", "value": "609f4db7ae7444949fac2eff042e4323a02afc8ca74410a58d579f5031c749d4f6d921c7fa760624a1b84e3043a82c55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718883, "uuid": "be50a8c6-d13c-403e-9a76-60871bf8c093", "value": "T12ED2D13211761E4CE8AE90BDE9AFF51584C1F90E6190C58E68C5145BFDEBF3829047BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718883, "uuid": "4b9fe2c0-eb5a-4606-81fe-ba845888689d", "value": "768:q02rM0smtnkeQMjiX0S+TLUUKBelAmjjuTlv5pPdfwEnbcuyD7URQRj9Kl:q02DswjiX0BP3KBgA6juBvn1/nouy8Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718883, "uuid": "2a344031-14ed-4bc9-b863-58737891b0ed", "value": 30756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718883, "uuid": "d3968cb1-ffba-4eb8-a428-cdb7b094cb9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718883, "uuid": "9ac7578b-1ffa-4dd6-97be-8afe21a723d2", "value": "5ed7aa27e1be770fd2a804567ab7621f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c560cf3-cc4d-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651739183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739183, "uuid": "4344c5fd-9688-435c-a97d-8ce3e134a6c9", "comment": "Malware payload (NanoCore)", "value": "738583111ef0f36a57348bb735f6a3cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739183, "uuid": "9a6734d0-5806-4d4a-8f6f-38fd823020b4", "comment": "Malware payload (NanoCore)", "value": "564285daf11bcb254fbb90a8d1a525e98d62b01c6f5c27596241e200fa7d1314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739183, "uuid": "12043e37-7aae-4741-9272-320ee6c9b7bf", "comment": "Malware payload (NanoCore)", "value": "bc580b5b7fead042a96ca84a0242398dddc7c2cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739183, "uuid": "256259d7-6ec6-4bf2-97f5-7147c3089adc", "comment": "Malware payload (NanoCore)", "value": "e0ed2efee3b8f07140bad7e8f0ecdcad3813670b70666fe839e701be196c3b975ca721c423f763bdef44d834a3499a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739183, "uuid": "f51dc86f-5de2-446e-b4f8-ecdf6891d395", "value": "T14E74E02467887B13EF3C6AFCA2E35706A7F15092E331F745BED085DE5284B261E1624B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739183, "uuid": "2022a392-085c-47b6-b331-488031fce11a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739183, "uuid": "fe565af1-5801-4457-b313-4047170753cc", "value": "6144:ApUDLXxY1YbAO4Jrpz8SO+stQRTmg9AsQJE/l+2qm5kLqt:gI26b4Fz+ttU/9P8E/jGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651739183, "uuid": "b859e8c7-16d2-4cf5-9432-c4a6109bab74", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651739183, "uuid": "f4a788f0-c3e6-41e9-b81b-2184599f555f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739183, "uuid": "25bf6c68-01c9-4bb9-abc6-60639363a10c", "value": "564285DAF11BCB254FBB90A8D1A525E98D62B01C6F5C2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987c5bb9-ccce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651794823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794823, "uuid": "1924f085-fb07-4637-8407-e06e4bb0efbb", "comment": "Malware payload", "value": "d001ec87852220a79d7cd1609cd796db", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794823, "uuid": "08cabe72-95f8-4d88-a184-9e0e63b716f0", "comment": "Malware payload", "value": "58564623819e0ae9b5b595bc5b15f213673bb0ef57ce77368a6a75653dc89eaa", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794823, "uuid": "c9fb54aa-d74f-4b3e-ab66-00d498e2cae9", "comment": "Malware payload", "value": "e24c13d8928dc5a97284cba296605dab53c8f542", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794823, "uuid": "b5187e1c-b9c0-40bf-877c-30566c1a669d", "comment": "Malware payload", "value": "5c584a095446a618ea9b99fd2f7dd6c9de155713f5137d5edfc51a0bc054a5f53a68081cb56a61aee34f48f6a8134297", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794823, "uuid": "c61a5443-c2f9-4dc9-9dca-ec526bc479a1", "value": "T12225332D8EDD6C6BEF3CAB94C3E55050EFC5CA6B0790AD5986ABC748C6C00E6D7B0164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794823, "uuid": "87b85c98-e65f-40d3-8c66-f3126605b353", "value": "24576:JkGXWwO9hE09xsxZ7i2CwnoB9OflWqidpiwxR4z6h6Yj8kUe9:P4vxKi2C6FfIqI3T4z6jj8ne9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794823, "uuid": "2a426b14-a423-4a35-ae90-b73f09081ea1", "value": 1020170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794823, "uuid": "6dea8b51-ab86-4cba-9ea9-4c14aad25399", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794823, "uuid": "ae51f164-ee0a-40ad-b76a-c753b21a0872", "value": "\u5a07\u5c0f\u7f8e\u5973\u7c73\u62c9\u548c\u70ae\u53cb\u7684\u65e5\u5e38_\u6309\u7740\u5934\u731b\u63d2\u5634\u53e3\u6c34\u76f4\u6d41_\u5f00\u6863\u9ed1\u4e1d\u9a91\u4e58\u6253\u6869.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f915e4-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651728188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728188, "uuid": "fea52d1b-3f58-4f6e-9ff7-a6224ee8dc88", "comment": "Malware payload", "value": "11e173c4962dd10c153f25c8ddceaf7e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728188, "uuid": "369d5a08-9a10-46ac-a66f-652ce248ee98", "comment": "Malware payload", "value": "5885adef1513fd351416c8a282ecde70abf91864616459a78053d76e775f4bff", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728188, "uuid": "49915120-dd9c-4d8a-9f25-2b9e6cd643cf", "comment": "Malware payload", "value": "15f4989dee9b0cb9d6c1d46dd6a28c1cdbe6db45", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728188, "uuid": "216bf451-8004-412e-b92a-c6eda81dc3bc", "comment": "Malware payload", "value": "1eeda91076dd83009bb95c41c63656cd4544a8f4f1883dde35211efed5543cbb0fbe6ed9ccf31f2759259b291f6df5b9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728188, "uuid": "fff43461-da9d-41f6-adea-804a5c313596", "value": "T16B612E88492DF24E2B60D94AABCCC90DAD5C07FFE0F4163E687B0852171CAD1A24B1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728188, "uuid": "2b3d62e8-6bf9-458d-91e8-bc5f9cb7b3fa", "value": "48:ZzldHClpZGhnpprGHJ3zlx++gC9TuYHCVMg7OpZHcZpJuZxN9aFEewncS7xRJWNC:ZEKWuH7jY7omxla5DaAoAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728188, "uuid": "e179f907-8ca4-4832-8617-2003c1d2ce5c", "value": 3454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728188, "uuid": "f533ff3c-600f-4514-b8f4-df827e2940b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728188, "uuid": "790aba35-ca53-49e1-8da7-824d1d3705bf", "value": "RERYZJCLGBCQZASDXDTKBX_COPY.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d960f85-cca4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651776605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776605, "uuid": "6e6e9717-3e3e-434e-8b28-d92b62da4346", "comment": "Malware payload (Mirai)", "value": "6050926b8dc137c383355d6d291c9d4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776605, "uuid": "c6e36f9b-5175-4547-b1e1-36d2ef67d92c", "comment": "Malware payload (Mirai)", "value": "58a9124331196df4cec71659b1769bdac0156160ddb45c9463fecb8beebdddfe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776605, "uuid": "ec236a80-a42a-434e-9f09-fed26dce345f", "comment": "Malware payload (Mirai)", "value": "5353626d66a2e059b423b8d439b1d1274611eed0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776605, "uuid": "141e4337-6a99-4ac1-ad6e-ac88e8039384", "comment": "Malware payload (Mirai)", "value": "845d60c529cebe1c5ad50704a147d71846c48b75cafb392ab8d39205dfee916a98780421c074a872268fba09c025d13e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776605, "uuid": "fb89c3c8-f941-46e5-ac26-73067590fadc", "value": "T10CB2D191332164B4CA901F35DD68C1ED71AB1689F3FD21232A280575B6D798B37F8A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776605, "uuid": "a62a1683-399d-49bb-a405-a97798701407", "value": "768:qwBA1NjQwcThlYlYXoKrEas4ccUcfh9s3Uozs:qwBA1NcwcThuuXosq4czcfezs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651776605, "uuid": "57902cf0-4de3-4506-9229-0f3c4df1cc66", "value": 25000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651776605, "uuid": "b97c61c4-4ad4-4b21-a46c-b487df496f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776605, "uuid": "b9755159-6335-450f-bb32-aff19bd4dfce", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6f2cc2-cc31-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651727212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727212, "uuid": "3849f196-cda2-4b29-aac5-6e864c209def", "comment": "Malware payload (SnakeKeylogger)", "value": "b6d5ac262af3a8ad0ed5917ed77efb41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727212, "uuid": "6f3e1272-a2d3-4038-99f5-55062cac3e83", "comment": "Malware payload (SnakeKeylogger)", "value": "58b121a0b5a2cd627baefdbc80f36b29989502aecea667ea77a7eacf863dce4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727212, "uuid": "da0845f9-dacc-4301-806b-729573d422a9", "comment": "Malware payload (SnakeKeylogger)", "value": "eec909e727547a7768154378cff46a20e432dd36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727212, "uuid": "cb18327f-cea6-497c-9ecd-0a9ef6e54f58", "comment": "Malware payload (SnakeKeylogger)", "value": "2d320f10ed528cfd520dcc29f5f9f35fa33e925736743e8bd7aacbd42bb858daa376c4c15c799d283ef61eec6959d813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727212, "uuid": "60a30515-ece4-4ec9-8bd7-edb7123ac4de", "value": "T1ABF47C2137C84E47E1BBA639A520021143F6BCD7D671EB9E2DD136DD48F2F809B19B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727212, "uuid": "3108c745-5841-4241-ac66-bade17545762", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727212, "uuid": "9afc4720-78ae-47fc-94a2-b60bbfa61554", "value": "12288:18NHRcFiu02RHzSxA0heRl4WKr/4P3+xwbIXuKkMEX5VjFqEvboJfK4gCHBQ9FLw:cM0fXHBIXwozAYbpoYYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727212, "uuid": "a3cfb514-7400-45e1-8df0-f8099740ce22", "value": 793120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727212, "uuid": "96a53a92-f594-477a-98b1-7c6807f4c8c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727212, "uuid": "f06a65be-a255-4e32-8cf1-5d102e099e02", "value": "b6d5ac262af3a8ad0ed5917ed77efb41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0253521e-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651759352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759352, "uuid": "15220839-3192-43f9-8f77-8943d9f99f73", "comment": "Malware payload (Formbook)", "value": "ea04869ec6efd644e3cbe0c7925e7521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759352, "uuid": "26e1d5bb-f6d6-41f7-8183-e6ab348be2fd", "comment": "Malware payload (Formbook)", "value": "5a1bd7caffd2c2663dc81fe2a635472b1dbd781f0cdc51268e9cf6d5e6e8ab79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759352, "uuid": "c121537d-aff1-452c-b933-1cf7c391bdfb", "comment": "Malware payload (Formbook)", "value": "72b56c3d992228ee3553294e72150d380caf0b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759352, "uuid": "aba4ca0d-037e-4ed2-98eb-11a08af77a60", "comment": "Malware payload (Formbook)", "value": "7a782e48bd6665129e765b85bfbf096f4977ef3264833c5d349a023aa3a9a5c2284e67ddf5ed37e8b0248c6876c8d760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759352, "uuid": "1c31bb95-f5d3-42a0-afae-a79891061078", "value": "T1BCE4234073234B37E67537F260219B5267F22F89B0A1F39DACB62ACF8556B560138B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759352, "uuid": "cb683895-cd08-4422-855e-1d1e8a5b341b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759352, "uuid": "e3d3d811-fa95-412e-b1b7-83b2b5890ffd", "value": "12288:ee+V1c8kY7tpT8ukOVvXGPmIhs9QoyZMAEfx0mHGqLTSi2L2I:+U8kY69E5kqLTSi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759352, "uuid": "bff10fd1-12e9-4a5f-a369-5f1226d2cb3e", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759352, "uuid": "fcabe846-1e29-44f5-a6ad-b560b239211e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759352, "uuid": "9306e37f-a490-49d5-91ff-711f045cfd48", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e8b1bb-cc41-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651734097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734097, "uuid": "ee0aeecd-46b6-4a28-817a-26fd77524635", "comment": "Malware payload (TeamBot)", "value": "f20c3808db1892168a568beeff416e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734097, "uuid": "d5cebcac-039b-41c2-afb9-3cea2d2d3527", "comment": "Malware payload (TeamBot)", "value": "5a51ed37569cbfeccfa669a1b3b5c4029e9e91e65112e18324ab66604f17fa3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734097, "uuid": "4d56cdb2-1760-4b26-bde3-eba102446499", "comment": "Malware payload (TeamBot)", "value": "279a146b785b401d88387a2e4fe1b696e8254d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734097, "uuid": "59b4378c-7e98-4f01-88e6-22fb9bbf735b", "comment": "Malware payload (TeamBot)", "value": "d779e2d6e2b6d31101fc61945189ecf1e6fbe8b075d3bf7260adfddd1e7fd45d57c821cdb8cb843b4740693a4886f70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734097, "uuid": "68d7e0af-9252-4fee-9a5a-420865aa99e6", "value": "T1E2549D00BB90C034F5BB15F5497A93BCB92DBDB19B2851CB62D42AEE56346E0EC30B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734097, "uuid": "ff1a6114-f64f-49f9-9282-895b41589e85", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734097, "uuid": "b6ea46a1-52ee-4823-863c-52ca8b9df9d7", "value": "6144:yHhGqNXCrulpduZzziCH59KN/rZ44BBngUA7Z9xv:yBVFS6pduZSCbKN/rTBn07Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651734097, "uuid": "12ee0c70-9067-4fe1-942e-46e8f63ef226", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651734097, "uuid": "47181e25-d7ca-4d2f-839e-82b7310d9c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734097, "uuid": "d760f4ba-b70e-487e-9ab4-c143024efa28", "value": "f20c3808db1892168a568beeff416e59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d39255-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746363, "uuid": "4cf061d2-1dc1-4b82-9d6a-59e03c25b16d", "comment": "Malware payload", "value": "1140552ac3fb976d5925ab7c788a7bbf", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746363, "uuid": "be12a8a4-28de-41fc-b25a-39807b9e27bc", "comment": "Malware payload", "value": "5ab43007bc2533c3a5a09862b090d689c96fb2ffbd204139878593554238d6e4", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746363, "uuid": "922d3a92-dbd4-4f66-b83c-3cd33b1d7806", "comment": "Malware payload", "value": "35084c24976ce0351704234bddbf13107cabd361", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746363, "uuid": "41fa821a-6bec-49ac-a19d-d2e2b372f887", "comment": "Malware payload", "value": "6e3d2341658f8d2a678f46a543d16aeb228264ba81328515fa4c0da761cce6ad32e4fb7c0dc0ecde404fa87dab3beb9c", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746363, "uuid": "ed721488-0a5f-4738-abc6-024d2d7f342a", "value": "T1F8124C62FFC14DF2CF2C02F56876592B862C77108FA10712BB6E661A2F09441F52895E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746363, "uuid": "787824b2-279a-42af-aeb6-fec984145ac0", "value": "5b93d93d32cd48b4478e2218c8053334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746363, "uuid": "23151021-f321-49da-a284-a6ce7310db47", "value": "192:ofuuiX0ubSoDQMXmA2WjO9r9YgRFryrJot6:bhgaXmxWj2rFWyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746363, "uuid": "9d224715-d376-4894-b6d6-d9cff73319eb", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746363, "uuid": "67ab4852-4a6f-4326-a710-b6037e2fa413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746363, "uuid": "bf7f1c30-33f3-475a-af7a-59c4525b6571", "value": "Purchase Order 205B.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7c7dcb-cc3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651731669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731669, "uuid": "9eb2f971-677b-4c86-a6de-e856fbd6a306", "comment": "Malware payload (AgentTesla)", "value": "9ffe01ce1274e4fd6ec5acdfbcc23d07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731669, "uuid": "5030516b-f8b2-48c2-89da-7056488a46cb", "comment": "Malware payload (AgentTesla)", "value": "5b285743304cac5d9ddf35a954d342538994caf81051bbf1f44ec2ad79e22566", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731669, "uuid": "97978e63-8632-402c-8ca1-efc33de9cd93", "comment": "Malware payload (AgentTesla)", "value": "3d013ae1a19adb7195be79da3912a195b4a022be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731669, "uuid": "a38bd992-2331-4298-9d88-7ffe405cfb49", "comment": "Malware payload (AgentTesla)", "value": "618aede8c74bab0affb17c7066e9e52f7021c381c6497fe126ace7e639472697ff88547570f4b04c323305bcea2a0300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731669, "uuid": "f43bed57-afa7-4015-a48b-d34acb977d06", "value": "T166C423EC0F373F801275EFB57D6C178F1862D60842D896E8B1644B4A0AB29256EDD1FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731669, "uuid": "a21a9f1f-6d27-45b6-b8dc-d98ef8f18b6b", "value": "12288:nXRjaEbPENtG7Q4g1wqk0LlhTKf5qX23dfEBZo:X4Est14YafbdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651731669, "uuid": "7ad34d17-b5ef-4a6c-b214-8d2c12ac7926", "value": 597143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651731669, "uuid": "e80ca353-6f62-4b52-8f7e-c475bdd66dab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731669, "uuid": "85ae7831-6b3d-4001-b8c1-2cbfe75703fe", "value": "SHIPPING ADVICE#202204.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d072eaef-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746813, "uuid": "5f7254f0-5f4b-4e52-83cc-d430482c9c79", "comment": "Malware payload (Formbook)", "value": "6918e243c51505d5769b394fbf8e29c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746813, "uuid": "65bfe150-7efa-409a-bdb6-4daa4d6456f3", "comment": "Malware payload (Formbook)", "value": "5bc5d93665bc0242f56ecf2f76c0d25bfb8d78536ad9ea4fea4e723500acf59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746813, "uuid": "0c72b5f6-002e-446e-91c2-d152b4d77821", "comment": "Malware payload (Formbook)", "value": "37623ba59abf882d5f776150581c39f0558366fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746813, "uuid": "866981cb-b55b-446a-91aa-c2c43eb47a29", "comment": "Malware payload (Formbook)", "value": "e89ab111f01902dbc6088f36e76d8f13fdd08e9b6dd5cce244ffde0b5587f4d65980e23ce610a719d7ca576a24733c09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746813, "uuid": "575fc1d8-4589-4971-8735-f7d0cdaafc74", "value": "T11842B21133988337D1A60BB29857D7E02335EE1A8956EF4F78C4771F6E3274186C2B29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746813, "uuid": "42bd500e-cfae-427d-ad40-83b0c1561b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746813, "uuid": "9925c0d1-2eae-4690-a2b8-34afca40439d", "value": "192:Mk2zx+ShKXjp3zyP2JaZz5dYzZ0aD7H4Fff6637mZ:jE3hkzyuI5dY91D7YFff6p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746813, "uuid": "06b28be4-2e19-450f-bc88-429150df11f6", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746813, "uuid": "dbfab502-43b7-4e52-88f7-bceec60caee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746813, "uuid": "00b3e005-c671-4229-9336-af3042ef8444", "value": "6918e243c51505d5769b394fbf8e29c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd84663-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651746351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746351, "uuid": "d27491e5-8fd1-4f20-b8ed-b55f00e4b3ba", "comment": "Malware payload (AgentTesla)", "value": "dbcaac203606f2e0bcc66eb0a66c71cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746351, "uuid": "507eb5a3-7997-42e7-b015-b7418f19b369", "comment": "Malware payload (AgentTesla)", "value": "5c7211ec561a3b9c0995a8acdba86454fd0ce0a0a4e887624daab74f83a98d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746351, "uuid": "65bb2767-6185-4359-aa73-7161958ce162", "comment": "Malware payload (AgentTesla)", "value": "156f714e3f8931b3c0b7734864e348f8a8604537", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746351, "uuid": "24fa39db-42bd-48df-9103-bc5c6099afa1", "comment": "Malware payload (AgentTesla)", "value": "0948dbb8d97a18fec5955ba9b6c081bb22bb19df82e13dcd58283e560860ab01b2cceafc38d16747eece8cf1d10b771a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746351, "uuid": "1e43dafa-bad4-4ca5-9426-7c3c311104f1", "value": "T1EF442354BA5B0CC63E10396CDD4AC8B1A09E35F2BD7AB664053E601D7B6AC4CBE711CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746351, "uuid": "844c3113-7d81-4a85-befb-4b0b505e1d69", "value": "6144:QnawrlDG6V7UiGeouzs1hb7Qlpd7SdDAJYX2KEGTa8:qaylS9ZeoJ7b7OgeJYeGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746351, "uuid": "daf1555d-eee9-470f-9bab-6cdf0c2d106e", "value": 255393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746351, "uuid": "97d6befd-506a-452a-80dc-57d80a1e68e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746351, "uuid": "705fd51d-2c63-4d43-b9fd-d834b5dff34a", "value": "Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6855f739-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651729029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729029, "uuid": "173fb603-0e44-4989-8d52-c4bcfe67a295", "comment": "Malware payload (Loki)", "value": "f1b50084cd8c3c37b4d3cb0ab2ed3f09", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729029, "uuid": "29979b2e-0347-436d-b56c-d1ff1363cc5e", "comment": "Malware payload (Loki)", "value": "5ce535366b9fad9c65002efc3c80ba53cf36d9c0e611f651baf865183c3dbef4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729029, "uuid": "50775973-a933-49d9-a359-b0d9d71da3ff", "comment": "Malware payload (Loki)", "value": "c8d71db4787f077eb0d8d4efe1420a96a44c5edf", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729029, "uuid": "6e9d7b9c-f79b-44a4-a6a4-2fd2b8d82b2c", "comment": "Malware payload (Loki)", "value": "ebd4c2efe084eaa0466b222d2a7732a6f64203f1953e7f795b6700f22c7ed2120770bd2eac1471924e283e192eb710ea", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729029, "uuid": "d9eadb5f-932f-4f9d-86fe-7028c1e63a7b", "value": "T1D92412AFF2182A18DBA8EB345F16DE9C58DCDE6E6E86D49129A97341C734FF00053624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729029, "uuid": "e22c4552-21b2-4e45-9e0d-1b1a0c5e7dd0", "value": "3072:Uv6y/CFPcolkxJC1Jrd2uAHhiWRLmuVbEXoT/Dex8mYJOQNHsF/jBJHxt:o6ECuYkxJC7WHIvuV36bYWJRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729029, "uuid": "3625ed5a-96e8-40d9-baa4-240d9fbbcd2b", "value": 210648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729029, "uuid": "a1f3efbb-2321-40e5-9462-78536e4bb9da", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729029, "uuid": "48b98369-a716-4953-9961-b026ab4a4aca", "value": "BK2002IRT6572209.BK0K.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22eb1ba-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651727891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727891, "uuid": "fd2e1974-e4ca-4f75-89bc-2889a384afb6", "comment": "Malware payload (Formbook)", "value": "5d7eb39dcf8fb650cf9a5cb7f3c66f89", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727891, "uuid": "1fd18a40-71a5-4967-adc9-8cce330bc5a6", "comment": "Malware payload (Formbook)", "value": "5d81ecea3ddb68a54c0bfdf6a5da1061ce81f3abb559032bf4cf1c412423454d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727891, "uuid": "e8c56c63-48dd-4e40-8a58-26009e911432", "comment": "Malware payload (Formbook)", "value": "f73f4854f32b82851e6537758900541772c2181b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727891, "uuid": "7b7f81d4-979a-4a25-9d52-09d0743a363d", "comment": "Malware payload (Formbook)", "value": "e666ff5276b50070b9f06edaa63e6647dbed410fd7a5973499b062b44e8fcc69db5ccce18a4705220b7f3756ad0b2241", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727891, "uuid": "8117a348-b48e-4b49-8402-d12918f47e98", "value": "T1522412F0FFA9545EC5C2CFB9A07C989102508D156E8AD8A361DDB34CFD39EA245E0B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727891, "uuid": "470e8ffd-835d-4895-ac0c-71301d32aefd", "value": "3072:/ZSgc2JEHMcZveP55TdxV87WjPZFZNMHvtI9WaomUaJFp2lH7aVD2FtGlpQ5xQVW:8gvYGxBaWvQvubXpJFpY+pQygxUqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727891, "uuid": "9fe49e9a-a870-4e0f-99f6-5cb1b2e39b92", "value": 211736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727891, "uuid": "9edbcc9d-643c-40ce-a28b-09a5ac9ba591", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727891, "uuid": "ca5fbb3c-2133-44d2-af1f-5d7ef6949ae8", "value": "AWB_NO_9284730932.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abadd523-cc8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651766938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651766938, "uuid": "09eeb967-c303-4b40-8dbe-2a940482438c", "comment": "Malware payload (AgentTesla)", "value": "5b98dac5c88fcbc9ac159ed0775b6fc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651766938, "uuid": "5849f595-da8d-483b-b31d-0a9fb6f966eb", "comment": "Malware payload (AgentTesla)", "value": "5e7ddbadfcbf7eac4febe61c14dd54833881353b5cbf7b606b423cd38767803e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651766938, "uuid": "d07cd845-8a5d-4ab0-acca-239f809d6240", "comment": "Malware payload (AgentTesla)", "value": "f9d0d3767be6cc912b391be49c302f6e08d55a74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651766938, "uuid": "98ef3517-363c-439a-98ce-d4b07aa53baa", "comment": "Malware payload (AgentTesla)", "value": "8de4c5cc69f8da7b84da66eb46528aa0a49d7a2ddf1cbfdab4268e97625e598acb30b68fb5a8678ab1c12be7b46522ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651766938, "uuid": "860cd9cc-d68f-497a-8a0c-ceee474f90c9", "value": "T1AEB4DF102A6DAD01D876DE700893C1B583F79C8F7A62A13AA7E3BD7F7910745C263A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651766938, "uuid": "3388f283-44e7-4cc7-8822-b9e36e6ac008", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651766938, "uuid": "ae7827c2-14f6-427f-aef0-2c11323dc268", "value": "12288:Xth8uLCjeB7RbGZUJgmGLk8rEIFos7aebBMOMvmD/Bp1c:9hXWq9FzP6otvQdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651766938, "uuid": "4701c73f-32b6-42c1-a1cf-840fe593f15c", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651766938, "uuid": "072fba53-fc14-4091-827d-2e7979293afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651766938, "uuid": "68a36eac-f195-4e59-b926-fdd3fa3d1861", "value": "HBM-MBL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b8e218-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651733528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733528, "uuid": "17fc3c85-fb3a-4c61-956a-b8fcea6e476e", "comment": "Malware payload (Loki)", "value": "df71685b24e578db871e9db64ed91e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733528, "uuid": "a9fd975b-684c-4d2b-8c57-a2e60a695531", "comment": "Malware payload (Loki)", "value": "5ebb9c44e8b96061ec0abba53b990f0c5191f3d834e64a60c386eddf50d6dd97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733528, "uuid": "ebb0b530-2e22-41a9-bbab-9ec302091c35", "comment": "Malware payload (Loki)", "value": "09001c7167254fb33630858a07f6aa3db0f6b3f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733528, "uuid": "5291e1ac-f5c7-4b5c-9b28-484afad75054", "comment": "Malware payload (Loki)", "value": "3943e666e084dec90a4b1c7711d3af92638eb7f4ec2b166184e2925dd22fc6e3070c84ca1e57acaf440710b0f8d94510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733528, "uuid": "60bb0f8f-531c-473d-bb08-adfc753ed390", "value": "T1A6B4CF9D7261B6EFC867E4729E981DA8FB50787B931B4153A02306EDD94C88BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733528, "uuid": "da61f32c-efb4-4b06-8b8f-eb83ed08e63d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733528, "uuid": "445477bd-50f3-482d-95b6-23b8626e045c", "value": "12288:NCTCekyuAjAjY2L2IyuFrj8MFv+chsrE5aqFuPAXqXitzJ6+Al:y29rj8MFv+gspqFuPk1tlLAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733528, "uuid": "afd6a26d-812b-408e-b621-4ecc81ed97bf", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733528, "uuid": "f870fb38-c0ca-437c-ab89-c1401264f3a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733528, "uuid": "85cb2525-a2f5-4535-b9a2-be421fd2d73d", "value": "DHL3789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24add308-cc56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651743089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743089, "uuid": "39833fd7-7b72-4781-b3af-8bd5235fc844", "comment": "Malware payload (Formbook)", "value": "f94c7def849c492d2fffa491ed71e77d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743089, "uuid": "5001a51d-bdc3-4bf4-8e52-bf380ba78e3f", "comment": "Malware payload (Formbook)", "value": "60286309bbd404c1aa6cf3a5c0ae2b09a1882c7964517a9b9d2bc844f3afc510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743089, "uuid": "071fab0a-eab7-400b-b4e9-59ba0d5259d6", "comment": "Malware payload (Formbook)", "value": "c82dde66486f01ffd73f64e4ef5e1f2573535598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743089, "uuid": "1ddb6f67-bd8d-4ce3-9636-40605ebda891", "comment": "Malware payload (Formbook)", "value": "3dafe7ac0bb2c119e72cc597c902645b100dce31f3c4f17f40a1089a9e15a83fb75954726cc02a416d92b6c1a89a95ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743089, "uuid": "4832adf4-92a7-4abb-8a18-764a3f4bb82e", "value": "T1E61412165AA4C577E5F213328E3EABAA2EF3551016F0971F13109F4E7A73642C82FB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743089, "uuid": "7df558b7-9646-42f9-93d1-af9f232d8599", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743089, "uuid": "d7cfcb22-b513-4154-83cb-308c77e07aa1", "value": "6144:HNeZme6OrU0X9BtflTe+QmzF7aP0jjZoH:HNlexBtflK+QkPaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651743089, "uuid": "244f33d8-8404-47b4-9153-748a3473a0db", "value": 203848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651743089, "uuid": "631c5f25-d119-4f53-be81-0986408e6a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743089, "uuid": "c098c6cb-1277-4252-bfb6-a1a9f7a93e3e", "value": "swift copy$48,400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1bda20-cc31-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651727484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727484, "uuid": "01f966d4-8d95-4961-9af9-d8ee16a3d947", "comment": "Malware payload (AgentTesla)", "value": "8e6357f692c43bc5271db1cfb8de43df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727484, "uuid": "f07cb2b1-ac01-465d-bbb9-d05e7548fcf6", "comment": "Malware payload (AgentTesla)", "value": "605ade46e2008848c5d97ab59b76fa42ae845e3833545bf933b945ae6db9839f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727484, "uuid": "8969f6db-efb5-4d47-b7b1-970188d4e932", "comment": "Malware payload (AgentTesla)", "value": "eb541f88f4125b60678ebb277b8fb5c873bafea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727484, "uuid": "fed915f3-3323-4674-b77c-8dba863c1b44", "comment": "Malware payload (AgentTesla)", "value": "d756d0a2529b02e3b17219ded3c63103a893dcc03a0d177fc8e3479ed968f5b76e86f3707231bd101e7c7089ccf5edcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727484, "uuid": "b0681a06-4e22-4207-921b-0741fe5dccfc", "value": "T121E2B23736C4FEA3D9AC767334EA5A3E9972AF411151D23F8880794F48B7B002573699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727484, "uuid": "f7e97285-b53c-4052-b74a-3263f72881eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727484, "uuid": "49daf0f3-243e-4b66-b6f2-017bd3307c15", "value": "384:BCrffQKWsiXZZJoqNhf1egQVD7k14hPsC/u:BCQBHey7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727484, "uuid": "f59d0ba5-ff5e-429b-8a55-b38d648f00b9", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727484, "uuid": "de974748-77e0-49ad-8d63-a15132672a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727484, "uuid": "5bdb6e64-7e4e-4e6a-b977-956dac70b8ed", "value": "RT35126077.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dca4552-cc34-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651728663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728663, "uuid": "08a66d38-99e2-4de0-a61b-6549a286c417", "comment": "Malware payload (Stop)", "value": "09d857feb80f366d00891d4d7b207974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728663, "uuid": "14f911ac-61c7-4389-a061-45aeef2aa1b8", "comment": "Malware payload (Stop)", "value": "608df5c6fe1401d81c82da19ff4553895997678e5bd55edcdf71002f547f0c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728663, "uuid": "03925751-cdf4-4ab9-9f70-e68c7dd5a00e", "comment": "Malware payload (Stop)", "value": "b24ddf60cb661a7adb9b4911b27a219cf6e88da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728663, "uuid": "0da58827-7b13-457d-a563-5f1f6dd8c92d", "comment": "Malware payload (Stop)", "value": "a5a499f2e3de398f0fd5039003c86d426faaf6d5f18900058d0591f06f5e2bc39caa2d728de5bc98402033c9dc296813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728663, "uuid": "e6f96937-187c-4239-b5c5-fefd54a2afeb", "value": "T1DD0502007B90C034F5BB51F0997A83B9B52D7DA1AB2454CF62D52AEE5734AE0EC3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728663, "uuid": "02636870-907c-4c02-9464-5eb11f97f0b5", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728663, "uuid": "1e063028-ef56-4613-b7a9-bacae9a1db42", "value": "12288:UhVwRahnuxsXeXX7ENA2lxXUUACdr5FpGI+ZbpNNoW51Z0ocxzY53W7lgA:E4OuqXeHwly7QrvpC6uflKz+m71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728663, "uuid": "50de0988-9c59-44a9-b061-36698eb4b52e", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728663, "uuid": "dd20f57e-2475-41b2-abc6-2b05499540a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728663, "uuid": "290f643e-fb7c-4f31-8359-d09c738b1a97", "value": "09d857feb80f366d00891d4d7b207974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f1304e-ccb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651784184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784184, "uuid": "1f755da1-ecf8-43e2-8848-70e5a701d7eb", "comment": "Malware payload (RedLineStealer)", "value": "080ef507c59d74c5c3207b77d12f0cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784184, "uuid": "f2d73c75-2421-4013-8a07-6cb2ea24757f", "comment": "Malware payload (RedLineStealer)", "value": "6347eda7821b2807e969568f9125af76656c78f222ccf221efa4b8b2a23adf0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784184, "uuid": "0c3ea0ee-d85b-4486-b99d-b2a2f404a5b3", "comment": "Malware payload (RedLineStealer)", "value": "ba9c77bb04a358aa20b3fea9bae486cbeda10aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784184, "uuid": "a5739676-18b1-442d-a6a6-db994dd4ac3f", "comment": "Malware payload (RedLineStealer)", "value": "c530ff2d801a70230d40f1d388f32e761e219695c17b05e59a336431ac50652a67559dbc73e34aa70d9e4e38e2a76eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784184, "uuid": "5cec61fd-e2e7-4361-9c49-6a46096199ba", "value": "T12984C010BA90D039F1BB12F58979C3ACB93D7EE1AB2455CB62C466DE56386E0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784184, "uuid": "b6851824-c223-40b4-a3e2-ea3e310f4cf4", "value": "a916e8b0d7c2c6fa3f2d0e67400f5178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784184, "uuid": "2d55e526-8a49-4d63-a2e1-7649b2f4667b", "value": "6144:l8Q7URQjBGQc/+PfJc+QF/14C+NedZDTEsqx+Rz1w:lVtjBlK+PfJoF/e5edWs3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651784184, "uuid": "53532a2b-a31b-4e65-bbdf-1e0f6e97027c", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651784184, "uuid": "a98fd595-c335-425b-a20d-905a192186e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784184, "uuid": "fbc1a009-9e5b-488c-91c6-d4503144457f", "value": "080ef507c59d74c5c3207b77d12f0cf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935e474b-cc95-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651770333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770333, "uuid": "8186224e-de28-4cb2-a8ae-3285124d3d04", "comment": "Malware payload (TeamBot)", "value": "4a0e4dee1dc1e0156e03f94666cc8502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770333, "uuid": "b612b77a-1e62-4429-a1db-c16f21578d7e", "comment": "Malware payload (TeamBot)", "value": "6463efd4789c770d191c9598c78f0ae5e45a997bee9ebbbcfca3fbba880f0cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770333, "uuid": "5653bea2-4807-4059-99a3-dcd40060936a", "comment": "Malware payload (TeamBot)", "value": "3d4aa62c6481c703ca1b7f706aecd660ddad09cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770333, "uuid": "ea423e0d-b7d1-4992-803b-b258afd67d39", "comment": "Malware payload (TeamBot)", "value": "ccd7602a19d04a386e19198d40bfcf626821a4a81ce0edadcd33d57eabc4ec522bfa67b93713b0da1cbe228217659da5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770333, "uuid": "900bb333-bd86-4111-acb0-b2f35d58f549", "value": "T1E3448D10BB90C035F1B712F5897A83A9793E7DE16B3595CB62D42AEE56346E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770333, "uuid": "ef570840-3470-48cc-a1ea-10347cee876a", "value": "b7b553a94d11d69eb0b4828fda24cd7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770333, "uuid": "5fc91cf2-530e-4f1e-bc06-d854aecf365c", "value": "6144:dsvUf8PkN/4YVBoQ/ZIDnh4Ay6+WJqC+pfEvu:dg/MlFVBoQmS4qZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651770333, "uuid": "e2a8d754-9992-402a-9932-82d21afdbaa2", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651770333, "uuid": "a6c206fb-7684-4bf6-a881-c5a9fd42b88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770333, "uuid": "bd34c6f8-eee2-407d-9f02-0e4706f5206d", "value": "4a0e4dee1dc1e0156e03f94666cc8502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ed61f4-cc36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651729295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729295, "uuid": "796378a6-d816-4306-9cd6-1f789a7b82eb", "comment": "Malware payload (Formbook)", "value": "b1b14afb7d50abdbdf1906681a0467e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729295, "uuid": "ef62525e-8e92-4bfe-8e84-ddae8b4f407d", "comment": "Malware payload (Formbook)", "value": "647d9c95b3f1069289bf5b7fb2e7fadd319cc0f03d1a8cd1318914f40b9a576b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729295, "uuid": "235a1905-c730-42c3-8247-f90fb4d3c2d5", "comment": "Malware payload (Formbook)", "value": "fd5175344963d71831002ce51b7fb53717019c13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729295, "uuid": "368910cc-3d66-48fc-8b28-25c6814bcdf8", "comment": "Malware payload (Formbook)", "value": "4cceec1f69db5da166767f931c35adbb89c2c3a8e21c31f41e6ad97a9e6e8ef932563f4aef5d9ea75b7c90b6bd9f7be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729295, "uuid": "34557ad6-424e-47f3-8ff6-97196a8dea9e", "value": "T188B294B1E654033BF5760FB588935670BE2BEE506821972ADC4CBE150E36243B561E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729295, "uuid": "0ddc4dea-36c4-4174-8267-6d4d19b0b544", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729295, "uuid": "fe0f17c9-de89-4c59-9d75-503f8994f4e2", "value": "192:AUr2QMzH3Qz5vD0x4/9AF4Q9EHVnNtu6zVoURsFQfOk6Bcbit9QW57gz9mDoxrj:A1Qm3O5vD0xMcEH9NtuQOuGN7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729295, "uuid": "35ff5f70-8415-4671-93a9-32d6ed537c7c", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729295, "uuid": "e6adb2d9-944b-45d2-ab7f-12ab46c8c35f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729295, "uuid": "72d5f7ee-f155-4296-9ab9-21ae8cfb0836", "value": "Euro Payment 1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeae8015-cc15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651715403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715403, "uuid": "a5c9611d-bf03-4889-8be4-f418badcbe83", "comment": "Malware payload (Mirai)", "value": "4953f04b88a42e3a0267524a1deba947", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715403, "uuid": "5e62623f-2e52-4876-8a1d-799c760a3b1d", "comment": "Malware payload (Mirai)", "value": "64c9269468521db797f203c06b37660af64d388b887334998fb118d229ba8733", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715403, "uuid": "8b5c3e53-58e1-4a61-b2c5-bfd4356f331e", "comment": "Malware payload (Mirai)", "value": "6988f712bb1be36882341ae46bf4b2a28ffaed23", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715403, "uuid": "8b13db8c-46a3-471d-8544-90a2f153c9f9", "comment": "Malware payload (Mirai)", "value": "5859acbb7a7a3a9882b11def66550d54382bffde56ed6ca640429f6ac82a2cd927886e5936c90f18ff46f1dc49289ca8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715403, "uuid": "aa94295d-ab43-45d3-9587-7eabc6d797fc", "value": "T154430117A3075D3294A36A3EAA9984823ECE4A1659E32CF31E781DDC52F6F41027F4D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715403, "uuid": "2766f549-8647-4e29-9515-b7b94cb0181b", "value": "1536:U2GeUQmpH3/KOFcrdMkjP39iLiLhjPUFiNWziV01:U2Gt59/lOpj9iLiLdjU20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651715403, "uuid": "fae500f8-e9a9-4450-8091-96b3725f29c5", "value": 59760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651715403, "uuid": "95eb1afd-8132-4ee6-bd39-ae442263221d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715403, "uuid": "dbdbd3af-320c-44e8-8ce2-284d7b397ec6", "value": "arm7-20220505-0150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8ee212-cc61-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651747985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747985, "uuid": "bdab83b8-6fcc-4e6c-b320-ae5dd5570aed", "comment": "Malware payload (AgentTesla)", "value": "904964c9db420ede7fb4a90a6df35889", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747985, "uuid": "4e446684-8d82-41cd-ae08-eb4aace3d376", "comment": "Malware payload (AgentTesla)", "value": "652ddd172fb711c5217488b449dca1fb2b1b5e9f254828e9c099043f30669315", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747985, "uuid": "171b34e1-12f3-4761-9cf3-f619666c5243", "comment": "Malware payload (AgentTesla)", "value": "4db15d740e6aba2e2852f72525326d59c6d05f9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747985, "uuid": "1190855c-efec-4fb5-a5ad-6d8e1d8cffd0", "comment": "Malware payload (AgentTesla)", "value": "41e1f7c32cac7a2bbe0300cc5fe616b24b41171d9c96c0188eee3017aa4ebebe7ad622d2277ca87513c9142607d1d2e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747985, "uuid": "e3b5f741-4bee-4dc0-aa8f-f0313675bcd5", "value": "T15AD4D09D726072EFC467E4729AA81CB4FA91797B971B1213A02712EDDE4D487CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747985, "uuid": "015927c9-1797-49e3-9351-e05c1cd61f49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747985, "uuid": "0eedff85-5a9f-4877-b9ba-030c5f26100b", "value": "12288:FDGlG02zRuWIGA8Sa/U2L2Iarvwa/KL9jSt6Aa5y3IuqyjGZAUjB28HyPAdT4B8A:Rkx2WwJSt6Aa5y3IvyjG6Um6zuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651747985, "uuid": "68e599e9-0ead-4a58-b6e1-04f79b7eb784", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651747985, "uuid": "ce6562d8-222b-435c-9711-981b8ccae917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747985, "uuid": "3c2951dd-381b-42d4-a10f-1d8676a455dc", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16657.7830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdefe9c-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733037, "uuid": "4c5998d7-0478-42f7-a1e5-016cd2f5f46d", "comment": "Malware payload (Mirai)", "value": "eadb3fac05a4131addbf53b97390d4c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733037, "uuid": "88f11855-bc12-46ab-8c6f-95cc28030bb3", "comment": "Malware payload (Mirai)", "value": "65b6837cbf4caa45a2e1df49285c2f30b2ec257bfbc2fff04788eebf4532575c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733037, "uuid": "7812b304-daf4-44cf-8135-8497aabb08fc", "comment": "Malware payload (Mirai)", "value": "dab2b175a2f48d1d7315140810b79348efa750e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733037, "uuid": "99dc6cdd-b2da-4159-9d4e-c46334199f34", "comment": "Malware payload (Mirai)", "value": "0c8177aaa3537b00a58dc08a156b200ce0f502d0a5893eff0729cf258e7171cf7a84ffa9d9c6dbafda5e8a7e77b4de1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733037, "uuid": "54acd085-5b27-4b28-b8e8-6547016f0a0e", "value": "T1CE92D0327686DD7093A04838E976C35675470B7CA9BE34315AB206BCE6C34109BF59D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733037, "uuid": "c4df9d26-e170-46fb-a87a-77686a96b37b", "value": "384:M8EaiKaZZK2f7o0yx1NuNSgANs9639l54DNVewqhymdGUop5hD:MaiLC2s0yxXuz97/ebs3Uozh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733037, "uuid": "84530ed3-a761-4881-b040-3f6ae84f4cc7", "value": 20608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733037, "uuid": "2e0f8aa7-e1c7-43d9-a5ac-380468bc2e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733037, "uuid": "94e23503-65a6-46f4-87e5-479e11813141", "value": "eadb3fac05a4131addbf53b97390d4c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7b1e60-cc15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651715405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715405, "uuid": "16f0a6fa-f366-41b2-86a4-5b0b63f3c5a9", "comment": "Malware payload (Mirai)", "value": "84a2a9b9ecf7406e7bfbffea6abd6efc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715405, "uuid": "b7f534cc-d5c7-4f16-8346-828ce679b94d", "comment": "Malware payload (Mirai)", "value": "668c63ff4ae7074cd81d19b9dacb14ac4e0d83f1f516cad53d139e82bed4e945", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715405, "uuid": "3ffaf444-0b1c-4a4f-98f9-582a693adf2e", "comment": "Malware payload (Mirai)", "value": "e9f901fc983013ae2f8f439bbeca28680520d463", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715405, "uuid": "8fcc21c7-2cb2-41d7-95a9-d6da21f0fdea", "comment": "Malware payload (Mirai)", "value": "df5f9e9a0cc0e7526ec6a4f4b69ed9f79ac9ee0d7d4c49f7eb1d5ecb86bc1161ed59e4d210e9fdbeafa20c2cf79efd54", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715405, "uuid": "73571085-5d70-4731-ac13-95435f04342c", "value": "T1DAA2D0F37144833FCC26A23A031C85BEB0FF900093ADEB451ED95696B2D72DE8A0D618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715405, "uuid": "e7ae2336-1190-4c0c-a9e9-2a5326a84a43", "value": "384:M1/ZeDCRXx6N3+k5vWHhhvOwKiwCUi8pUQ3wLXwI6/FuX3Wsax3qD8r+z4v1RK:QK+XAN3TvWHhpgiwCUWQgUIqQXHaBqDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651715405, "uuid": "071529e9-c85a-46c8-ab62-cb3f134d8787", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651715405, "uuid": "92ed9c3b-29d1-48db-a8a3-b362bb0e7c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715405, "uuid": "74f31276-8f63-4bb6-a04d-172b939ffd37", "value": "x86-20220505-0150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fb55d5-cc12-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651714077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714077, "uuid": "42e1c8b4-795c-49c7-a20d-d88748dfaa65", "comment": "Malware payload", "value": "5b88915f3a7e3abf57e14f87916f2597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714077, "uuid": "dd1816e6-c83e-4349-83ce-85e7d6fb6961", "comment": "Malware payload", "value": "66c53ec18e7103077d68a02ff90cb60b0b4947f6b68553575b987970959da26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714077, "uuid": "20410829-f694-422f-be04-e36a84357852", "comment": "Malware payload", "value": "44ccc137d88c9e7f86b024e7f00fa1b347061a1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714077, "uuid": "70b9d9e5-e898-44ca-be07-b964adb0dad5", "comment": "Malware payload", "value": "74b28f51f32596f6f5d498ac395d4727b128c0ed71a4b6713a246b527dba6712ae1bfb5a9d6785f3610ebf86e0b2d56e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714077, "uuid": "dd186cda-7f64-4a01-b2c6-5df3c1104e63", "value": "T17495AEE38B41414FE5636439C01EAA6D30711731678FBCA3B7889AE9E72B3C0556DB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714077, "uuid": "bf54a999-6be0-421a-8f5e-7c74ffe27dce", "value": "6db5fd36871bf7ca78879be44b315cea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714077, "uuid": "b25c73fc-bbf6-49e8-956a-541f0b694f79", "value": "49152:g/x/jLnwxeoVT5G5uRWqozE+SMY93gAqe1nsiszTkwhjl:Ax/jLnwxeoVT5G5uoqodSMagXinDGTkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651714077, "uuid": "7423301a-a496-4c38-af98-6fc0690037e4", "value": 1984856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651714077, "uuid": "c0bdd0b9-48eb-4f15-a40c-bc75f4f2ffea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714077, "uuid": "6452d474-dc5c-451e-ab1b-9f79069ff689", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae68dcc-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746374, "uuid": "3feee2e3-cc5c-4574-8b82-d96ebfac79a7", "comment": "Malware payload", "value": "ee7d3acaf93e02e0f6b431decbb34457", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746374, "uuid": "9ea1a0a3-1663-4444-b79f-56b16e307b5c", "comment": "Malware payload", "value": "6710319e01c2bf476ca123cd0893c779385705f1d05218699608168fd6655d94", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746374, "uuid": "659d3526-e1ec-43b9-993b-7929dfde8428", "comment": "Malware payload", "value": "e750311bfd44b6fb8b5f3121434877b4235ae9ab", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746374, "uuid": "fda204f8-7e64-4bb4-8e45-9ca27112dd85", "comment": "Malware payload", "value": "6034b8358389f0750608b515f15fcaecb32019fd042ea49a01edf6640f3667b5de54deaf29469fd782e43a6896e5b99a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746374, "uuid": "b81cd20f-5041-4a11-87c8-4b8002b63822", "value": "T17634752BC2826D7804901878F4159973C69FCB558DF89B96E2E79863A3CBE01FD51CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746374, "uuid": "bebb54fc-c11b-4f3b-a341-42aa246bca67", "value": "3072:L2HAzHt3WEsL36dRU28/9cbP8XmoaadshqMg:Lz3sT120IPJoIhqMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746374, "uuid": "345f076d-537e-4283-a22b-3fa3c7c975f0", "value": 250686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746374, "uuid": "1a8a4c56-631b-4ea3-b09e-6ff86cd7fce4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746374, "uuid": "9cd51a9e-a63b-472c-adea-4a27c7d63bf6", "value": "Purchase Order Copy No 2422020 CDFD- Reg..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30119583-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746115, "uuid": "d08a2e67-b090-46c9-b304-a1077fb66bca", "comment": "Malware payload (Formbook)", "value": "3e9075d4694cead5b35b9533e50c7078", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746115, "uuid": "292f1aeb-e5ef-44fa-83cf-92923d92645d", "comment": "Malware payload (Formbook)", "value": "677472a14a286dcf5eb03f6ecd2c4b5f54e44ab016871688b6eddd5996e2cfc6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746115, "uuid": "0b32e3d5-0acd-4bef-b39b-bf4bfed9e1d9", "comment": "Malware payload (Formbook)", "value": "38098779d9add42ddc840105b427bab92398d028", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746115, "uuid": "7830872f-126c-4635-9c64-d050f78e3f18", "comment": "Malware payload (Formbook)", "value": "a6f4b26b8bc502966226cf47a78407b991d1858d0262fdb56c824713f8960aaa9b6090b24b9a0027cc928c66399513ec", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746115, "uuid": "95f040f3-6573-4617-819c-165bc372b8d3", "value": "T16124121935DB7982F6F6F87108194162A2A8FF206DEDF44D3C743E2691BB882054E7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746115, "uuid": "713903f8-5eb2-4b2e-83d3-5a458d4fc5dc", "value": "6144:YhE9HVUfzBN1kqS1HqkeewjBMowRbok7q5yF:YhqUfonwLwNf7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746115, "uuid": "fbd1bee3-7dc8-41d5-b1ae-4be81f52bf83", "value": 211512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746115, "uuid": "75012c5d-dd58-4b3f-99c5-3224c6bf8a34", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746115, "uuid": "68a2efc5-d1bd-4473-9f28-09907ac991af", "value": "PO050522_Airhawk.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822232fd-cc73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Pony)", "timestamp": 1651755701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651755701, "uuid": "4b54891d-fd96-4ea3-a21f-21db6b4ff1c2", "comment": "Malware payload (Pony)", "value": "b3c3360d6e54c2426443f431ee9ce080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651755701, "uuid": "03ac66d9-4440-4b86-ac3c-66feb8f86b5c", "comment": "Malware payload (Pony)", "value": "68ae2aa17c2e13a2835d6ac134cdb7f1d9e4bb5bd41c0ca76cbffaed758adc29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651755701, "uuid": "ef1f1d71-cd1a-4474-9f28-1e5a3f1e0fa5", "comment": "Malware payload (Pony)", "value": "1cc0d296ae40d866da9cb9c3ac11c34f3e6dc82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651755701, "uuid": "005126c7-ff38-4efb-bd35-c458f736b43f", "comment": "Malware payload (Pony)", "value": "fed304da403a85567fa50789baae9a53f82d45dad7fe26c152a70134a041c88f102ae9173cb2f35f366a84bec336470c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651755701, "uuid": "ac7d8d0c-25d5-48dd-a139-346ac1149c65", "value": "T139930903B985F0F1D1A2267137C167A5F3F89E787D7A4D4AEF9C6445B9B2287AB02043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651755701, "uuid": "6ecb8ad5-4408-49d5-97d5-d0950aad57b4", "value": "d6cd9cecc12ba283fd2bf86a18ca964e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651755701, "uuid": "c7273485-bd6d-4e25-9db5-c609e024bdb9", "value": "1536:5PfWgJVQ7RgQm4qT3CT4vj/xE664AInRNA6OXc3TvYkzbh/Y:VOKQ7RgNj/C6tAP6OX8h/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651755701, "uuid": "8cdbb052-1bac-4ad9-a631-0651399ed5a6", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651755701, "uuid": "410a3dc1-cdae-4860-ae2d-1f643fc829b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651755701, "uuid": "dc2ff5f9-1e68-466a-8e91-f7987b7d3ad2", "value": "68AE2AA17C2E13A2835D6AC134CDB7F1D9E4BB5BD41C0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23590e2b-cc56-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1651743087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743087, "uuid": "75cab837-112a-4b02-b35b-6bb8f5ab52fe", "comment": "Malware payload (AZORult)", "value": "5f70716a8d651666f9cec77dd2b5350c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743087, "uuid": "44035e2f-dcc6-461d-ba23-230720fd720c", "comment": "Malware payload (AZORult)", "value": "6b448fb67632a98df81c0dd29d39e9229f27f5a49c6020ec82e5ffe06b4d04b8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743087, "uuid": "8d6e62b9-7875-4e34-82b8-f5feca7cd615", "comment": "Malware payload (AZORult)", "value": "ae505c3ab08ab0db1ab104740e5d0b9f10458cda", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651743087, "uuid": "a26076de-2c78-4dfb-9121-a9156f4accd3", "comment": "Malware payload (AZORult)", "value": "d84da3609edf1b7170e7e1073cd63cceb58c493ea77405fb5b1d676267064662ee3482a50335f74886e73b27265b0826", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743087, "uuid": "29cde6e0-4efa-46de-899f-670ac099e4d0", "value": "T1FFC41254A5778332E26823F9E27623C42BB13B7EB531E6C4BD9D05CF5552B0B1206BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743087, "uuid": "66333115-9f66-437c-89fd-70e95479a293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743087, "uuid": "dc59df44-6ea4-4b80-b3e9-48799f961fe2", "value": "12288:wpJC6AW5rvQzovCCgv4dvQY4tT2AUwumM0A97wt2L2I:SPNvQUvcQFs23mM0n2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651743087, "uuid": "686f14f4-2a4c-4898-93fa-0ea83d6082fd", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651743087, "uuid": "6cd43da4-dbe3-4e0b-a07f-9214364811f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651743087, "uuid": "e127903c-e409-46c5-9f05-66b3f1cb8a00", "value": "Hesap Hareketleri28042022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca6dae4-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651736150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736150, "uuid": "7fe80bea-a7a5-4332-a873-37feee7cf873", "comment": "Malware payload (RedLineStealer)", "value": "6c609f8fd73aa59dd20595590dceac7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736150, "uuid": "5b409489-03a3-4ab1-8540-26301567f38c", "comment": "Malware payload (RedLineStealer)", "value": "6b5a1aea006e192d2ba16ae3b4e653f31475f862abb11f93c3c3d91a91c24bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736150, "uuid": "72df18e5-8c43-460f-913d-dbef143014e9", "comment": "Malware payload (RedLineStealer)", "value": "24919a9fb87379affb1cfd4560ea2c9f8b56a148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736150, "uuid": "0bb5cbbb-d9a2-4f51-aac3-6cf6a45c5846", "comment": "Malware payload (RedLineStealer)", "value": "ffa40043bac90e7a2b7011acd43b2d776ece1408dd2b51f7b9c261f24b6720c3230c054e3337a9477cb0b1f4c9f8a260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736150, "uuid": "dd8fd771-668f-4b6e-88ef-35f654fa0390", "value": "T17F154B27183EDAC8F94CBDB994450B0029718CA500B7D1ABE95F3ED2E2B7517CA1E5F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736150, "uuid": "1f18af1b-40d7-4106-8ac4-0196badd8080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736150, "uuid": "942dd27b-716d-4b99-b2c5-2026b7fb16f5", "value": "24576:K8sqAokULpHPahhMpgj0EbJ0A6iqFyXG7NK:aZokUDALkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736150, "uuid": "8c85f098-be91-4728-a5d0-d9deb60275fd", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736150, "uuid": "ff7a55d6-ad30-4bd5-bac0-82291327e842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736150, "uuid": "1012461a-dfd3-4343-a69c-50536f9a4d86", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa79958-cc47-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651736764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736764, "uuid": "1e483465-2e39-4cfb-816b-d58030874622", "comment": "Malware payload", "value": "f55368f5a634a126b767e7224ecd5d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736764, "uuid": "52bfcf18-2ed1-424b-b9bc-8ba9cbbd5030", "comment": "Malware payload", "value": "6c4845488cfcbc669c7dbf44efc720759904e33cd8b411c6400ffa910a849aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736764, "uuid": "9abfbd5c-743c-4007-ab13-a20d180afea9", "comment": "Malware payload", "value": "fa94aa7b7303ed1a5058744295b0d5c68760d064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736764, "uuid": "ce6c31f7-8683-4c85-8c2b-7bf0b25818e3", "comment": "Malware payload", "value": "799bcf70dae9221cbe8d12cdb0f0344b3370746a24cc867cca3d41d1131b627ea8e854b96c7345664c8f21fbb02cb587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736764, "uuid": "e74e80a7-8043-47df-a5be-4110f2984a04", "value": "T1DE120800FBD0C635DDAF08B8D9F3522487B6A7D3A987CB4E5DC832595E137A203867A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736764, "uuid": "fa0da6c1-f7b3-424f-ac03-fac6d59f5e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736764, "uuid": "f206dc0e-427a-48ad-a7aa-2de592920f7a", "value": "96:z7esG/Dsg6rDwoOtzLNlGXd88OdMCv0y+mJql/EyOt2iLzvlHYIJ0RzNt:zqxDUrDwphNlGNMdlzrJmys4vdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736764, "uuid": "479b468a-0cf7-4e3e-ab9b-ad5a77245ae0", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736764, "uuid": "ab60fc6e-08cb-4b53-b953-f49a5c132ccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736764, "uuid": "387cf92f-e576-46bc-ac6c-34f53f63f6e1", "value": "f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d332718-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651745761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745761, "uuid": "65b25910-789d-44d4-a7b3-c2870f0d7a37", "comment": "Malware payload (SnakeKeylogger)", "value": "ea9246388f5df411b1f286461bd2124e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745761, "uuid": "69e48bb1-752d-46c2-93b9-4c0fd37d0445", "comment": "Malware payload (SnakeKeylogger)", "value": "6cc8dd224e3ad7eb507e0843d957e6dc5340c827168cc93d0a3d59d3d5920f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745761, "uuid": "27538525-67c1-4871-bb72-0e7de67101e0", "comment": "Malware payload (SnakeKeylogger)", "value": "42e629abfed7c2327a7294139de923699d10c3df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745761, "uuid": "488733e5-ce5d-49df-914d-cf3aaf452eda", "comment": "Malware payload (SnakeKeylogger)", "value": "1438a4c1ad69ab8aeb171a5851834ce54b5c6bcc7da7983b1b9b846812856bb497f3797a9ce1c47ababad93c60a38b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745761, "uuid": "182d5cc3-5bd6-48e5-bff8-0fb436eb2c99", "value": "T117D408AC365C31DEC867C972CAA41C64EA6174BF7B1B92079023159DAE1DB97DF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745761, "uuid": "16c91ab9-300f-40f8-a0db-2285763e62a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745761, "uuid": "ea658c58-cef0-41ec-b797-3386787b5e9a", "value": "12288:fvcwsp/G1sgpeDKtjJzEtdKl2iNnc1XWdT/3nbOpjSkug6CD6PCZe0WsWFSRKFB:MwspPQe2jhEfKl1Rc1WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745761, "uuid": "d3af88e1-f0ca-46b0-bf5e-7d59b7dd8b56", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745761, "uuid": "b0e3b643-7b1a-48ab-8751-682a1430e7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745761, "uuid": "258c28ff-057b-4ae5-b290-5d51869c3099", "value": "SHIPMENT DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7029220-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746368, "uuid": "2c0dc6a0-3cdc-4a67-8751-8f582b5209db", "comment": "Malware payload", "value": "eda5439daa832513880e0e488c7508bf", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746368, "uuid": "416c4162-18ca-49b8-bb1d-3f7d5bd99c96", "comment": "Malware payload", "value": "6da9bdb6a101b1fd955ec01a1e74f9f4a6ef75646ab2c19ef6e6ce26594fafb0", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746368, "uuid": "4273f892-67e2-4fa6-86c4-8b0bc84249a1", "comment": "Malware payload", "value": "3006a80f970107f72b3d300a564e2b0ee7f7c43a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746368, "uuid": "c6de0a73-2c0e-4247-adc1-aa866acd0f68", "comment": "Malware payload", "value": "79bded4b018cbfb148138fa9be38c6aa55651f57a1ca782c39cd33cdcd34d70902bffb16c3aa2bf6f69e18731709b4da", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746368, "uuid": "e301831a-b687-411a-ae6f-4f87da056cf1", "value": "T1EE32F949FA5088FAD32D4178C4635E4BA079B211E7A263CF737C456A2F927863728788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746368, "uuid": "13050eca-9e59-44f4-9a2e-a00bef4bacbf", "value": "d2def47d2a92d4173aea3c245c5c4bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746368, "uuid": "fe6cdb01-3a91-45a9-bb2a-4df2bd22967e", "value": "96:SY2pNnF557AN59lpepeiI8a/nXDFpJW+tsPb6zjB1YfWPNNYlS1VAdsDJkD4uANO:Sz57g7pIeiba/DBokF1YwYQA6DUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746368, "uuid": "764704ae-ede6-4481-9a11-5d23921cad56", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746368, "uuid": "a091d992-d23c-425b-b6e8-f5d6b3f6e4d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746368, "uuid": "48408e04-48cd-42da-9056-0043d3f5c0e0", "value": "Swift-RVSC2107519.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978582d7-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651735980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735980, "uuid": "bf4888d2-eba2-40b8-957a-e4c80a815dca", "comment": "Malware payload", "value": "2fde6b4f095b4d2051ff187ed7908bef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735980, "uuid": "99d791ff-03bc-411e-b46f-1bdc6ad1d56c", "comment": "Malware payload", "value": "6e5a705271b3d5f53476410d8667d8a8b254595ea387737125f0af049596a2b8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735980, "uuid": "629a7587-f81a-4a50-8e43-048e62562135", "comment": "Malware payload", "value": "c28916c12d75ca9d22887d93a67eb4e0802ac506", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735980, "uuid": "416af33f-8ed1-408a-a980-955f02de58c6", "comment": "Malware payload", "value": "b9e3c0aa6a618c2499f6964a4dc07fcc0842b794d3f03d103ea85bf574ed35360be5ca841aebf64fdbab028734e1c741", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735980, "uuid": "7d1ca8d5-4db2-462d-9339-aeebdb543e53", "value": "T103752983BB52AB62C3092737C0DB052843A2D6526213FE0BB5DA13254D8B7FD5A4FD1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735980, "uuid": "ee0082d2-e21c-4b73-83a6-6e836a7bc4cb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735980, "uuid": "3eeef43f-5ce6-4233-94ce-ef3370c8edd2", "value": "24576:9zUGpPabiv6/mcJMETBOLIPlLCd1sqSNvdNXww:9LgqXcJnZNG1sqKVZww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651735980, "uuid": "3ff2c5af-ce9e-4174-a8c5-21248846fb08", "value": 1605631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651735980, "uuid": "e6338cdb-03b6-44c7-8446-9a38889e5fba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735980, "uuid": "6dbc881d-87b6-4b9a-84a9-f060fc9d237a", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49465a35-cc2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651725541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725541, "uuid": "ac4da49c-5fd5-40b4-b647-e87e3be9602c", "comment": "Malware payload (Mirai)", "value": "4b65a0503df775edebfd158a75e30c15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725541, "uuid": "10462a7c-1f46-480d-a069-603eca56835d", "comment": "Malware payload (Mirai)", "value": "6ee7368ccd9816992e3ddc5b792ed37968456c6aeaf9e2949e1fe581b00a9fd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725541, "uuid": "151e2a70-0618-492b-bcfa-e84831c717f4", "comment": "Malware payload (Mirai)", "value": "39013f0965c0cdf31381112122c96989f52ad8fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725541, "uuid": "aa5fd564-99cb-4280-b453-f76787a1e13e", "comment": "Malware payload (Mirai)", "value": "b6442517ae5c7b2e70d201eb0e35936ef5fd20cfc7932d69169e2f728015be24ed642f3ea30f46fc46d7ab67c1d9ac0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725541, "uuid": "83a8456e-be66-457a-8e3b-4545a1adbd3d", "value": "T1D8835C25697D2F26C1C4B03F22FB8754B2E1260E26B49A9D7DB60F4FFF2064064472B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725541, "uuid": "2b40a2ce-c672-4853-a054-23cd82bc359c", "value": "1536:xS/6lFqSMSUnIdWOa2DRsjRPABfefcwSjwHAmy6vnxXchmPBgk+nF85:Pp9AjyWfcSA+vnJchmS5C5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651725541, "uuid": "13113576-ed46-4c57-9469-f6343335e771", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651725541, "uuid": "23b75663-87ee-4aff-88f3-2f4ea9be43fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725541, "uuid": "478ad528-608f-4561-bbac-d891454271f0", "value": "4b65a0503df775edebfd158a75e30c15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20554777-cc7d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651759832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759832, "uuid": "e421fb3f-097a-497a-a80d-e015f163e7eb", "comment": "Malware payload", "value": "7e44d94813b6100ca296aa91d321020c", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759832, "uuid": "c3b341cd-be6c-4cff-a5c2-5c18709b7d8e", "comment": "Malware payload", "value": "6fc54151607a82d5f4fae661ef0b7b0767d325f5935ed6139f8932bc27309202", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759832, "uuid": "28d4a763-d6a3-4f08-b688-cc16b5d3ad41", "comment": "Malware payload", "value": "9ef9a6ba386a2728b6f2ddb78e18c517a597a3cd", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759832, "uuid": "8086216b-0bea-428a-9e0f-cc1711b93ceb", "comment": "Malware payload", "value": "98097900f40200e4df7617e268c915e256c1692ec4e5371e555e89ab66fa2b84b72119aedcffd030766041819fcd3a35", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759832, "uuid": "418306c3-eb4d-44c0-b5c9-f326141bf876", "value": "T17BD37D17B2A90CBFD0728639C9235916E7B278150A709BAF036446561F27390AEFFF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759832, "uuid": "e8e2bbcc-33a2-4e13-88dc-f64a4bf384be", "value": "b4a3f218dbd33872d0fd88a2ff95be76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759832, "uuid": "99e95d32-ab15-4ca6-bb0b-a3d63ee30e4a", "value": "3072:JyI0C6Og9CaD7VR2X+sbzXqbxcBd8j1AgbXPaUOmpSiaedwyD5viMbijx5:JyI0C6Og9CaD7VR2X+sbzXux48j1Agbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759832, "uuid": "fe58aa41-eff8-4353-bfb4-5f62ac65d5b9", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759832, "uuid": "793714b4-ec77-488d-ab0f-808a441163b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759832, "uuid": "57490eab-93bb-4e56-9442-d1c3e72efe23", "value": "ACROSUP.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d923bd-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651730374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730374, "uuid": "d4766d64-4c0b-4d76-bd5d-1d646f0cf3db", "comment": "Malware payload (AgentTesla)", "value": "aa03dd2a195b22ffaee5f959590d0a06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730374, "uuid": "aed49d91-2b90-4e71-9d39-06e98748cba6", "comment": "Malware payload (AgentTesla)", "value": "7043e2ae38720d05ce8ae960628394b4d87c66e1d3c5e850c23cacbbf709b080", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730374, "uuid": "3db27ed2-057a-4fbf-a109-25b2499114d9", "comment": "Malware payload (AgentTesla)", "value": "467067f8f5671b08e6feeb98c0e086f635fc9f05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730374, "uuid": "900ff4f7-a46e-4b40-9297-7a0e0fb606ad", "comment": "Malware payload (AgentTesla)", "value": "b90678072793ace36729800bc7427eb026af56c76de5d30d1a1db1efad8e493ccccd5cef1cfb34d07cd05e9b8adb15eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730374, "uuid": "845b558e-dae0-4389-94b1-0efad290a03d", "value": "T1DEA423BFB4F8C61EE471F690AA8E5D07C129326F20913275E7C46F3F06781B825B85A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730374, "uuid": "4ad57715-3f2e-498c-ab9f-bbe999edfe77", "value": "12288:mieoVzXLZZhOL0UBfRbB90aVbSAJMjZrNa2iRxT/h15ugv:bZ7OrRbB9vSAJM9rw1N15zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730374, "uuid": "b5ba0b9e-881d-4f41-aff1-96e9aa76c1f1", "value": 473222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730374, "uuid": "d55a05d8-4e0f-43f5-899f-df0a39790f00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730374, "uuid": "252ac17e-c430-482f-ae04-f5c7f91ffd8e", "value": "PO 345678..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f63bef-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651733985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733985, "uuid": "16d1b75f-91ee-4665-b01f-35005ab92257", "comment": "Malware payload (Loki)", "value": "175b66fff2f5329fb4d20c85871e11cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733985, "uuid": "a3927eff-df08-40b9-ac71-255dca0adcb3", "comment": "Malware payload (Loki)", "value": "70843726bed5aab6c7d046ed467453471bde9209ba1942e72fbe8bfa4e3b851b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733985, "uuid": "22c7380a-6269-4aa1-a7d1-b959daabc3c2", "comment": "Malware payload (Loki)", "value": "fa69af19aceede6a9fb280521a6768a1de86cb04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733985, "uuid": "af3c4f55-42e6-4c42-b59d-7e3e988f34c4", "comment": "Malware payload (Loki)", "value": "2bcff523fc57663fa7a55eda8fe3cda40541b13f78c5ba55bd8ee0fb80036921d88850b64ca5d1740859ade07bdb9952", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733985, "uuid": "21128317-ce52-40b8-8291-7431c2920d96", "value": "T145C3F2586B11C4A7E4E242313D399AB32BFB85212811075B53A46FEE7933F42DB0E75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733985, "uuid": "1ed2ecb5-4b91-4dbd-8d1a-e22268ef5f89", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733985, "uuid": "d44ac278-3c0d-45b7-98c1-198f9eef2661", "value": "3072:l1NjcVVnLpPunbQL/KDgyPwtr+82YF/RdJSWD+3hgLX:HNeZmQLAYgspV+xgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733985, "uuid": "fcf23fff-962e-41a0-8f92-e90eeb68ed0f", "value": 127463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733985, "uuid": "387c4ed4-009c-40b2-a596-466a9917ca29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733985, "uuid": "ce26aa52-c75d-47b1-a55c-2ad546e984fd", "value": "175b66fff2f5329fb4d20c85871e11cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f4243e-cc4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651739687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739687, "uuid": "ff76a70f-91e7-45ae-9804-33dd79dffee2", "comment": "Malware payload (Quakbot)", "value": "7f1e12ad2f10484ebf04d11278dbe50f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739687, "uuid": "f2331c37-d0db-478c-a4d6-52d685a33a4e", "comment": "Malware payload (Quakbot)", "value": "70853bbc9fa08169e96c929332ef983877bdc0967efa855176904e03ee9f5921", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739687, "uuid": "d94a682b-2efe-420e-86b3-cf96fd96038d", "comment": "Malware payload (Quakbot)", "value": "3ca5f5e55618914a8910d4fb0c9e2378b1076842", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651739687, "uuid": "130a0db9-13b5-43ca-ad84-0789a5e6087f", "comment": "Malware payload (Quakbot)", "value": "64bbe8993bbddbb732ca706010717b48ee5e88d3bc536909068be4806b7d4d81aa4b1e5c0525e5e543264bd593cfdf46", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739687, "uuid": "6e069187-05f1-43a3-9bcd-8ffc792e612b", "value": "T1D445121380447436D4E9563C21014662222B74EFE479BFD88FDA25FA3B6E0F9DE6D98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739687, "uuid": "0241382e-e159-48de-a19a-49271514229b", "value": "24576:0iG0mdDHVf9N/raMnxMXV0MriSo+fTA50MriSo+fTAb0MriSo+fTAA0MriSo+fTB:0iGbbVfnaNS+f0S+fES+fxS+fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651739687, "uuid": "6b1c11db-98f1-4e3b-a0ac-fa71af8f8f67", "value": 1249919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651739687, "uuid": "29381fe2-c449-4173-9a48-b40abba2548a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651739687, "uuid": "14b7eb93-6cbd-48ed-9d31-22944fec7d8e", "value": "c_3245235532.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd809478-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746379, "uuid": "abe19af7-2765-483f-adfb-6a518dd28cc7", "comment": "Malware payload", "value": "2ca10537f9bd8ea6d66182c731260ffc", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746379, "uuid": "6f799ae4-3fa4-4e63-910f-4ff4a2e175ce", "comment": "Malware payload", "value": "72e54878f1c063c5d48e40734f1fe23a3a19d965bf4205c3b45a7762ff68eaff", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746379, "uuid": "60f5da23-c76b-4615-872e-71a55ac5ab89", "comment": "Malware payload", "value": "9c39a51ed7257087804bc3fbe79cb0b777fd1896", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746379, "uuid": "6a4d89e9-9de3-406c-847d-b65b26499da0", "comment": "Malware payload", "value": "0c8934094987dabfc7f2b1cdf3e296f97d50acba1786925105260fcc897f9c929d1429b60ee6a9bbff18a21771f7d473", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746379, "uuid": "afb3b878-b95a-4fe9-90f6-6b8dbcf57c18", "value": "T10A45F127E3D7FA70E6AE56BAC6B5DA68176EB4A24175B74DB6404CCD39203438830F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746379, "uuid": "3b824165-e066-46d3-858d-cefc381dc216", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746379, "uuid": "9ceaac31-eeea-4d23-a5f7-aef4cca3d5ba", "value": "12288:hnnnZq3Z2muWdP8bzbBSreGEA3FgGddfAXXRZbAeb40KR+OuLBjMa0q/PeGAPUX7:hnnnZqpdRKX1DA6qg1fN/0q0QLiNo8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746379, "uuid": "8fa84160-13a3-46d1-9d8e-3f9c91a53855", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746379, "uuid": "d40089c6-c6c2-4ef8-9cdf-4170fa18f767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746379, "uuid": "f69f2e90-4cd1-47f7-99b3-de5f91193aa3", "value": "202205.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a18ce4d-cc43-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651735072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735072, "uuid": "d8a4ebc2-8438-4613-b3bd-72ed63622a74", "comment": "Malware payload (AveMariaRAT)", "value": "0c8c06423d9e0b429bf236a40ab0aad0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735072, "uuid": "48b5796d-a613-4911-a482-654ccdb1ccb1", "comment": "Malware payload (AveMariaRAT)", "value": "73b59429ed22a0f7ae52b702a6c62cd222f2e37ea459032dc8ec1f7ab9459038", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735072, "uuid": "376cc3df-d945-4dc9-95ed-3bf376ec5068", "comment": "Malware payload (AveMariaRAT)", "value": "7f3f8e71ee846e2fe0ca728c1e545053c48807c3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651735072, "uuid": "762989d7-7f8e-49c7-ba83-a2dad4f8a5c6", "comment": "Malware payload (AveMariaRAT)", "value": "a21e5d7a31b17fe240557017c62e1d91884c2ec4f70db02e56ff4d9c015c0e2b28d9b8e6fd73dd6f0fa1c1afb1202e30", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735072, "uuid": "55889543-08f2-476d-bb42-42231b80ebfd", "value": "T164B4021A3FA5DB02C59853B6C0D7187407F2AB4B2373CB4B3E8926D60E017E69EC9795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735072, "uuid": "62de43b5-f665-405c-aaff-169b5780f267", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735072, "uuid": "f474da9f-4aad-4d76-93bf-6617e44d363f", "value": "12288:ydpdU9TTP+C6PHjuqFAFJ4ODSu2CXfRMlui+nDXuBf2bESzTJ:Yq7+jfjLeJ4ODSX0+L+iBf2vzTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651735072, "uuid": "9d4b8f17-a02b-4ac1-894d-8ceede09a152", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651735072, "uuid": "ba0a473c-09c0-4602-ab5d-c270a19d18d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651735072, "uuid": "d445605b-d686-4a20-a248-8f8f544d7e79", "value": "PRO-AWMCP6022-ESN.img.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0213fe5-cca9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651779079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779079, "uuid": "281dfce0-d4c4-4526-a5ea-bc31b9a900b6", "comment": "Malware payload (Loki)", "value": "f392bdb5bc6f991bf94038de199e39e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779079, "uuid": "c4099f4f-8e17-47f8-8879-9162dfc2fe4f", "comment": "Malware payload (Loki)", "value": "73b761d7f9970112c74d0622142444f7496d6c3b697667b3efb16883876cd31c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779079, "uuid": "8afda6b5-a8e3-43c8-be41-775e5e6ce88c", "comment": "Malware payload (Loki)", "value": "c433a1d87899038f420eb366948236b8f892f1aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779079, "uuid": "fb98cba2-1ebb-4b08-b88e-bf0901a639f0", "comment": "Malware payload (Loki)", "value": "073ea790f3f8f65a04e1f9f72d2d5b480533120ad93d2d677978cf8a02be0c2b1db707ebe22ecde4659d9e7f17e86207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779079, "uuid": "815094a5-3297-4f6d-a5aa-8ab2ad38cca8", "value": "T17AF4E1727741ED62C1775630E26387B4F1E3BE6B54F6828FA209BB1D69B01C60206FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779079, "uuid": "247b36e2-d731-4f14-bde5-2f1e1a0b57c1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779079, "uuid": "c2f4f60c-85d5-46b9-b5a3-1322981e4f5f", "value": "12288:lYpEvp21QgHjydOYb5/whsFou4tRuqevZNOGS1evyYe7YvaU:lY2pcQcydVgHu4+vzO3ayYe7YvaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651779079, "uuid": "235ffdf1-ddd9-4907-994d-14247a9c7d6b", "value": 774736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651779079, "uuid": "6ac99a35-fb27-43be-a956-37fea925cc39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779079, "uuid": "1ca5ce4c-45aa-46d0-bb47-02b939a2eccb", "value": "SecuriteInfo.com.UDS.Trojan.Win32.Shelsy.gen.17176.1137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5dde41-cc3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651732579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732579, "uuid": "23fb1ab1-4c6f-4354-b6ea-40c6eff36171", "comment": "Malware payload (AgentTesla)", "value": "e250c4dd15e5bbc352800dbed9a7b3d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732579, "uuid": "d1fd211e-31d4-4fdf-9cc3-5d07f343b5d2", "comment": "Malware payload (AgentTesla)", "value": "77327f17cd5e43d1508f2d13c9939942a1ff81da9c63bafa23c4b05441bed0b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732579, "uuid": "e37d7087-0eeb-4618-9500-4bbf0313155e", "comment": "Malware payload (AgentTesla)", "value": "f7dda4d8e7a033852b829c2db63ae283e3769ea9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732579, "uuid": "f34f80b9-d8bf-4a11-81ae-2130c7e1027d", "comment": "Malware payload (AgentTesla)", "value": "e095a3dd73606d8130441de3cb4290c65a41631f968757c96b9f310cdf17811d9830b77c87256108fe9e3132cb19d9ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732579, "uuid": "e6c5a039-39ca-4637-b505-975da2bcd1f0", "value": "T198C423986E26585CB300265F7FA1873B741F7FD3086C84B7621D7E5BC78A8B8E8D2560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732579, "uuid": "3a932c05-cb6b-41fb-83e2-8c395d280a24", "value": "12288:+yFHlOUJ/Mm7TT/JSuVsOV5+w6Xa0N/7ysi3IAQ4r5UZXOyoB:+yFYaFTrxVn5+w6KAEIamw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732579, "uuid": "39c78ef9-7125-4e51-9bdf-17d2a2775e5a", "value": 574957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732579, "uuid": "00f7d9b0-3e88-4fc3-9de4-9e3eccda0f0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732579, "uuid": "72b36ff3-4412-495d-985c-6eebad947d0a", "value": "bank details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c48672e-cc94-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1651769784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769784, "uuid": "4db66d16-1116-4778-be33-94e8dbe84b82", "comment": "Malware payload (NetWire)", "value": "0a5658ae9bc75b17d7d591f8411c2b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769784, "uuid": "3ec4d850-fa40-454c-8317-e4eed124555d", "comment": "Malware payload (NetWire)", "value": "791b2bf682699cf97e3925dee40ddd5c2cb728e80f798225a7fb0b713c1b1544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769784, "uuid": "ae452002-4198-4799-9f6a-243783ce830c", "comment": "Malware payload (NetWire)", "value": "97a8540c7b213ab33231735e73a01f0903e51182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769784, "uuid": "c2adf585-3833-46a9-8fda-376490ff500c", "comment": "Malware payload (NetWire)", "value": "052e4551db273967f7eae6a03a6cc13490f2bc9baa548f1771f731f19cddb9b3a0f60d190e5c2188298262b2f620bf33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769784, "uuid": "d829e06f-4e0f-4aca-ad39-80ac75cdab98", "value": "T124B20FF1C1FB47ECDC530E760CB2AE10106BBE9D95756639685BB039AA731C220B2E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769784, "uuid": "20b766fb-8ea7-4421-a921-0dc83370b31e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769784, "uuid": "e3a40976-6274-4a49-9512-643101845fd4", "value": "384:lfpqJR7hm2/PpvUNZnrunD6d84fizQyHwCggdmNeJpEjMRlr4Fg:hp8R7hHJK0nD/4fiLQgdmNWLRlrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769784, "uuid": "5442d959-0410-4449-aacc-627c58a4b89b", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769784, "uuid": "84d29ab5-3953-439e-96ee-2f5259fed9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769784, "uuid": "8e90d543-7898-443c-b9ba-18085bc3f4b2", "value": "First Order 1050522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97f3bc0-cc61-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651748171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748171, "uuid": "ed3118cf-157a-4077-bf60-8d41c9c7e199", "comment": "Malware payload (AgentTesla)", "value": "56433f36b2a6ff398fc05ffa68aa7cd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748171, "uuid": "83f08754-3f61-43c5-96b0-1cfff8081e84", "comment": "Malware payload (AgentTesla)", "value": "7a48c66fe1192c99d88798287deacfcfb2ee859ef39c4b8a6c53abc048f2723b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748171, "uuid": "52463b5a-90cd-4465-b517-b572390cf912", "comment": "Malware payload (AgentTesla)", "value": "f2438080b4c95e0ef3ef5873b8a50357a2d6e2d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651748171, "uuid": "bc80bdba-14cd-4146-9137-392207d882b5", "comment": "Malware payload (AgentTesla)", "value": "c544f5a9e0e5e3c8aa184836233285e128edcf075c3bd19d5dcc9f2f4f132ff1e635cabd0e72442c14d79b4b4bcb2feb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "daa", "colour": "#0ED13E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651748171, "uuid": "92bf03d8-e228-405c-8650-38881f821c7f", "value": "T1C3B4331D6DDD6708FA7FCA3DF1C659CA6CA3A32D40C728B4032B23044BF6DBA526551A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651748171, "uuid": "00d98678-cfa3-4333-9b88-5ef1f2c973bf", "value": "12288:ffwL7kLrkqjFMIlapN9GIZlpjf8ev6Mv+CxiL0Y:wfhqjDlapN8InpiMmQgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651748171, "uuid": "fb8d96b2-a043-4609-bb2e-52e0267816db", "value": 518557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651748171, "uuid": "bc1428be-9c8a-4c22-83a5-728358f79e86", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651748171, "uuid": "9b031017-356c-4e92-a355-fc93afb1bece", "value": "Nestl\ufffd_Cotizaci\ufffdn_245123..daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd32674-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651733978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733978, "uuid": "c2f41256-a86f-4cbc-929c-927d480a9bf8", "comment": "Malware payload (Loki)", "value": "8c7e9d4d5f172854a531a86d34af2c8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733978, "uuid": "d2c21d80-ad74-4d2c-a62f-c3aa5265a109", "comment": "Malware payload (Loki)", "value": "7eaffbf0e048501f710bef50d95d59870d638c7e64225397f1ae1d03014c8b19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733978, "uuid": "879a6f19-59de-4fe1-9623-bd9d251bf619", "comment": "Malware payload (Loki)", "value": "43d99c2bf4d5fce1b640b4ee65b234ced6292c35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733978, "uuid": "bff683a7-ef3b-4264-a2a9-a357758733c2", "comment": "Malware payload (Loki)", "value": "5eba2bc4863a4d92af6bbdd7c2bca0efcc89a9234e0cf8c7dcdfa705142430602170e741ce53a1238eb625bb4402a49d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733978, "uuid": "62549e31-f3f6-497c-ac02-a1e5bc3ad5f6", "value": "T120C3F1583BA1C0BBD4F307B21D395BA78EF6D623243457475710BB4D3AA2A42DB1E361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733978, "uuid": "ae397e88-6441-4c56-81d0-0433b56b2b5c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733978, "uuid": "0b30c26b-758b-488e-a131-1c63c9dbf680", "value": "1536:lsuNLvSFVVeozLpPunbrmI7ngp4GpYis8ycoLxPNh8fXuEMygzMRLqBcV7W55IUK:l1NjcVVnLpPunbjLgFcJcq7bNw3g4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733978, "uuid": "fd2d60d4-b153-46b8-9240-9ff92b7a0cb3", "value": 126888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733978, "uuid": "e8ab5f91-f4f7-431b-b298-b6f701611722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733978, "uuid": "193b7514-7c7b-44c7-9365-66988eef817d", "value": "8c7e9d4d5f172854a531a86d34af2c8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb445058-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651757515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757515, "uuid": "bbad6148-d55f-4451-bdb2-82b00b1b8e6c", "comment": "Malware payload", "value": "e7a3f3e9969e3aeb33e4d12226664911", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757515, "uuid": "61b3fd84-5cb9-43a3-8dbf-1c60a7061096", "comment": "Malware payload", "value": "7edc5e3677b8ad565be4058e736c6ec6f48654dadb97d100a7a094e539b27ac6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757515, "uuid": "015e3953-720c-4213-81d6-c427a2e83533", "comment": "Malware payload", "value": "f10e433aae5bcc302617cbe660c320a66e60b570", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757515, "uuid": "b57a4a02-bfd4-4744-8e69-342ec7786633", "comment": "Malware payload", "value": "0b2abbf74a00e8a2e9c241b805edbaccb7381ba4880c7f2b85b3a4795249d592a5239ad72cba88a244543d420000ade4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757515, "uuid": "8d926d86-21d0-4269-8b95-27e2f81f6fc7", "value": "T15B02CC14F21AA0778BB0E201CB0F7E57B72A53835155A55823DB21BE948B58FC06FAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757515, "uuid": "b1f92035-e739-4c12-bfb7-e39b37aa511a", "value": "96:qKNur8hD8m8T82Fk79XHq4b63nLbj2f5scFIL2z/QwhRVgT212x2T2w2hLTDrFDl:qKgque9a9vQ4LXKgUKFjP3FFDOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757515, "uuid": "e706963e-28ff-4a89-afea-ce927961943d", "value": 8283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757515, "uuid": "1e919616-3c4e-43ff-9c82-49d7dc1a6794", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757515, "uuid": "f270a8e5-4209-41dd-8c61-c3b15985374e", "value": "SecurityDsp_Replacements.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dea19f-cc7d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651759867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759867, "uuid": "e2a52cdc-9a70-42da-aa54-7adb21f6b134", "comment": "Malware payload", "value": "9ec1fcb11b597941bec03078cccab724", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759867, "uuid": "dd03be5a-4166-4038-a8e9-936c7b898c05", "comment": "Malware payload", "value": "7f96d59cb02229529b14761f979f710bca500c68cc2b37d80e60e751f809475e", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759867, "uuid": "8162cf1e-9b47-4413-9a60-29fc9b8bfed5", "comment": "Malware payload", "value": "489c36c9ea3fb90f61209d43efffd8d997a362c6", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759867, "uuid": "a2fc16b6-2525-43d1-bcfe-1a8b71582e1a", "comment": "Malware payload", "value": "e3361e978fd257a3ab30aa7203020d63490f8648ef46b16c6dd874d7e619719e38636b99c929ad0b8c7f1ee7b9fce4d1", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759867, "uuid": "0e91a80d-d461-48fc-b6b9-c2b00cc4efcf", "value": "T1E331FF080BDA0715C2B2CA36A8AEA312A9A57846E9934F5A02D056C4282A211F871E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759867, "uuid": "18bb4c13-e603-4d2d-b98a-b4403d033572", "value": "12:8sY0m/3BVSXzZUBW+fcwiFvPywMY+L1vP3iN37+lbYM36:81J/ByUA+fYFv6wkL1vurabb36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759867, "uuid": "5af562ce-2e57-426a-9596-5a84fec53f8a", "value": 1542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759867, "uuid": "15f52ca0-d97b-43ff-8235-278c3040da69", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759867, "uuid": "ee07cb5f-a348-4cff-b87c-38c5ba28a946", "value": "INFORMAT.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cdef95-ccbe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651787735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787735, "uuid": "8728f640-639f-4b36-94b6-565aa0ac89a3", "comment": "Malware payload", "value": "6e168c7f0a14bb6c926b287eaa06f541", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787735, "uuid": "98f711d1-de37-4dbe-8c49-3407603fc74c", "comment": "Malware payload", "value": "8085a6f73b88a4bd5659066e91dc040ca2d24c347e002be8235fb12c93e45008", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787735, "uuid": "d860031f-b641-4a78-b975-f98b4026faea", "comment": "Malware payload", "value": "af4ea595c8f55bfe1161d70016727197e96b12c6", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787735, "uuid": "04d193f5-784c-4264-816c-e7bd48c06c16", "comment": "Malware payload", "value": "fa635c707daf43499480a8fc322c34030eaa6eb6391f1f0b1e725bf0ca1907d93c630f041e9f2ec4ce1a9c2cd45a9be7", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787735, "uuid": "fdb3d3ca-83b9-46c9-a297-a76c8261bf1a", "value": "T1F5830219F039BAA3D69186D6CF06E005C862E5ECE44FE0F96F4C28CA4BA60D2758F5D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787735, "uuid": "1a6e2597-1870-4f06-b2c5-f2bb0fda9d28", "value": "1536:yjE6ugGtdOITQRzC4ZnyQShmX4bxsYCOh+YT6Vo4Onos+TdW:oug44EszCeYQ4Fhbgo4m+TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651787735, "uuid": "b6dc3ae9-096f-4fc4-8e7f-f69faeb5921a", "value": 87666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651787735, "uuid": "8a4c8542-3bc4-4e58-92af-f8fea70409e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787735, "uuid": "a7673caa-0f32-49fe-9ec7-4f3ba841dc0e", "value": "consumer credit act small agreement(26388).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c047a6f8-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733042, "uuid": "6b342d0e-1aad-4ebf-8cbf-381e659565fb", "comment": "Malware payload (Mirai)", "value": "b7bcbee82fced9f65dd9401df18dbc92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733042, "uuid": "0569d5d3-4cd5-46f7-8de2-b4eb06a5cf03", "comment": "Malware payload (Mirai)", "value": "82861d544da278dcf03daddee05c441293b336512ddc243360ee256a351eadfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733042, "uuid": "6b9c2c17-03ab-497a-9a12-edf703161f62", "comment": "Malware payload (Mirai)", "value": "04cbf371cbff7b69b331f625bf54d1f3c0c59113", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733042, "uuid": "3b533e60-199a-4bab-8b6b-4d03f9b7910f", "comment": "Malware payload (Mirai)", "value": "f21b5d55f5774dab5bbeb02da3bdb0f2b147e5f0a61bde23394709df8640ae03d469cb48c9d1ae8fe7bf1cfbbb1efbb4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733042, "uuid": "9a435161-46de-41aa-8ab1-f23e3fd7594c", "value": "T15B92CF1F51CF4A9AD82B0379651A08BEBF013CDA0B9FDE090611D2E652F215A8F3A1CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733042, "uuid": "7e869093-e4ba-47c7-92fb-9e0275dd655a", "value": "384:MQbB7BBEuOzn6Wc5C3GAAqv7moC58Mmd876oJBow5wug32rlN7Qyn0AgYZHKLv1t:f7BwjfLn9moP1876oJGw5wug32oy0H1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733042, "uuid": "1466a6d8-a550-41e9-a000-04a3b7b51aad", "value": 19604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733042, "uuid": "49c9a5ba-b405-445d-8256-b199c9702f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733042, "uuid": "390e4c06-04a8-46ba-912e-f276a59766bc", "value": "b7bcbee82fced9f65dd9401df18dbc92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b8c560-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "fd2fdee9-04c4-4496-ad1e-12f7a3fe6e17", "comment": "Malware payload (Mirai)", "value": "3f1baa805b62bc677460268ac32fca9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "ade9b7ea-d33f-4daf-9efa-64260f070254", "comment": "Malware payload (Mirai)", "value": "83d19a56f50e4f138a8ffe2d2ada7b627e93b0c27ff920ec3b1ae054c3a24935", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "8c05b905-fb72-4774-acf3-a40818cdeff9", "comment": "Malware payload (Mirai)", "value": "2754f33106142757a4385f356c9900006e6a5e41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "3c63418c-d0e4-4200-8b21-5e9b894f92d0", "comment": "Malware payload (Mirai)", "value": "f032b8edaf973eeb55c170fff57ada774cc6aa6969ad355db0cb84a846b87ec6bb293b14802031e7eb71c89912f4fd91", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733405, "uuid": "941ca25d-5154-4221-8557-a8f32dbb427c", "value": "T1CC92D0307A477590E7748D38D8E2AC8438075AFDC3EB32B114A38F85EAD381565F4A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733405, "uuid": "15ad0cea-2f68-46d4-a3c0-cfa97f0bc2dd", "value": "384:jC43YzCnT4c4qan+mrPtdAy8NwJh14nIMZZ9pJhymdGUop5hj:iI4c4Jnr1dAfwJr4nIMjJs3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733405, "uuid": "51955ff3-a78f-40a6-b824-8788a6cab6be", "value": 20608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733405, "uuid": "8ff6339e-c5b1-4131-a329-f2ccb5a1e427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733405, "uuid": "a0f8e606-08e2-408b-bb30-2586c6351f65", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51ef19b-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651736057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736057, "uuid": "647f9d1a-0d3e-4af4-8cfa-685285ef107c", "comment": "Malware payload (Formbook)", "value": "c61f9a9059f8b8bd0e69f7df4cb09786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736057, "uuid": "828a0a67-dc9f-4356-82b5-9407498b4ee1", "comment": "Malware payload (Formbook)", "value": "84a5a26f1748c3ad1f0b98c438908e8dc842eacc6390484527ee1fe7e56264f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736057, "uuid": "3d263c5b-5afe-4a56-b5e1-196417eb6981", "comment": "Malware payload (Formbook)", "value": "70fffde0debf4559859617d49dc48c54df3c156d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736057, "uuid": "86a685dd-79cf-4d01-92c4-db0831631d57", "comment": "Malware payload (Formbook)", "value": "a17819aa1edf09372b05d0501576c043e21032e3a9672620a918d0d4e8234e88a9df1360ca81698e5cd9b4e50fd017ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736057, "uuid": "3e39f83e-63b1-4f94-994b-e1663d3c8ba9", "value": "T161067DB32B45629FC1313039FC92CA0E66101275931F7623EBD83978E59F9D12AC9F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736057, "uuid": "41ee5f6c-a326-4132-bd90-ed0a3e4dd24a", "value": "25a9be81ed1ff039b036d3155dd64335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736057, "uuid": "f7d8f09b-dca7-473a-8738-a7a076a08889", "value": "98304:xjFJEyX5ZYpLKwYXA8NMLgJ0CYkL1N5qV0O8:ZFSyJZ8LYEgCCYkDxO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736057, "uuid": "9477598f-5aee-4be0-aa49-63a2fbebc90e", "value": 3677592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736057, "uuid": "e707e057-a366-4655-94c8-6bc720ddb155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736057, "uuid": "f7c344fa-f17c-4775-aa38-c37818ed1a95", "value": "c61f9a9059f8b8bd0e69f7df4cb09786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e99775-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718909, "uuid": "c114bcc6-2a5e-4b5e-a6af-1e05500e0583", "comment": "Malware payload (Mirai)", "value": "da5ab4a03e702e30021fbfdeffdb9f56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718909, "uuid": "ffbe75c3-c73d-4bd6-8c71-2b26b0c49f6e", "comment": "Malware payload (Mirai)", "value": "8677abae9f55400ea52c561bcc86072e261e1f67e2770bb7b3853f884817fa34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718909, "uuid": "828eb315-68de-4ab5-8501-479bd3a0f85b", "comment": "Malware payload (Mirai)", "value": "d1b5e92f7dadfedbf505a8666efea9cda19da9d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718909, "uuid": "fb9c15ca-fe84-4692-acc1-db10f1f90d85", "comment": "Malware payload (Mirai)", "value": "3516bc41068861dcd59b3052534999d52c940552fec58a38a50158bc5ead4cfcf3d9ad888dfd13e2530dccd8237c7bdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718909, "uuid": "4439c313-d74b-4ceb-96ba-12106e5f2123", "value": "T1CC73AF75C0ACDDA4C6154638F25199389B13A00DA5A33EFAEAC2C656505FBFCF1087F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718909, "uuid": "4fa8910e-bd53-4390-b622-ee05f448880f", "value": "1536:a/bMmbMJqa5wtczvnMrU9nE4rsSryijHBfs3YCQTD5N6CEHr:aTMN4yhvnMrU1E6ryidf+585N6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718909, "uuid": "79a0fad2-9f64-4bab-be03-7649d6655892", "value": 74832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718909, "uuid": "0cb0ebc3-6db7-4a82-b340-60a540e42644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718909, "uuid": "fb7b16f6-c2a9-42d4-a4d3-f766ae5d588b", "value": "da5ab4a03e702e30021fbfdeffdb9f56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adcc1a5-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651728094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728094, "uuid": "2066b6f2-7d02-45e0-8a87-fb61de4ec169", "comment": "Malware payload (GuLoader)", "value": "37fe08e53ecd76b241b79e8784f965db", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728094, "uuid": "608626c8-9669-401d-b943-0e391255bd34", "comment": "Malware payload (GuLoader)", "value": "87861a46769dd6da39305347be331587a6c98b2cfc7e3e962a99dda6e33d1c81", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728094, "uuid": "ad992816-e701-42a1-bb7f-dd53feac1538", "comment": "Malware payload (GuLoader)", "value": "1cc199e36d7911f6fa84002ff7c821beb7b0b2ee", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728094, "uuid": "cbd61e09-dad0-451d-98b5-70316f54bdd2", "comment": "Malware payload (GuLoader)", "value": "2cb39349c00c9ac5f497b98b9b14efc605ccb85e86e455e59fc86f60a9e4c8edc3a34ccc4d5ae6d8bc95af2c81d3abed", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728094, "uuid": "83f6ed20-ae49-4ce1-929a-4f797669dffe", "value": "T11032F945FA508CFAD32C4178C8735E4BA07AB211D7A223CF737C452A2F927863728788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728094, "uuid": "5363fcbb-2f47-4aa8-84f7-73dbdec92f88", "value": "d2def47d2a92d4173aea3c245c5c4bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728094, "uuid": "141c8511-d3c1-4c13-b3b3-238989f349c5", "value": "96:SY2pNnF557AN59lpepeiI8a/nXDFpJW+tsPb6zjB1YfW7VNNYlS1VAdsDJkD4uAA:Sz57g7pIeiba/DBokF1YgtYQA6DUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728094, "uuid": "15f84a07-c21f-4611-8f94-bf83cc8383e7", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728094, "uuid": "83b32783-0383-4c59-8d5b-ab988e1199bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728094, "uuid": "42cf53a4-88ad-46f8-bf00-2a80921ffaaa", "value": "Purchase Order 205A.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02ee4f9-cca8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651778542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651778542, "uuid": "30047503-2982-4416-86b4-3eaa8ecb9403", "comment": "Malware payload (AgentTesla)", "value": "b30a1ce48984c9d5f4c1eb2f5de2557e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651778542, "uuid": "11e14d35-f7f0-4a5e-99dd-4cf9741cba71", "comment": "Malware payload (AgentTesla)", "value": "89e1548e7612ccc95cce20b7f3ae375988d0ff1c224215f7e0eeed103c6c1f15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651778542, "uuid": "4055be7e-4022-4505-a4e0-379a716c8f9c", "comment": "Malware payload (AgentTesla)", "value": "4bd9ac9cc7f14d7e015172431f7b3721eb9661d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651778542, "uuid": "3aab2cf0-9152-478f-b128-381ebb25d429", "comment": "Malware payload (AgentTesla)", "value": "010c390644a0ed8b2156d5081b84fb06b61bc2659d76c8f72f8c40dcb7a0678693519a2d4d8354cb277414bca64f1c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651778542, "uuid": "fb844574-2d5f-4765-9064-db9c4c788a61", "value": "T187F4F0202A2DAE10C57ADE714493C1B543F79C8F7962A13AA7E3BDBF7915741C223A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651778542, "uuid": "83729bdd-b8a1-4d83-8ad1-e5c78b07c920", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651778542, "uuid": "2ab9a613-084e-4619-aab9-8dbedde42be6", "value": "12288:FFKuL00CJDFq4fPQZLjg2ezOTEFoxs3KF1aVy6RWFuHA/oY1WciJUh:LRqJ5q43QZeUuoxW+1W5A/eciah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651778542, "uuid": "fd24fcc6-c430-4855-917c-ce53ccfb76e5", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651778542, "uuid": "4f7a95a8-d5bf-4e38-bc72-ab1b81908984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651778542, "uuid": "6a071d56-4b66-4a5c-ad0b-dbd68b0fb1b9", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a136fc3-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651728093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728093, "uuid": "7a378b53-c789-46ad-a78b-287fc6e5c6a9", "comment": "Malware payload (GuLoader)", "value": "0773ae53c49b566eb47c1935815eb34c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728093, "uuid": "1cdef357-771e-43b8-b9b8-b13016fe65b0", "comment": "Malware payload (GuLoader)", "value": "89e2493a09c8a4a6de5198ff6052522953f26b441efe2b19838052fa695f08e9", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728093, "uuid": "8f1f1481-c7f0-4d0c-8fdd-6fd96abc6957", "comment": "Malware payload (GuLoader)", "value": "517359f64e696114a86aa6e174b27a3f1217a27c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728093, "uuid": "7f483ec1-e396-40da-afa0-1d85e4c360f9", "comment": "Malware payload (GuLoader)", "value": "41fb6580776099b5a1bea7bce5d73af48d28ce5c19447ce9028f78daf5d1f7254b83e9c62cc53f37413ffcefbed85881", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728093, "uuid": "2cb4b002-2298-406a-9cd8-406187890851", "value": "T1BA124C62FFD149F2CF2C03F56976592B862C77108FA10712BB7E661E2F05441F91895E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728093, "uuid": "d566c14a-f6d7-4b97-bb4c-81035e032fde", "value": "5b93d93d32cd48b4478e2218c8053334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728093, "uuid": "c085f65a-aade-4fc3-aac9-6253beb9e6b7", "value": "192:ofuuiX0ubSoDQMXmA2WjO9r9YQFryrJot6:bhgaXmxWj2hFWyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728093, "uuid": "77fc19fd-c4ff-483c-ab3c-7034c6737894", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728093, "uuid": "fcfc3568-497a-4522-b675-4b5e46bbe4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728093, "uuid": "bef154d0-6d00-4a62-8e3c-040243da161f", "value": "RVSC2107519.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adc6f6d-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651746213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746213, "uuid": "b14e5324-1713-468d-b7f1-cac1b4b9740b", "comment": "Malware payload (GuLoader)", "value": "22e379a41dea814b0df3c54098d0159c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746213, "uuid": "6fda8df5-5e1e-4b7d-bc17-1b3c7150a47b", "comment": "Malware payload (GuLoader)", "value": "8a9186bc1aafd580c249486fca33a144dde0dc96c5c0e30be52a1bf0ad8c5455", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746213, "uuid": "a982f235-3b45-4659-85cc-bd4b1e54f9e9", "comment": "Malware payload (GuLoader)", "value": "7982ca05e64db857f9c1c8f5c8f84576607858ba", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746213, "uuid": "af6f72f4-551e-4c9c-b25e-3e65777b7ff3", "comment": "Malware payload (GuLoader)", "value": "3f1d1e7ab36ae22761c3ced08af715cda55fdacfd9d51268eddb5e50d5681151f565880f0cbae773f19618ae8f97ad5b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746213, "uuid": "61cf0f47-207c-4659-aa82-47635bdbbe2d", "value": "T19B34E83BD2826D7500641C78F424A973C68FC79599B88A99F3C799A363CBD04EE51CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746213, "uuid": "d5e3b9f4-200c-4c03-a37a-6ab84f82b166", "value": "3072:tEFVTSh5MideUi6LBgoeJhqe6j6y4ANxtKdDQvy:tEF1BOeU/BgoeClzNxtKdDQvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746213, "uuid": "7b870d14-b675-49f0-9ba9-afd5566aa203", "value": 238508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746213, "uuid": "ef343a2b-1401-4c4f-b6af-829c2ea06e86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746213, "uuid": "9181e7f7-41b4-4c0c-a6e0-8c7718957a2d", "value": "DHL_STATEMENT_OF_ACCOUNT_OVERDUE_INVOICE_SUSPENSION_NOTICE.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dce187-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651727916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727916, "uuid": "6fa3b36c-60b6-49b5-a829-f922ab9d6724", "comment": "Malware payload (AgentTesla)", "value": "60baabeae8590d75596bc32a984b8faf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727916, "uuid": "b7ef083e-6532-451d-b774-b48bc2820dfe", "comment": "Malware payload (AgentTesla)", "value": "8a98b4da203afc60658d89e615f0f298f2e2ee9bb734cc28184911de5d0955cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727916, "uuid": "41274b3e-1c6f-4c14-a99e-95fcd027e851", "comment": "Malware payload (AgentTesla)", "value": "62b0857658421f9235b99e2fef5e299d9a455ad8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727916, "uuid": "1b0d2351-85ae-4d89-a0e2-4860b9d1894e", "comment": "Malware payload (AgentTesla)", "value": "7d24420b4a35e0f9e9a850473a93568b241dacbc2f33e5123bea13eeac1067f287825ff563b5a12cc502a6f4cc3c79a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727916, "uuid": "82ea60cc-77b4-4df6-a3f4-cffc2970ad16", "value": "T14D2412C9F7991786E1959E7D99087B1830AEEE18B47F8C3EF850B249D2FDE014E12391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727916, "uuid": "dc26880b-7951-48ec-b1cd-0a6828c27318", "value": "3072:4hHApYRDChkCsCBABMimkHiXh+wZo2UhoTos5azb1M5Y6r1uY13JWv8QKB:WApYRm+3CCBMGH8+wZRUhgo1MqDQ3J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727916, "uuid": "692b8e7b-22b0-417f-86dd-f34846d312ed", "value": 210808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727916, "uuid": "b1e02525-42f2-468d-9f4c-00942aa132ef", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727916, "uuid": "dad01eef-9d65-45f3-83d5-a80f025314c3", "value": "2022CT285-FH-211217A.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b76b9f-cccd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651794250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794250, "uuid": "7075f2fb-e1be-4cb3-8aea-02d9d7a2e02c", "comment": "Malware payload", "value": "797560327ed25ca66ba08de50c88b8b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794250, "uuid": "dc504be4-4faa-470f-84ea-8602a30fcc70", "comment": "Malware payload", "value": "8c8f59d71eb9a0c17dfb1b541ca3b337202f1c8dd288256159417a4cb739d217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794250, "uuid": "761c56bf-55dd-4e7e-93d2-eec05d7e340d", "comment": "Malware payload", "value": "269829dcd5ad5581ab42aa359b0457da05af696f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794250, "uuid": "993f3b22-6b92-4a78-a150-1c91a54cdb23", "comment": "Malware payload", "value": "ab6e8e4a2c611182464ea08de5fe6c1c16d5ba41431b6078004b266c5a63de7699bed0303f27def173d0ea72a547279f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794250, "uuid": "99e09524-1fd4-4c7c-a682-1a124b2ba5e2", "value": "T18B456B16505A49DBE4B2573F80614DF16610BDB8F888D0AD81EB7BB49FB835C14CE8FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794250, "uuid": "cdd236f3-d60c-401a-8fb6-428e339fa842", "value": "e6d4c936d9c95e722d2428ba45fa8608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794250, "uuid": "9a4ab5be-ec36-4eb4-8b07-a167b201885a", "value": "24576:ej8KH/NVv4gWcixa/Q41L9bQCfYmpbVFgwy2ZAHaRB:e3NVvFixiQiF472ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794250, "uuid": "d11781ce-4552-4dcb-b06f-81f8bb0115b4", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794250, "uuid": "3184fc0a-163f-44bf-bd7b-8aff8c5e2456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794250, "uuid": "c7310df7-4059-461b-a405-7a4a5c225884", "value": "\u0445\u043a\u0442\u2560\u0446\u0428\u2563\u2554.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5abf6fd-cc0d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651711952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711952, "uuid": "33e68843-6fa3-4fac-a2da-d30396f10aff", "comment": "Malware payload", "value": "f74ccaec9935cca19122478058c39f79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711952, "uuid": "238ad192-b64a-4976-936b-2e2e8af99a55", "comment": "Malware payload", "value": "8d2d9d8d937c880d75eb1e4a930f273a0b215ba1b15c07c10a7d902f23b0b08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711952, "uuid": "05116f62-d344-473f-890a-fa438ea3a4a4", "comment": "Malware payload", "value": "5dbffbe85764d0bd43a90a1ef8eb8d8c5a540527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711952, "uuid": "e90d6426-313f-4d2d-a469-7205dfd2eb4e", "comment": "Malware payload", "value": "3cd69a66a3919e18eead4cf61b93a063d48e8dc7d8284ad16710bccdfe75a70ab2895af3d15fd6fce61d3468132e9744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711952, "uuid": "9d606f2b-db85-4f83-bd49-671d69cb9145", "value": "T130163300F7A51525FD55437394AAF3B6EBA5A3326833AC500AD31F9BB44F2422B6DDC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711952, "uuid": "7483e63e-42f5-4419-9172-e9cb3dd5cfac", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711952, "uuid": "9689c3de-d55a-4941-bbbb-02b69c57b03d", "value": "49152:k4yt7lzFHsGmpkLDyKDuaqad0H/XjCehgCznjLvWTPQVT+T8iGHQelQN73A9kbIG:kD/ZHmmqaeP5hzWGT+T8i0XI737K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651711952, "uuid": "78d8a667-5839-4c80-94fe-a8895e1d8284", "value": 4143776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651711952, "uuid": "395fa9fe-57a0-42a4-b9b6-ccfbf35a7969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711952, "uuid": "dfa98726-6e78-4abd-9b72-b0d156d6f246", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd8999b-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651734003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734003, "uuid": "eaaadca9-0d0c-4f13-b8ff-6c71efc9bbcc", "comment": "Malware payload (Mirai)", "value": "8601545f9925cc763e0b74c7eeb75f45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734003, "uuid": "c0ece828-7db5-485c-8d87-7b4056610b4a", "comment": "Malware payload (Mirai)", "value": "8f81b4c035aa51f448a7deaac1b0f36b1412263217fbfc5022b7c789b1e3d16e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734003, "uuid": "d98af24e-f8dc-4c50-bd46-5144e7296a0f", "comment": "Malware payload (Mirai)", "value": "c83db8365b34ceab55b05800c518ab76f0a0f4ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651734003, "uuid": "f74027d5-9c9f-4380-a242-7c20023a9059", "comment": "Malware payload (Mirai)", "value": "6d6a8d1bf9d4bf0dd56a7bdb4d3f9eaaddf202fc2ae3c71d373fdc35bb1a6555d33bf9a4ef83acf7af0ce7c960c0a6b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734003, "uuid": "ffaae270-9703-4d4b-8cc8-7e0fd9fd297a", "value": "T118A2CFACB0786506CDBEDC3E408E47B1A62AB28131566F8EA7258CE4F694827F419453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734003, "uuid": "07ccce79-cf66-436c-bf42-11903bb22796", "value": "384:spp4vcxmXT7S4IjJIDDQTHgpzuVmUvpYPK5rUuTBRWGVCz0NvQ:W+vcxmX/SpNgDQTHi+xYPorWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651734003, "uuid": "07ca8e75-12d1-444c-a8ab-89713fc0c93d", "value": 23064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651734003, "uuid": "9a9f3dfb-2839-41e7-95d3-6c1ff1ff320f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651734003, "uuid": "423831b5-45da-4299-9113-97721b7344cd", "value": "8601545f9925cc763e0b74c7eeb75f45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0096c199-cc65-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651749471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651749471, "uuid": "fe8cd8cb-0cb4-4965-b2ad-b4ffccf0d0e3", "comment": "Malware payload (AgentTesla)", "value": "c4e10220c55fbbb8e2dbed8d66d6be1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651749471, "uuid": "f0ff2849-1613-4b8b-aff1-37833665da1c", "comment": "Malware payload (AgentTesla)", "value": "8f8b6b559a3d8f55e8efd22212eeff9136bdbc27565b49183fce44b0ece72b6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651749471, "uuid": "d20a8b73-b3a5-4eba-aace-25986e73873b", "comment": "Malware payload (AgentTesla)", "value": "897cc57b911b1aa5a41ac8793fcb79be28196ee8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651749471, "uuid": "2433d0d9-2fe1-46b3-8941-e410fe605f7a", "comment": "Malware payload (AgentTesla)", "value": "7b0aee53143f32bd9429c1e6820597b7975c98b8040df46ecc1123a6fbf66a5ef2f0effc51a64d7be4af321249941606", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651749471, "uuid": "08a3c8f3-c824-4d99-9a71-d08f4ac4211e", "value": "T19013E81A2892561AC5D47BF869B1A19366367CE10134C18FECF97F29AD73323CCC226D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651749471, "uuid": "0f19a40a-bb50-46ea-a17f-d0b1199a3fd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651749471, "uuid": "4e733e24-da52-4fc7-8ca0-1cfe968ce97f", "value": "384:eTLmk+l2GtPl55020NffOPQEulai+MwCKPEH2S3dd0hUADka6Y:eTLmk5GtP18lsMwCK63deVDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651749471, "uuid": "69ce88ff-fc23-4956-bf87-9ee449a59fa4", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651749471, "uuid": "8a1406d0-3245-4843-a2ea-4643f15fac61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651749471, "uuid": "effcc902-f07d-4751-a5df-2c87b6aeaccd", "value": "Quotation Q 2022-05-05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cc4b9c-cc26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651722604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722604, "uuid": "8a35dd5d-8e22-42d6-9d9b-8728e6ba39c1", "comment": "Malware payload (Mirai)", "value": "8b5f66b3fef129f46bf5e991322e93af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722604, "uuid": "a29c02e1-76d1-4b6b-83db-790e0ccdb5a7", "comment": "Malware payload (Mirai)", "value": "922c097d38721b3b768123fd27ca898ace5a76d7148c4289b9e9f69437e80afb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722604, "uuid": "7daf838c-f0b1-4e92-b396-c3f16908312f", "comment": "Malware payload (Mirai)", "value": "618bd98b8505e48dca64193a9ae1b2765746bc0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722604, "uuid": "db49b754-d765-41b3-bccb-c530842d61f0", "comment": "Malware payload (Mirai)", "value": "74304a009f2d2c2386943f1385b82c2507e8d6573c1ac7ad63309ad9cc9b5e6cad589ab669cd835a9b79b51a3614e8e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722604, "uuid": "f632fdef-a27a-459d-89c5-d42312bb08ed", "value": "T1B7D33B86EA408E13C0D51B77FAEF41493322D755E3DB73068D189BB43F86A9E4E23649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722604, "uuid": "64373c0e-b095-441a-aa1a-cc2aa44024c2", "value": "3072:QybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx13e:DbUEGniGQYtOR7aPk9mrsplDKZUmQBK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651722604, "uuid": "a85864e6-4098-4c3e-bcdc-2afa521d1b80", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651722604, "uuid": "549e3bcf-9fbe-436d-bb05-8adc3d25bc0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722604, "uuid": "607b9b03-ab46-496e-9031-68a564d484b0", "value": "pandora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444313dd-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651759463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759463, "uuid": "6948a623-fd83-496d-85b5-f6f35480da36", "comment": "Malware payload", "value": "c57425445655338ff41c4354f81c064d", "object_relation": "md5", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759463, "uuid": "4bbc8b4d-0927-47d0-b599-b72f3cd8c8a7", "comment": "Malware payload", "value": "93eef024ef7904bd7a65d5b2a8e3e199b3a0af26aace0884ca6b9070f3f56a60", "object_relation": "sha256", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759463, "uuid": "cda92636-2a46-40bf-9a45-919af80b57da", "comment": "Malware payload", "value": "5404fdab30ebac12c8f0e2414611b0d2625cb747", "object_relation": "sha1", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759463, "uuid": "5e55b58d-2509-4856-9d97-624e741c513d", "comment": "Malware payload", "value": "3df0b5c41cd6a5b29cc5d2dffb5dc1c54e37c6703f1c5cb0a0c0e863e6070c27c5bea47ebe84fe5f60045ad99b68bd3c", "object_relation": "sha3-384", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759463, "uuid": "3f3dc8b0-2ef8-4725-8027-ec1d363bc03f", "value": "T12F3523134960702BDD96853C04252711FF07205AF7D46AF82E3F7B4E26DE26ACFA752A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759463, "uuid": "116da3ff-de1d-4a0f-b54a-1f3ca00a9fa0", "value": "24576:KqrBiLwM34TSJ0yq6kPiu2TFALwXg6AVi9BvMTD47ggJ59Ce:KqrAP3l0yhMiZpAlViz8TgJ5Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759463, "uuid": "4f8925ed-c879-4cb7-9f81-53ad17f2a83b", "value": 1106930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759463, "uuid": "93bd55e6-8a44-4ce1-887d-044e91c9a882", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759463, "uuid": "9f2022bd-9534-48ed-b1ed-929cb2ffd6cc", "value": "Cancellation-1541944530$-May5.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfc8317-cc68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651750970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750970, "uuid": "f1328425-bd6b-477a-8af6-1c7b9d45bd29", "comment": "Malware payload", "value": "8f05657f0bd8f4eb60fba59cc94fe189", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750970, "uuid": "33194841-337f-4757-98d5-d8935e8ee28d", "comment": "Malware payload", "value": "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750970, "uuid": "50f2a87e-cc58-4c4e-862f-db001400ca3e", "comment": "Malware payload", "value": "65e4d507b1de3a1e4820e4c81808fdfd7e238e10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750970, "uuid": "17e9e987-75c7-45a4-b8ff-42342d57d9ba", "comment": "Malware payload", "value": "709132b32a8e658dc88d953d91ac6e3509d4010c99b8fd60cc91c3f6b10dde5e3f5793e72aa71a596aef3f791a2f0a38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750970, "uuid": "018453e4-d68a-449e-8d60-88a86fd39068", "value": "T17EB2EA17F741CA7AC4DE92744D8B4574B4B3A4F4AF23531B220126BB6891B890F2E7ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750970, "uuid": "76583150-3570-4675-846c-18df5bcd5dbd", "value": "192:GdnjdHUuc02BKbU7ZsF4nMS4itnY++4pImrcKQx5mDDwLSDos0SxU7NUJ2Ox:gjdHU3xBKUZg4nl4itnY5aQxQUH5i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750970, "uuid": "b15f9b80-d1d5-4a6b-8cd8-8cba785d2352", "value": 25145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750970, "uuid": "0d458b7b-1e29-4142-a74d-501e6145549b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750970, "uuid": "12e8fb00-06ca-4d83-bfbd-eb042a209fbf", "value": "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e42c7e1-cca3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651776230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776230, "uuid": "faac340b-2b38-4707-a3d7-f2e568b21eee", "comment": "Malware payload (Mirai)", "value": "061a5e7683ab3ff82026d8e649f4e260", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776230, "uuid": "faa03318-d96f-44d9-bb0f-8d1b964573fb", "comment": "Malware payload (Mirai)", "value": "9455dc215707886010f86f831de59df23d112d832809d6b267af7058158cb544", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776230, "uuid": "d70ed0f6-9c35-440b-8421-fb124459b9a1", "comment": "Malware payload (Mirai)", "value": "e7d586ea766117c30a0e6368a85a67a3bc5527c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776230, "uuid": "e8766350-e678-46d2-81aa-655e6ca9c826", "comment": "Malware payload (Mirai)", "value": "09a06ae35ab07346e5ef200a850b36767c97653521e688f82d4dd958102e362ae8529abbb6a67dce44aaeac5dae53bfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776230, "uuid": "d7d4ea0d-a158-4f22-acc8-d7235dd897c7", "value": "T14423011154930D92D840FCFAC0D00E8CA7FEA0BDE2AFA7EA05468DB66D55DCAD87874C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776230, "uuid": "3a8f186d-6790-427a-acef-a94f071544b8", "value": "768:pK7y1XGOC/p3l81xe1849E5Ljhkee9q3UELct/iw+kAYYQcp2SFd1Mk:h12Omp3l81V4SlhkSLchiw+kXYflFd6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651776230, "uuid": "5d1213a9-a3ba-4bf0-8ef6-4b3cba33c1dc", "value": 48712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651776230, "uuid": "75989827-46da-4403-8332-2f6b9422b8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776230, "uuid": "235c57f7-95dc-4b08-85ee-b905c4988abd", "value": "061a5e7683ab3ff82026d8e649f4e260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dfa18c-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651759355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759355, "uuid": "442534c8-2f42-4bd7-b38c-5b4eff4c22f3", "comment": "Malware payload (AgentTesla)", "value": "b8cc7cfe32416773efdb0ff682c81bcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759355, "uuid": "9549a138-c311-45af-afd5-116bd1113030", "comment": "Malware payload (AgentTesla)", "value": "9464ff923ad1544ea19d9dc669406a4b3477d2bbcd0ada1ed205d931b0496987", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759355, "uuid": "3cc1d288-ede6-455f-b4b3-121aee7d7d6f", "comment": "Malware payload (AgentTesla)", "value": "da4fd6002f5ea015c5c20e87309517929ad1636c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759355, "uuid": "4ca02639-83fd-4f1a-934d-a258974e35bf", "comment": "Malware payload (AgentTesla)", "value": "93c69821e3d8e567d901a9ed406eb3799c29d127d54c617bbb7d3ce0548567ab7bb800dd0dc3cce95eec0ef70da6f3d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759355, "uuid": "7bd1ef7d-1b80-4a9a-891d-e8d817d9c278", "value": "T1E6D4DF9D721172EFC857D472DAA81CA5FA5038BA931F5203A42312EDDE4D897DF284F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759355, "uuid": "c6892a04-3fef-4541-b6dd-aefee519bff2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759355, "uuid": "9777ea44-96e3-466b-b1a5-4c34c70db220", "value": "12288:3ZNvf+U99PwQOmKKGUR8S/0ga45q6J/0zfYkxXjo5PV9r+4GRH7aglojpHHZ+j3o:LvZzqWczfYklo5G44Hv+HZ+VBddL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759355, "uuid": "dfdd3e36-4e44-4cdb-85d6-76e695c8dd5f", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759355, "uuid": "06d0ad43-f54e-4288-a369-1dec4dd70f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759355, "uuid": "70db2fb0-2dcb-4abe-85b3-20220612761b", "value": "Proforma Invoice #15032016-A001..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd9214a-cc3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651732444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732444, "uuid": "da13c628-d505-410f-9255-53e5a3411f3d", "comment": "Malware payload (AveMariaRAT)", "value": "2b084deacae875f1f603dacfdb476468", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732444, "uuid": "afc9af8c-8d6b-4314-a3df-ed300235b46e", "comment": "Malware payload (AveMariaRAT)", "value": "948f5ec06ab4bed9e95098cc6e862ffaaa5540a28ac9ce8e7199e72a131d6c1f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732444, "uuid": "942a132d-c16c-43b0-9f71-622e717c68d8", "comment": "Malware payload (AveMariaRAT)", "value": "c1abc9c3e9b2bd29c7b68505d23f93d50bdfb35a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732444, "uuid": "5e0624e1-68da-4398-acf2-b303a5fa125b", "comment": "Malware payload (AveMariaRAT)", "value": "fedac1cfc8158dac89ab68ae8b55f3a536f2d98e94c8d8f682a02e0fd7c7720a85b769a4bbbdabbca215ba1ea038ef55", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732444, "uuid": "6efb76bf-1287-468c-9a2a-42e2a4119ec8", "value": "T17352BFD940294D562766D18F0D6FCAE835A96ABD27BC80F4ACB36C1C95FCC7E029052A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732444, "uuid": "8cbff87d-bc69-44f6-b67f-879530d6fa86", "value": "384:YS/960Eq9xcmley85CqEuKo8NB+QbHDmJ:Y8BRP85JEubQbHDmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732444, "uuid": "7394f21f-c270-41ea-a9a9-96a9f1f8c9d1", "value": 14186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732444, "uuid": "73b931fa-05c0-4414-b759-2db6c371b4df", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732444, "uuid": "7b3661f0-9529-4348-8a87-49cec97b0b7f", "value": "order SW 220504 37.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40ab29a-cc9e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651774227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774227, "uuid": "02589152-3369-499e-81e3-cad7b93756e8", "comment": "Malware payload", "value": "d0e7e81298b72a41493a95145fd9bd20", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774227, "uuid": "e0152f9e-9665-4530-8d91-ae316c688aa6", "comment": "Malware payload", "value": "94dc277ca7d5c57a2980edde83007a2718342a5a0e7cf530d19d124fd49e0bee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774227, "uuid": "f1a23646-1c40-4e5a-a23c-4aa93328b962", "comment": "Malware payload", "value": "c0423c21c15e29256e59b2f59590376918c26fae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774227, "uuid": "b2303550-f68e-45dc-b8c9-744d51693748", "comment": "Malware payload", "value": "817931e040303b2764fafb15720a411abf85e02a1088c28bae7c8c184ad3a2c995494c5595d4df3cf21b1b0c2dae1b1f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774227, "uuid": "745f3dec-53d9-42f2-bc2b-4cd1c05ca3b4", "value": "T16EA51243F736A46BC8F2C2332175273921764E19CB43AF4A294937BE28B79DC8B955D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774227, "uuid": "959dceff-9a7d-4d63-a291-d0b26900a08e", "value": "49152:i/ftkCU5jtr3/IxyNs1MwZpe+ri0qlsAhu80:4lkCojtr3IyNsyq4tlbu80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651774227, "uuid": "9de91fc1-89c6-4e09-a0cd-a93352632c34", "value": 2097869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651774227, "uuid": "a2fd5a16-5947-47a9-bcf1-8cb6608d3222", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774227, "uuid": "6afb6328-c0c5-48b0-94d6-f11eff35dd0a", "value": "app-2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95033bee-cc67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651750579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750579, "uuid": "b804ffee-a9ce-46ea-821c-2085ec5f91a8", "comment": "Malware payload (Formbook)", "value": "8ba0b1b8226c3df5526fc339f0f5b70f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750579, "uuid": "093a1cac-83c1-4450-bc1e-d1266219b2c3", "comment": "Malware payload (Formbook)", "value": "96e23a6b86ee1295e6586b402f1536d07cccdb22ddb91c153212169e195e5b15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750579, "uuid": "44e1346e-3782-4b5e-bd9d-7d135f897906", "comment": "Malware payload (Formbook)", "value": "e417ba0c3ada96c870fc3a7756a9ef8f536344a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750579, "uuid": "391aa851-467b-42ce-b6af-23cf9befd2c7", "comment": "Malware payload (Formbook)", "value": "1383564dc42bd005ba18818aab23b4f0d41fe84fb825c4d42fe4ca3b0410cc6ed33067051c0a5f4a33f5be8920ff792f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750579, "uuid": "5bf2afbb-3d08-446e-a9d0-fdf8d669118d", "value": "T1D9E4221A7983C244C14C423540E723218BB1F39B7273DB8D7D68A5D58F83BD19BD6A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750579, "uuid": "5b729b1b-a793-403c-9f5c-28a8a9da6fa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750579, "uuid": "809a93f2-96b4-4ab9-92c0-88e5fe112569", "value": "12288:RXVjjeuplyJcK8iXwjsMd+/3ZnXMzqpj4cRgkL0qUkQcvch46uqPToii5RPpY:vjeYbKXyJAJnXMzAMvyLUkkOPII5RRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750579, "uuid": "63520e0e-7819-40b4-b57d-6d510813073c", "value": 696368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750579, "uuid": "355990c6-805a-4265-9c17-6ff38a6391fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750579, "uuid": "ad2688ab-131d-4294-99fe-54a4838f84e2", "value": "8ba0b1b8226c3df5526fc339f0f5b70f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f34016-cc26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651722603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722603, "uuid": "6db9a95c-e82f-4e13-822e-77325a0224e7", "comment": "Malware payload (Mirai)", "value": "38872a7ddcc04c8ba5bdc2a76b11c375", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722603, "uuid": "ca8e987e-81cb-436f-a4d3-7a2bc1b43f4b", "comment": "Malware payload (Mirai)", "value": "96ebc4f79c681f746d44c74d17429dcd70e8523829fb74877d0afdf6d499e791", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722603, "uuid": "3a2a67f2-3318-4d3c-9793-010ff5003e18", "comment": "Malware payload (Mirai)", "value": "aad8050cffa4162a3dcfdd51dbc62551c893c547", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722603, "uuid": "f8b67115-5da7-4160-bb6d-31d6ac88c56c", "comment": "Malware payload (Mirai)", "value": "701b81df292915cbc1139f910176ed072b86b405abffe99b58c4856b44c5d0e47657f8d24b4822e61f9d94bb1b22f952", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722603, "uuid": "620acdd2-cb29-41c5-ada5-4472944ff3aa", "value": "T17C532AC8A0D3E8F5EC14097D307AAB629E73F13FB176E99BC7E85573A901202D10665D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722603, "uuid": "a31124ea-9d62-4263-ac52-e5f45ef12027", "value": "1536:i5BpWlXJcf4slZQLkAl+tJSWE/4FZh+70EngkMLe:iAXJcf4slZQLkAl+tJSWE/4FX00OdML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651722603, "uuid": "b9218b5d-8c5e-4f62-8e95-7bd2033e96e1", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651722603, "uuid": "c09963f9-39ce-4f00-b33a-41771eff7cab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722603, "uuid": "db02753e-b954-4cae-b7d9-897e04a30322", "value": "pandora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63036bb9-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651746630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746630, "uuid": "2f39f795-2f53-4781-97a5-31aa7ae456ac", "comment": "Malware payload (Stop)", "value": "689068a91f2b65afb187ceb03d42888f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746630, "uuid": "48693c9a-7fd1-4000-83a6-c7694cfe1c53", "comment": "Malware payload (Stop)", "value": "97406821b7694334a54bb5cc9dce58daf5069f30b93edd135d4b3f1658d8fa01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746630, "uuid": "a691136c-24bd-4aae-acf8-81114b836552", "comment": "Malware payload (Stop)", "value": "246dbe5646f1da12ba31fb8b4cf68e75c0caeae8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746630, "uuid": "7c740508-124c-4e29-9dda-2b494de3b813", "comment": "Malware payload (Stop)", "value": "207c37f1681239595720d08570bbb0d0a444eced4053ce3177f7e4130e275d263eae610f4c29c2d4d518a17bd3e60567", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746630, "uuid": "ea80fb95-06c2-4e04-9a0b-964419bd7f0f", "value": "T184050110ABA0D039F4B755F51A76C3ACB92E7EB18B2050CB57D42AEE16346E4EC7170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746630, "uuid": "39b4e57c-4060-4b6b-9bc6-a3b87892a501", "value": "102925d1127f9c0032b267954e8e052b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746630, "uuid": "2d880cbc-e570-4238-ab12-3393c0ed4fea", "value": "12288:zHqrV04IidvSdqYXLqTluEPS+002qx5ehIWtLr3pHnsUZSSIJfk:GZzwdqFlFPS1YcLzps4SD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746630, "uuid": "b4f588bc-d484-4b64-9aa7-77db0c986021", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746630, "uuid": "ae2d7745-df38-4262-94f9-55bceee71e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746630, "uuid": "d924fbcf-33bb-4f48-8d01-9bfb92dc949d", "value": "689068a91f2b65afb187ceb03d42888f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "530e594a-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651745744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745744, "uuid": "cbeadbc0-c05c-4d74-ba4e-90032ff5c360", "comment": "Malware payload (SnakeKeylogger)", "value": "68440dc7458940694aaca4e97dc7a667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745744, "uuid": "ae20e586-4e1e-471c-992d-4f1de0591082", "comment": "Malware payload (SnakeKeylogger)", "value": "98a4fcbcdbdfd38d6c4ae1f1d4890509e5699edcde3dd927a76f7da3736f9eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745744, "uuid": "98a3499a-bff3-4eb2-bd6c-c47cb76a574f", "comment": "Malware payload (SnakeKeylogger)", "value": "5cf20319589bbdd66d1e34dc13edbfb377bb8b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745744, "uuid": "c8c8451c-f4ec-48ac-8682-4fa160f35c6b", "comment": "Malware payload (SnakeKeylogger)", "value": "6870a5ee448c6e4f15a6a67014e10afd70a64baf5fcc283c6c4d838a2cd3edca4b397d5626ab3427224b3277b8acd97d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745744, "uuid": "85de92f7-3663-43e9-a793-d89175a74ca3", "value": "T140D41201177AC323E2B07BF94A9510C237F12E95F076DA9AAED262DC449BF170B45B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745744, "uuid": "ee04b149-e758-4db6-8b1b-eee5bc4e316d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745744, "uuid": "7b37f462-d264-4930-9e76-8c20569e318e", "value": "12288:aukzEUhIyLrp9VDTUhy+MqY4EGDCls3klD8IJA2L2I:a7IUhIyLriheQEGFU98IJA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745744, "uuid": "05c9d9e0-c6c1-4217-a0a8-3c79da49b835", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745744, "uuid": "a98767f6-8494-4d33-abfc-ed14024f1a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745744, "uuid": "1f2d6b34-da07-4e09-bdea-1be8d111a9fd", "value": "119550,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cd153a-cc79-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651758180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758180, "uuid": "9724c5ce-f251-45c4-a040-17f1502a0f24", "comment": "Malware payload (AgentTesla)", "value": "2c885b853f7c7feac1a51d2713692cde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758180, "uuid": "604f7fdf-8144-4e64-a9cc-7cf484a7bd8b", "comment": "Malware payload (AgentTesla)", "value": "9c3f8541a594e867ef931e23a452958fa4906f8af6f214375ea627f3659abfc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758180, "uuid": "5cb29cf3-7e1f-40a3-8cc1-94e0e96a9138", "comment": "Malware payload (AgentTesla)", "value": "51a064a4fb7de11ab2ba2dd575da52ace3d78ec4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758180, "uuid": "be456730-29a4-4f4c-9e1f-ca354863ea17", "comment": "Malware payload (AgentTesla)", "value": "98dd8ea0aa376a40e2f29b8379be38fdffb9be71e36750759cbacc69d173552b5123e798ab397dbf7c89a09b98677caf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758180, "uuid": "e5b913f1-da19-4ec6-8b63-1873ec1039dc", "value": "T1A30501076FF596E7CD622FB6B7B042F853320F1A7971E29525D022B83562B274A03727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758180, "uuid": "ef16d343-90c2-4f1e-b480-04a47d58c501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758180, "uuid": "097efb25-a7c7-4175-aa48-3f6711f8919a", "value": "12288:H0XPL/7ZK6aA6njdjxPWVh3AfG9LTX6/rBW0k6MQ/FJbgik2L2IAV:6A69EPWiML76zBW0kY/Dbgb2GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651758180, "uuid": "3577506b-1c9c-4a86-b323-4a9ffedb23a2", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651758180, "uuid": "5d3d7098-63c6-4c49-86e9-bc1104054fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758180, "uuid": "d4cf3de9-c167-430e-9a72-01535c2401e0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11666.18426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f650e616-cca9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651779089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779089, "uuid": "ad2df410-45f9-4cdc-8ad3-39036457dcee", "comment": "Malware payload (AveMariaRAT)", "value": "f4f3f3f6a1fe9ec4ced6e413edd9c3dd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779089, "uuid": "6439fcc5-d93d-4007-8ea7-3f766fff21e8", "comment": "Malware payload (AveMariaRAT)", "value": "9d9dd9114b6bf74d7c3b82820c1251e5c379cb1ae8f7b4b4e5be0443ec6f8492", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779089, "uuid": "2542b64f-0416-4ff9-9bab-fd5eac31858d", "comment": "Malware payload (AveMariaRAT)", "value": "b6e62cfa3ccd547b7624747db7906d06342102e1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651779089, "uuid": "5a411727-06a4-4886-969b-1df69ae43150", "comment": "Malware payload (AveMariaRAT)", "value": "e329859489953edd25f1cbcf464ba9c9fd4e1d0e08e8993d3c734e25de951f37cf6b2809cfcca828941c2e04b0aff04e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779089, "uuid": "aad25e9e-ad13-4adf-8d59-56745ec6cf5f", "value": "T160B4CF9D726072EFC857E072DEA81CA4EA51797B831F5113A42712EDDA4C88BCF185F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779089, "uuid": "7f47d955-fd1f-4bc9-9f51-ada7f77eaf61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779089, "uuid": "50de7820-660d-4324-8b95-af0bc6bb78b0", "value": "12288:VbXv6olBG6sirChkIdot4tU+PgfolL+FVbUiFEoaWhv2L2I:VzWxayTPgQliIcHfhv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651779089, "uuid": "a6672b05-e025-49d8-94ee-dc052dc334c6", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651779089, "uuid": "c39ba969-865c-4962-8c06-4949d71bbc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651779089, "uuid": "e6231831-ec32-435e-85b7-73c9c7e7a0b3", "value": "PRO-AWMCP6022-ESN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0a6504-cc0d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Kutaki)", "timestamp": 1651711993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711993, "uuid": "2493f1de-6cca-40fd-ae2a-670dbd95ebcd", "comment": "Malware payload (Kutaki)", "value": "b601b457acbbae7a489b331f46fd6032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711993, "uuid": "d458887f-f2f9-47e8-9877-94f7204772bd", "comment": "Malware payload (Kutaki)", "value": "9eb3c2eecc4f7c57c124e9d8514cf45577ad229c4a25e1120da16aaffa2be45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711993, "uuid": "dea29b3d-41ee-4108-8351-f762da50f3d5", "comment": "Malware payload (Kutaki)", "value": "8c205fa4750d3b787c2466bd7ae606b74bcb8ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711993, "uuid": "69827ecf-eace-4245-9d5a-80b3c59c3b4f", "comment": "Malware payload (Kutaki)", "value": "87940152f81f7f3ea7a65be1568474522b3141321a9936b97a3cff13ecc22f608c86b92608ed53c2a797df45b1c2cd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711993, "uuid": "c532fe5d-f38a-4944-bf1e-9d77042d49a5", "value": "T122068CD6CFBC5495EAE2D73119B030788E362D60AC7DA54D3B1D3A58DB32AC12CE1B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711993, "uuid": "14b05280-146d-431f-bd47-c4e9652e0c5e", "value": "1e09e5c96c9f123a17057e767175e55e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711993, "uuid": "f385e28d-0c22-4b1f-9924-7313afa60503", "value": "49152:bfsY2pKG9xsvVc/xjvZNBMOgCTUESfmP/SA8NS:bfsY2pKGxsS/tZNBM34YfmP/SA8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651711993, "uuid": "773effbb-4e2c-4434-8bd4-985f9c1effad", "value": 3977216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651711993, "uuid": "7867e766-85df-4b7c-aedf-becebe26c899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711993, "uuid": "0d07f263-c100-44c7-afe1-6025aacbe5f7", "value": "Trade Details.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dea24c2-cc4a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651737951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737951, "uuid": "4b8c8ee6-928a-445e-b48c-3a7980704562", "comment": "Malware payload", "value": "26bbb10b28f49e3f0802e515b80b433c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737951, "uuid": "966d340b-ed75-4a37-9ea6-92c354e0f696", "comment": "Malware payload", "value": "9eceb9cfa14c5f82cf31bdced380faec9bf35060defe355c066e1acb36ba66ea", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737951, "uuid": "82133dc6-4065-4b66-8df4-7ed41f656d0a", "comment": "Malware payload", "value": "e92586db0d1e1699baba2de748562d11b2177380", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737951, "uuid": "921af33e-296f-4537-84c6-7364e46ec162", "comment": "Malware payload", "value": "16b8d33a24f64bc10dfbbacb475eaa645877624740dab511f42f7221f3df13d4ecd4891c333473838ed8c5f16a563d66", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Ermac", "colour": "#43BC63", "exportable": true, "hide_tag": false }, { "name": "metadroid", "colour": "#412D2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737951, "uuid": "832cdab7-8ce0-40fb-ae38-72670091b9f9", "value": "T142A5F102F7CAA85EE8F7C3364B76466A91124C56C753D7838964713D1DBBAC08F86EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737951, "uuid": "72fded56-6b85-43b5-8536-b49099d23573", "value": "49152:ybKBBbUq0PhXIYr8NdT64fm+OPQOO/AP8bW43:lBBb7gXI28bT2+f33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651737951, "uuid": "ef299bc0-f64a-4290-bd8f-e26d521c1f58", "value": 2087361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651737951, "uuid": "448b0c68-a863-4455-bf51-13be02ae1232", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737951, "uuid": "18017bc2-c898-455b-98ec-291956ffded6", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109fe556-cc70-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651754222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754222, "uuid": "be141e5e-1d63-4370-a76c-d48c51d14748", "comment": "Malware payload (NanoCore)", "value": "e0f7e9b224da7b99dbeb4dea382cc312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754222, "uuid": "2f40dcdd-9fdd-4d3f-81e0-b5bd0bd0161f", "comment": "Malware payload (NanoCore)", "value": "9f4ab7b18e4e6ae87cce8944c87988bb6c76bec7e8c7a98f77b856cf1e970dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754222, "uuid": "74bde14c-ea53-4008-89c9-f6c8462e7ac6", "comment": "Malware payload (NanoCore)", "value": "bcb225341b9fd80cb7ca426c9430d627c8969d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754222, "uuid": "06c84fd0-2078-42ec-8d39-05b4992ad5a8", "comment": "Malware payload (NanoCore)", "value": "e3aff28b1b88ff11209d35f9d82815d711ef7694b7365a7cb5a6d5deef0fc6ab1c130b55ce5bdde2d449b81fedef6f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754222, "uuid": "3d35950b-38f3-421c-91cb-d1bfbb43c27b", "value": "T1CB042F52EBF6EF34CE340A3F8245B3255F2E5E9181F2BD8D344CB1652EB9E01C5446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754222, "uuid": "65d0f84b-b15f-4e70-8d67-ac64d6b71598", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754222, "uuid": "7ffc674c-fad0-45f9-a848-1dc52aae1c99", "value": "768:p9wlVy+EWwBROESgJXtShVm13jytSHPWcjaYT:4TwBPSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651754222, "uuid": "85f74b40-998d-4f9f-b22f-d62b1840e66b", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651754222, "uuid": "bd6d311e-a443-4c3e-9aa1-b5da265db972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754222, "uuid": "ccb4b7fa-dbea-4094-b91c-fd851370d765", "value": "QUOTATION_REQUEST.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ce5885-cc93-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651769292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769292, "uuid": "97c65755-bd84-474d-8e7e-0855c0308a3e", "comment": "Malware payload (AgentTesla)", "value": "c95f9d0b751cb2f3c5b2fea84ea56784", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769292, "uuid": "dbf1a095-0849-47f3-b5d7-930205f79a21", "comment": "Malware payload (AgentTesla)", "value": "9f4dc8e7955c6897f90b07e1076f47566653340f11eb3cb2bda35a3345d3ae48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769292, "uuid": "c49d7f3f-129f-41bb-9fc0-fec7caf9d5bf", "comment": "Malware payload (AgentTesla)", "value": "67b2c9a7c613960ee1e150c84c99848c1b517322", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769292, "uuid": "74efc9bb-f7fa-4c33-9cbb-3a9220da9347", "comment": "Malware payload (AgentTesla)", "value": "009f9aacae3ddd1ba6e286cf20030b2d108087d0db2fa41a7cea3e59f5de6cd2e4f614a91310ce13335e37aad13cabe5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769292, "uuid": "3c1b3a02-f830-4a4a-825a-3bc7ed8675bd", "value": "T172F4E1EC366172EFC853D0729E982CA4BA51747B931B5203E02716EDDA4D88BCF255F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769292, "uuid": "14da5b18-a4e7-4f98-98fb-706b58633339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769292, "uuid": "4560107a-3796-4fdf-a6be-daa0416541cd", "value": "12288:D9TRTTV4ApE+t1/TeiyshV3KcotRiCSKgS4hty7CDN2NCYQBAIEKrRLqKLUsC12N:5bLeNM3KcvAQhty2hVSORjM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769292, "uuid": "513aa62d-a4c0-4787-9336-83a72c8dd96d", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769292, "uuid": "3a214035-910d-49df-879e-bbc648cd1c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769292, "uuid": "12ab787b-8b8a-4452-a26e-45712a362ba5", "value": "Bank Payment & ORDER CONFIRMATION.img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d0bb90-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746787, "uuid": "973e2fe4-a720-4a62-8da0-81dc3042a90f", "comment": "Malware payload (Formbook)", "value": "28c37ccee0f65ee6a15ced2b9ff8c166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746787, "uuid": "5699b4dd-aac2-4f1a-8ddd-a43372745ed4", "comment": "Malware payload (Formbook)", "value": "9f64f18dc5e7990f086489794f46fc8f6a2a436615781130f2ad9f68316e9c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746787, "uuid": "ce40a0ab-c32b-47ec-8286-52763b8a9e5d", "comment": "Malware payload (Formbook)", "value": "195452b57d3f65bb95d59848eb72c9b9f4fe36c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746787, "uuid": "794a5189-905c-4da6-b316-6167266bb751", "comment": "Malware payload (Formbook)", "value": "51985d64910a0dd8d220e93f9a97f0d2199a8a6d1850dabefeda3aa64bfc19ae3e5babf7abc6b21049d101fcdffa9d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746787, "uuid": "2718dc21-0d99-4eaf-b865-92544750e9db", "value": "T189B3C82CAB880E80D7027FB8AF87D524B74F5864936ECD91A407FE66447B211E14BEF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746787, "uuid": "c50e6208-d9b7-43c9-a8b7-f8f46c25f17a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746787, "uuid": "1343bb84-a029-4e40-b455-5c83a4ba8917", "value": "768:bAwCaTV3ZuJgzAZMkQjAq1PROz0eUd0FqT/:5COYe6MkUB1I4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746787, "uuid": "66f791d2-5ae1-4b84-97b5-a10c9b380771", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746787, "uuid": "0a3976f0-8d4d-4c4d-a613-5d68a5d57192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746787, "uuid": "e0633a36-557f-4564-b9b0-55651b74b2b5", "value": "28c37ccee0f65ee6a15ced2b9ff8c166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44e97c2-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718902, "uuid": "b84ab51c-1809-44e3-9079-dbbaad3fabb9", "comment": "Malware payload (Mirai)", "value": "8a0a033ae5a73046a60796ba8d781279", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718902, "uuid": "65e3c8c3-2afc-4c14-b65a-4f82a3ee1f26", "comment": "Malware payload (Mirai)", "value": "9f680f470a7f0f5a0191f21da85c6bf9131f2bd21dc3959eb96e00d33038120e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718902, "uuid": "f5df13c8-f0ec-4473-8037-7da71e089090", "comment": "Malware payload (Mirai)", "value": "12b5458baf645074e057807cd700a5d557b5190f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718902, "uuid": "7bb2ced0-5efc-48e7-92eb-f47bd59a2164", "comment": "Malware payload (Mirai)", "value": "a26cb1912c87873b94d24169b34998a94853824ceda192f2b0e0c567d66941ce2420f52621e7be4bdede728bb007d1dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718902, "uuid": "35a5dac9-2ff6-46cf-8b05-f9db9fe65c0a", "value": "T154D2E1EA96DC8D26D2B01474CE64A981235342B8A37D3227F70147D0F7F750A6DB8AB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718902, "uuid": "a399ba27-5354-4cb6-8223-21b323411a72", "value": "768:aZhabVw++pfiRurFkh6LjH0yistw8dLfls3UozX:aZhabm++cRuFlLj7vFozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718902, "uuid": "c194e91e-6ee7-43d3-b628-e5b5ad65a6f0", "value": 30372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718902, "uuid": "7ce249cc-439b-4be8-a062-a5ffc7c30623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718902, "uuid": "c36a9e9c-ab05-42a8-9a38-319d22ef4946", "value": "8a0a033ae5a73046a60796ba8d781279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878b96ee-cc61-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651747979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747979, "uuid": "3b1ff576-b0cb-40c4-91bc-4e86cb31e1e3", "comment": "Malware payload (AgentTesla)", "value": "e5e0c1821fb6eaf5461d9cd5557462e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747979, "uuid": "494577ef-527a-4624-bfe9-ea73dd8764b4", "comment": "Malware payload (AgentTesla)", "value": "a14407a599cd28b7437b9e6da4673f348493054295530064eb33886de74f8a74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747979, "uuid": "606e4748-fe4b-48c6-89bc-3f31ffc6bee7", "comment": "Malware payload (AgentTesla)", "value": "d715b7158e57d3803d45e288e52084068254e192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747979, "uuid": "e08b9342-727f-426b-95f2-c7d1f309b342", "comment": "Malware payload (AgentTesla)", "value": "3525a74bbe67ef34e94b328df1b1e84c48655c333b815ca867a88bb6d767c335386d89cb9a337757e6107da41ee07134", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747979, "uuid": "f480ffec-7d00-450d-a8f7-d6f497de7a01", "value": "T1C6042052EBB6EF35CE340A3FC245B3255F2E5E9181F2BD8D304DB1642EB9E01C5446AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747979, "uuid": "082d1eca-c7a2-4818-a2b4-a30f28e5f5d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747979, "uuid": "88900ef3-9495-424d-aaa8-fe7281caf17d", "value": "768:7gwhyZm99JDdBROESgJXtShVm13jytSHPWcjaYT:5emlDdBPSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651747979, "uuid": "6acfa239-036f-4ee2-8ef6-1fdc542b1ec4", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651747979, "uuid": "31ec881e-e391-4a87-bf44-96c1c5832b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747979, "uuid": "b8d44ca3-c5ca-4718-8403-d4e6d2c09eaa", "value": "SecuriteInfo.com.W32.AIDetectNet.01.11996.20817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a614427-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651728174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728174, "uuid": "f10ce076-ac42-458b-9688-7e28b7b8a598", "comment": "Malware payload (GuLoader)", "value": "a1c7d730583e66e8c18bf56fa623f19a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728174, "uuid": "c3254a13-3558-4c79-9b98-cfb8a2a59797", "comment": "Malware payload (GuLoader)", "value": "a1aeeb50c7a24aa55712867162e8e9433e67adde9a26a55c602bbfc7a2b974dd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728174, "uuid": "fa0c5f3a-7959-432c-ac93-3f579119fcbc", "comment": "Malware payload (GuLoader)", "value": "91418fcd6a143d0dd4a8b818dad69fdfea63d0a1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728174, "uuid": "6955fa74-31fd-4e20-8ff9-d995fbc59228", "comment": "Malware payload (GuLoader)", "value": "5f19c6b922c5d46585ee00de34027c01cbe2539dd0babbc675d7fb59fc44152503d3f0f75b3237f4301e6f8e0e5de295", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728174, "uuid": "1526de11-0dcf-4265-bf63-f9d73d67aaf8", "value": "T1D144D82BC2826E7401502878F8649673C69FC754DDB88AD5F6D38863A3CBE15EE51CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728174, "uuid": "1760b5ce-cd24-437d-a140-d0535a9aa9fb", "value": "3072:U3Nk0MNFGY272n3ly2ZogLFqi3Xo9oAmR3tiKjqX7sjKiyP5:UW7NJ6wY2Zo+FqiI9oAgdjqXAjKN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728174, "uuid": "b19d56dc-2a32-48b3-9d6a-93f204655ea1", "value": 253766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728174, "uuid": "04699526-23c9-4fa4-af1e-de2655b50cc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728174, "uuid": "00ac7769-aa96-469d-b637-80df2c1c2018", "value": "IMG-0985443WA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5085b5b3-cc78-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651757766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757766, "uuid": "7d87f4bc-7c5a-40f1-a112-fe08a1774cd6", "comment": "Malware payload", "value": "c2041aded21f77618e9cf7acfa693e7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757766, "uuid": "a2d3f4e3-1b8b-4818-9003-9584aab9e01c", "comment": "Malware payload", "value": "a1f44aec9d23ab604e455b1d2e7700e0cf94458f02ce02bed47ebf5f556e13a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757766, "uuid": "0dbd3e77-4eaf-41a8-8ed5-195b9485d8d9", "comment": "Malware payload", "value": "e6788ee9a4cb8e09b7a3e49d801efdbe5d6b9a0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757766, "uuid": "364e37cc-962a-42de-86e6-77d6bdf52019", "comment": "Malware payload", "value": "b5c61494eb4ee4e9d95a1f9b89d879521c7af3bcd038111de61b6428c9fdabad881f4fbb5ee8d09e070bd81723099f75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757766, "uuid": "5c80749d-59bb-4baa-8f7c-8a4132dcc94e", "value": "T1F4442388F29110835489A2129F848E1896DC39F365585BCD2D79C72BC75BBE0A0D7F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757766, "uuid": "f84b2f35-ae54-4426-9b36-991fd0dbb251", "value": "6144:JnawrJDnNFfBCNn4/ZWlIHvvnLiYcNIrnZbnp3ytHzn5:1ayJDn7JQrIH7iYcNgZ9C55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757766, "uuid": "be967188-d06b-4318-b207-b13ee1996c3a", "value": 256064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757766, "uuid": "d1f00e37-0d72-431d-9d15-6228e1c831a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757766, "uuid": "9987608e-7027-4312-94cf-8f7a9a1e1814", "value": "Payment Slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59eb3faa-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (MassLogger)", "timestamp": 1651745755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745755, "uuid": "e3eaea4d-2887-45dd-be56-9536bbf1594f", "comment": "Malware payload (MassLogger)", "value": "e1ebb944dc096898221edb776322b5b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745755, "uuid": "3d98d09b-100b-44fd-949f-72a948cf6b1d", "comment": "Malware payload (MassLogger)", "value": "a3e03b14952892c47905fc23fa009c3ba80c9ea3e53516fca5def4e71db51463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745755, "uuid": "44fb5db1-b7ad-4cf8-88b3-9093619b4981", "comment": "Malware payload (MassLogger)", "value": "78e89235b455d66c3beee851e9530452b60e9558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745755, "uuid": "d0734c7c-aded-41cb-88b7-a321c31a3e6a", "comment": "Malware payload (MassLogger)", "value": "d66bf3df482b488927de3e2972b4e91834d830a1abae3768bfe0f23c49ee19ec3bbebdbcf5d3a6c80b800633a925bc4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745755, "uuid": "3feb9d1b-d49e-4301-9907-fe5146daf86c", "value": "T1D9F4F1D2F11042D9EC6A1732286B1CA219932DBEE5F5D11D71FA36223BF72A3401E95F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745755, "uuid": "717943b8-0809-4e77-af14-27ee67b590e6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745755, "uuid": "a5064fa4-2cda-4289-9f2e-727ca691fa92", "value": "12288:VNDW0tRezfNx/GVJNR8srKef982/2SSH/bkHu1yTJ5HHgD:VNRtGfNxm6s3VHSfiu1yTHHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745755, "uuid": "81d95ee9-5bf6-4f2d-88cb-c50d3bdff339", "value": 770548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745755, "uuid": "f06daedf-9b46-4e00-9454-dd63540031b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745755, "uuid": "dcca9185-90e4-45c9-82c9-1cdbdc55b124", "value": "200009876543456789-98765432340088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a250d88a-cc60-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651747595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747595, "uuid": "47bdc20e-9c4c-4d6c-ad13-199609591486", "comment": "Malware payload (DCRat)", "value": "a958bca004dcc7edf8310150ef02512b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747595, "uuid": "dc3fca36-99fd-41a4-844a-74a1904d1276", "comment": "Malware payload (DCRat)", "value": "a3f1615bd60b684da869e6b08295b273bd7698f63aa24ffb86d2ce24e03496bf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747595, "uuid": "9a1d3262-699b-4fed-92d5-e1c6de60c643", "comment": "Malware payload (DCRat)", "value": "6f853ea253498f97e1ade601e0abd831d404d7b1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747595, "uuid": "0074a6c0-6022-441a-a392-5f9330178ea9", "comment": "Malware payload (DCRat)", "value": "07490a58a31b00b8a1fa54c3281c5f95575d6fd022ce75eb681548f570b3de654be5df7206340bfa1456bf2237c5c75e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747595, "uuid": "f7d49eac-69c3-41a8-9c20-f5b84228f464", "value": "T16BA593342DEA9029F173AF798AE439E6DA2FBE733707545E00A123864723A41DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747595, "uuid": "0ec60625-da40-475e-bb49-d3ccf268fa4e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747595, "uuid": "bcbd7d84-d684-4653-9ebd-0001b7615527", "value": "24576:P2G/nvxW3WA0oNGspS3fJXZmdFm3/0x/OmPgyhwlYIHKaYmosqY:PbA3QOGsusU1ykvhrqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651747595, "uuid": "5ca0285a-b733-4b06-a005-66fb04704d2d", "value": 2161897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651747595, "uuid": "b781f2b8-703a-493a-87c9-1a159865e44f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747595, "uuid": "e7f2474a-1daa-4de4-959a-cecf0f31ecc9", "value": "a958bca004dcc7edf8310150ef02512b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499c0cb8-cca5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651777081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777081, "uuid": "4fc29774-656c-4215-b877-f7d8c2c248d0", "comment": "Malware payload (Mirai)", "value": "fa1d6127a8dc3d46e2343f81fb4b331b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777081, "uuid": "be940995-0907-4d93-9b65-2500d84a5930", "comment": "Malware payload (Mirai)", "value": "a4fad4d82966256d21a01e78026c0d00f4ee2db9f532fd77cbbaf1bcbbd7a587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777081, "uuid": "c77a1ef5-412c-4e5d-bffa-12213b765ebd", "comment": "Malware payload (Mirai)", "value": "0462511fa7372bc9d1f60a861e825c22ff464156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777081, "uuid": "721e29ca-84fa-40f3-b367-b1e00f0ee11e", "comment": "Malware payload (Mirai)", "value": "5fb2fca0189cb09083e38ac65d8a0dcd26d052c7ced517d0c29a2aec1b6ae74840136f94a5e59a67255602eb6d41d58d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651777081, "uuid": "a0f55b40-176d-4e12-bf7b-2d2dc8ea8313", "value": "T124B2E155C2195EF2CBFF8D3419A243E073A90F9E4731CCA2F2D2DF239256C6A41949D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651777081, "uuid": "a207db04-2ef0-48f9-bcf8-a68168163cca", "value": "384:Bn+fhb79/cRN66PJEFpB5/aWKgZqAkjCjnHkrygv4p67MstxpCVm8M4uVcqgw05C:wfht0X6oErB5/aUZqAIsnEpXimj4uVcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651777081, "uuid": "1d9c3663-26dd-42fd-907f-cd3a6e9181b1", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651777081, "uuid": "06a9c212-a6e1-49ac-8343-a1bc750cb60b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651777081, "uuid": "21e746ab-af3d-40c7-8bb2-28ed3e7794c5", "value": "fa1d6127a8dc3d46e2343f81fb4b331b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908f84a7-ccb3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651783213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651783213, "uuid": "998e1b28-ac08-46e0-9bb7-cd6c79785148", "comment": "Malware payload", "value": "98b6b7b2846555b674409f040430ec72", "object_relation": "md5", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651783213, "uuid": "1754988a-61a0-428c-a06d-73ce53a1f512", "comment": "Malware payload", "value": "a5c87433df7f9a01cd7140d0882e6f227c62076b14d92f6fd9ab3e0570b596ee", "object_relation": "sha256", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651783213, "uuid": "aa39877a-fa4f-4d73-b706-37c73bca7969", "comment": "Malware payload", "value": "fc83deca0cf7448ea1e4d6bd14a28f1c37690adc", "object_relation": "sha1", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651783213, "uuid": "7f81399d-d8c7-4c18-b9c1-82316c21b50d", "comment": "Malware payload", "value": "ad5f9c9346afc380251bbd282a1bee1044b8832832e7c9e0fc4ac1cbe042a3dbcd80a20125188e41204194bdaaae05e2", "object_relation": "sha3-384", "Tag": [ { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651783213, "uuid": "94d0e8c4-464a-4834-b935-e813cf334cd2", "value": "T104F533CADC616817045BF12C6FA3C49534A391CEEA78A8D98C04F8241B7F63ED57B399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651783213, "uuid": "cff9caca-cfc2-401e-84d4-f36442ee31dd", "value": "98304:9TcvBocMVE/Xm9GJR+zTONmBZNgS/+U1xXYOIsHVsNd:FcAVqOG6ziNMZ2U1xX12d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651783213, "uuid": "2aa04cf9-5992-45f8-a722-d8e05ebdd231", "value": 3343737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651783213, "uuid": "e6a6acaf-cc68-4322-ab9a-7abadd90b772", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651783213, "uuid": "1f860db7-a8f7-4b51-aef1-2b959368f7c2", "value": "Main_Setup_Pass_1234.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636d7d86-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746201, "uuid": "a16d680c-8e44-40cc-8f09-dd00d6440a2c", "comment": "Malware payload", "value": "3dc8444189c11fddae1f26926cacd0dd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746201, "uuid": "7ce20dc7-358a-4dbb-b053-16e6f777d658", "comment": "Malware payload", "value": "a6e5ffe0bcb8d584960818dc3e0c043ea63ef8ba30e436b24a7d199a9f0e971f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746201, "uuid": "72492b34-3b4d-4741-9a4b-7c517ab6801e", "comment": "Malware payload", "value": "4bddc6bb44e7ad7e8fca395945d5c65493f8459a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746201, "uuid": "35101e06-08a0-432a-a973-567384fe7456", "comment": "Malware payload", "value": "54c69815092d9d1800b905d9fbc168489e42f7f3817cd6762d04d0f24a817e7750aa5cb2b4633bc3a18b92e0138c10b0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746201, "uuid": "d2eef4e6-f7ec-4d6b-822c-19bbb0a96d18", "value": "T12D22DA1677E9C739D5325777CEF78600437CBA85A863DF6D38C8360A9D227900693AE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746201, "uuid": "50df3399-c681-4456-a10d-3d9b25100217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746201, "uuid": "2b3401f9-a3f1-4781-930a-aaba74eb6a04", "value": "192:8tP22srJy9ctcG88EAzskKajRT7Y/YXscTBl5Oi9yC:8tP22sFy6tv8FeMajtvsc/5Oi9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746201, "uuid": "d33c3d4e-214f-4b7c-8798-faf64a27ca43", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746201, "uuid": "6863c405-9ebd-4d2b-9274-5ee993aabdc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746201, "uuid": "3c8212e7-c0b7-408c-af63-b03513bbe10e", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fabdf4-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718930, "uuid": "1823b6a0-e434-446d-894e-28e600eaa49e", "comment": "Malware payload (Mirai)", "value": "692b6d7287cf39b5f14fafa2faf19d4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718930, "uuid": "bbee4b84-d3b9-4c61-b499-2d321972e991", "comment": "Malware payload (Mirai)", "value": "a6e85564686531bf2c91d6e280ed98f3a801a4d328dd689f501bad1c7b555858", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718930, "uuid": "96402de3-8686-4728-9597-4c51edac0bac", "comment": "Malware payload (Mirai)", "value": "ab565c33a7a85d743f21361794baf1d2d041c56f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718930, "uuid": "6c78df48-c855-47a5-bef8-d7737ef94c44", "comment": "Malware payload (Mirai)", "value": "da04a4aeb849d4b918a9d850ffb4071c6884b5c3db68f2374d9c3513f601c5262366abde6765e548a96067408c0d4aa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718930, "uuid": "913a325c-6754-4aff-bf86-567d7d32dc65", "value": "T1F833F17BF36A2510BFF154B99F98E93312E801BDE3C671235364AB5987D320A087E15B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718930, "uuid": "44a7dce0-1617-433c-9e56-e8ad333349c2", "value": "1536:3EAvf9wLnXTlrly6XOwcea90mLP9MP3bxGc+Yc:3z1wLnJBXOQaqmLAb/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718930, "uuid": "48fea749-2ef8-4ed2-ac8b-b70570a345a4", "value": 54248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718930, "uuid": "5c6bc8cb-be42-4d2a-b448-25f28512492b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718930, "uuid": "abba9b72-9b49-4320-b8bf-59385a7512a4", "value": "692b6d7287cf39b5f14fafa2faf19d4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414c2dd4-cca5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651777067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777067, "uuid": "4ea38b89-d529-4142-a7f1-7b352270d006", "comment": "Malware payload (Mirai)", "value": "923dc61370a1716c859de893759ad655", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777067, "uuid": "154944e7-5752-4dee-b146-298ab3953b09", "comment": "Malware payload (Mirai)", "value": "a73d0066dbc7a90f86db08f5674415b7f572d785b781b604ae034e57779b727b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777067, "uuid": "d45c41bd-6863-4de3-9a0a-8ccd217582b3", "comment": "Malware payload (Mirai)", "value": "3c346e2120136d691e878695a9416102c5acfd60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651777067, "uuid": "9830eafe-f40c-4382-ba24-9e51436ae3ae", "comment": "Malware payload (Mirai)", "value": "056d29c1faad5589d94c63499bc68d521d2566936da789007da5b8b9a50ad6540fea106691ace80c2a4557f3a5f2fe85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651777067, "uuid": "af585f23-d1aa-40b0-85b4-27ed161cae20", "value": "T188431925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651777067, "uuid": "93e23c29-8fcf-4bfa-b812-ed29dbd52bb3", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDd:eL0AxvSHfymp0xgunvCkV6vTMDauS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651777067, "uuid": "f3a75202-479a-4dbb-8b6b-55f9df45db73", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651777067, "uuid": "774b87b4-8c0e-4db4-b9fb-74169ce8b131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651777067, "uuid": "919e10f0-f608-41e9-b92a-74c6867fbfd6", "value": "923dc61370a1716c859de893759ad655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76baa239-cc71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651754823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754823, "uuid": "a03c7705-47ea-4f18-a7e5-b301a3a7d0a0", "comment": "Malware payload (Quakbot)", "value": "a8b25d3401de11ea141970e0029d01a7", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754823, "uuid": "d08881a2-b4df-4310-af9b-f339980e5fa4", "comment": "Malware payload (Quakbot)", "value": "a77395f6c072ba062dcaf5935e9c67ff5384fabfb5855ebd4fd810fce5644180", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754823, "uuid": "34a411c9-4277-4e3f-9101-345949307410", "comment": "Malware payload (Quakbot)", "value": "a22cd593e467c7202e78b67416d7396605bf19a6", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754823, "uuid": "0c5a9bd5-e507-4ebe-a5c6-29cf62f4fee2", "comment": "Malware payload (Quakbot)", "value": "2c359d2e798640fdcf408b76bb5a75f9055437ff1f21f55eef30376933917a661eb8cf879502afbe9bea0c96f063ea32", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754823, "uuid": "71378139-d525-49fa-85ff-b3ad2292fe1e", "value": "T18434E01A6169A079D5ED677039111942C0EF302BE956FC259F4287FA3F832B74E2D3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754823, "uuid": "5d14566d-707c-41c3-aa0f-0c3d247957f4", "value": "6144://sXnHaBFeZeUr94jYSJ19FFDA2P94f+mt8Fu2://GHaB0XSjYS79Q+HFu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651754823, "uuid": "fda187ff-51da-427e-83c7-90b204f958b0", "value": 245903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651754823, "uuid": "2eafc7ff-1146-4014-a47c-d8597655935f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754823, "uuid": "ccf242c9-01ac-402e-85a4-8b63c1c11d1c", "value": "ihod_255357117.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8413d1ed-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651746256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746256, "uuid": "8db8e696-9512-46ba-b468-d81aed97ac85", "comment": "Malware payload (AgentTesla)", "value": "f3bc1ed2b2956cca52aff8ada8d69b2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746256, "uuid": "b015b2d7-c269-4790-9f98-a27bce9fc79a", "comment": "Malware payload (AgentTesla)", "value": "ab0e0c4e85b9050fcd075ae12b5ed229abfdb9286d35292e30661e442b6de7f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746256, "uuid": "d5c46853-d3ed-435e-8286-7f8dfd2eb0dd", "comment": "Malware payload (AgentTesla)", "value": "3bc53ecec27244b188e6a9ec4b2b40a1ef76d0be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746256, "uuid": "32dc026f-905b-421e-8537-dc19b047b5e3", "comment": "Malware payload (AgentTesla)", "value": "999edee9e30d1c258634751fae2f77b18057d6ec409b12902073d064293101559278c03aafea5c3d625efd944ac3e0ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746256, "uuid": "8256c982-6f09-4cdd-812c-0de342fd06c4", "value": "T18E84DF50738E6F76F7EF0B74E3E062A84B34802715CAE74F948118F9AC407EAD65265B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746256, "uuid": "5bea5ecc-25ad-4702-9132-5da7cc814913", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746256, "uuid": "a6cba6e7-235b-4408-bae2-8a999189cb87", "value": "6144:TMDiFuzew4QxI7tc0rrerawEBWSxtrj4oLZwyLD2BI1wp9:YiFP7R+ra/sSxt/LZwyX1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746256, "uuid": "5b74621d-7906-452d-bd78-8df53199f502", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746256, "uuid": "c48ae2e1-b572-4c78-99a0-00b01f6065b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746256, "uuid": "dfb26fb6-c3bd-4f09-b80f-41c5e05458bd", "value": "66BC44TUbb DHL Posta Documentation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5bc89a-cc78-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651757973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757973, "uuid": "d288563c-566d-466a-bb3c-e8d8d44dcaf8", "comment": "Malware payload (SnakeKeylogger)", "value": "69830eb8ef84739d5ae1e8275672d064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757973, "uuid": "f6935ea4-b807-495d-ba75-4c05e77c78df", "comment": "Malware payload (SnakeKeylogger)", "value": "ab6d956bc8537fc2088401d7193445e4dfa4ee35024e1d19c13f2200511d9481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757973, "uuid": "8f2bc9e8-2d22-4e87-b185-91c4f488e0b5", "comment": "Malware payload (SnakeKeylogger)", "value": "7f3f7afcc090c3cd824b4d1ade07c246390e2577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757973, "uuid": "f35cfb33-e265-4463-aca0-1fc9cc3a59e2", "comment": "Malware payload (SnakeKeylogger)", "value": "c92201bb7cbd3dffd061fa73da7ced5465d1fcd1a583a414aa50634834c1288a571a5ab3502464d9018edec30673c8fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757973, "uuid": "9d136fee-4995-40de-b1a9-1b4cfb8f490f", "value": "T16DD408AC326C31DEC957C972DAA81C64EA6074BF7B1B9107902715AD9D0EB97DF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757973, "uuid": "0323b7fd-60ff-408b-8c51-34200003e709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757973, "uuid": "9d59c9f5-f4fb-45c8-8e7e-2a82783ad2ea", "value": "12288:XFWKV3CRNj/8ExhJoc3ZA32iNnc13XYTajREJO7LbSV5S+qQ7eJd4StjkilL+PQ:XoKV3Kj/1x431RcNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757973, "uuid": "bfbe9ee9-683a-41d4-8515-3ae44f161f99", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757973, "uuid": "84e6ea6f-051b-4778-993c-503ac8ed7e94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757973, "uuid": "c7f056ed-ab00-4152-ab20-d397336d553a", "value": "SHIPMENT DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83186550-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651728215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728215, "uuid": "edddc875-439d-403f-9daf-61bfa96a10a0", "comment": "Malware payload", "value": "baa53d60a3571cd26ab3f2d57862809e", "object_relation": "md5", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728215, "uuid": "68766121-17f8-4ea8-b1ac-946d843085b4", "comment": "Malware payload", "value": "ac257146ada3db7bf64f3493bde332c50b99ef90825ac37699fc0562b61d6a78", "object_relation": "sha256", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728215, "uuid": "379d0f7c-e1e1-41fd-9737-5147ed772cd1", "comment": "Malware payload", "value": "cf6a090d8f579e50728ad8db314f7cda4ac88be5", "object_relation": "sha1", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728215, "uuid": "00143a5e-2e0f-43a4-ba4e-fbadbbdf297c", "comment": "Malware payload", "value": "aff0285bdc2e6fcedc88f166be3fe26f0168f007ad73c339ee3e808b9da05aa8a5739e163a79c4ce3d614e79d676404f", "object_relation": "sha3-384", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728215, "uuid": "49fd2ff8-b792-4015-9f63-fd19dbe92878", "value": "T19AD19490B6A7E5DC06D632F4E13FF6CCA410812B412AC944B5DCD9CAAF490A6C3F57AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728215, "uuid": "918ca3cf-374a-49c9-bacb-38c7a80cb068", "value": "192:LYcCB2/S0v236liGv0u6wi26l37pqqt9R9vKe/V7xxK52wedPufLnAuLf:rFew8p3dqcLJ40yVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728215, "uuid": "41633322-c8c9-418b-af95-60df028e9043", "value": 6329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728215, "uuid": "60c4b9b9-9d2c-458a-a593-c0aff812d6a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728215, "uuid": "2ebec026-4463-4171-af66-3f16284dafc5", "value": "lazy.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0286a041-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651727999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727999, "uuid": "496f8176-57b9-4498-8273-93e10af08602", "comment": "Malware payload", "value": "20e9e2e20425f5b89106f6bbace5381d", "object_relation": "md5", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727999, "uuid": "f67da599-ec65-4af5-a240-bd13ebc7adc8", "comment": "Malware payload", "value": "ad21daa38d2105a4709717d1efffaee94796641111f74c9658f6b2587c2ef03e", "object_relation": "sha256", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727999, "uuid": "e5128759-2896-4606-b2ad-6a291d9f8963", "comment": "Malware payload", "value": "698d0472b07b3495efc734afc4617bb53beb8e79", "object_relation": "sha1", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727999, "uuid": "db9835a2-ab7f-4ed3-a9cc-ed86468fe674", "comment": "Malware payload", "value": "da1b77883891510a6a92da876e9f7469b63ef701c74a10c9323a14eb8769280227f5aef047b50495360531945084ac65", "object_relation": "sha3-384", "Tag": [ { "name": "LazyScripter", "colour": "#6D8205", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727999, "uuid": "3d3d7adc-9564-4567-9968-5c40698c5ff4", "value": "T12133279ADDB68ED047500F6E16633E63CA3E3A4844BE85988FF75D0C43682D1992F727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727999, "uuid": "4cf40141-c422-4bb2-8542-2ee678b144db", "value": "1536:lL5Jy27rRSlpx7rRSLPHxpx7rRSLdxpx7rRS9AqoWwpx7rRSVXKwiAxpx7rRSVXc:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727999, "uuid": "5db9c3cd-5c8a-465b-b1e4-b43b1363d2f9", "value": 52739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727999, "uuid": "ed2e42d3-eacd-4f17-b4a6-b28aff790c9e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727999, "uuid": "7339d856-d6a5-4a1f-b389-dd385f0b8c63", "value": "SecurityDsp.bat.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e07e69-ccb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651784110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784110, "uuid": "f5cc58be-3d52-42f5-8a03-244a3f978dc0", "comment": "Malware payload (AgentTesla)", "value": "6631a01942a28fc0507a84c854310df8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784110, "uuid": "e669c8bc-8232-4c21-b98d-1f7b3f7527b2", "comment": "Malware payload (AgentTesla)", "value": "ae711943280a10e5296a2cf63302dbf4cfbec2cd1969346a9ced66085459f22c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784110, "uuid": "19050744-bb1e-49af-b19b-c3d3d00408b8", "comment": "Malware payload (AgentTesla)", "value": "fc2075746a83511aa2e01409b4e8f9420af88625", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651784110, "uuid": "b9936272-d76b-407d-a524-54c2c48e18b6", "comment": "Malware payload (AgentTesla)", "value": "27eb5b1d85f3236d2e3dafefe74846dd8bea267e4506e8f8373532e989077044e582010d98485685b54e631bc60f3158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784110, "uuid": "e40fa1d5-3255-4728-98ee-699bb227deea", "value": "T1C1656D037A9A8B10E8EE3331F754650A1BB5A5D61613C48DAA4D3AA60EF32D35C0F75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784110, "uuid": "00cb47cf-9a25-434f-adb7-e378b547ae59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784110, "uuid": "c1e21b63-adff-491c-828d-37c211e24f25", "value": "24576:sdAKF3zI//5CLMIlAXRZNqqk84BavP6bDK3k9mLX6f1XdshwMtBMeP4V56MoUi0V:s1F3iYmXRZNqqk84BavP6bDK3k9yX6f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651784110, "uuid": "807cc8d1-30db-4465-9b36-0dc296ab95c4", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651784110, "uuid": "331eaea9-ac30-482e-9a02-0669ae663f6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651784110, "uuid": "b8b9dcbb-2603-4fd0-95e7-4492dca2cf3b", "value": "6631a01942a28fc0507a84c854310df8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5189ae-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746165, "uuid": "a7cb94f3-a9f1-4b0c-a493-bca3846903e0", "comment": "Malware payload", "value": "5d8cbc4e0859b67721365d71e0e7ef8e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746165, "uuid": "48ed3d5b-1dbc-4d41-86e7-d683bc1da0ee", "comment": "Malware payload", "value": "ae7594bdac6d85d4c9b9ce565fdd78d2adf0884f2321d1de3d63eeaa5eac3a21", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746165, "uuid": "a3292707-838c-483c-8412-fc3e61162d04", "comment": "Malware payload", "value": "d9e44167e14cdfd9dbc3f868f1c4ff193cb57141", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746165, "uuid": "00dec369-3649-43cc-8533-35bfd1f5b9d1", "comment": "Malware payload", "value": "2e2735e351c7a159b526914c145a9a8bf5dbc23346ea619a13a9bfe0856ed13e3c4b960aada7ce0575480879af42a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746165, "uuid": "c7fb0409-2ccd-45ad-8c58-a9d255b52027", "value": "T1E7241223B078E727D22E0A7535ED7AF948E3DD813E6F91127DA872466131CA3A871C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746165, "uuid": "4a86da6f-5e6d-4d09-9c0d-cf3c5b78ec3f", "value": "6144:oVf/oIuPsRVVsBck7S3TpKuAPKnfbMkXdx1PU3UAqgHI:oVf/oI9RVVuczIuAPWbMUUBXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746165, "uuid": "daf534d4-d26e-4c67-b452-5d845cecd070", "value": 211800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746165, "uuid": "f0f7d561-8fbc-47a1-8b7d-3597c31f8f77", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746165, "uuid": "aed0546b-1d4e-4c91-b47b-d76f7566a55e", "value": "New Project Quotation Inquiry request parts list .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c32d5b-cccd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651794394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794394, "uuid": "80598970-2ac2-4500-8834-c731524566d8", "comment": "Malware payload", "value": "ef81a5eebe0df6080e89a5cd78584b2e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794394, "uuid": "f8add828-ccf3-490b-9022-babd247659c8", "comment": "Malware payload", "value": "aec46545b1662711a7b745f16862399a01e7c2b65c86fbb8a956edf8e2cedacb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794394, "uuid": "66952367-272e-49c3-bd7f-8d831194c562", "comment": "Malware payload", "value": "ac9776887ea1396c8a742062411c2be9878638ab", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794394, "uuid": "83415299-9327-4739-adf3-3696d7727722", "comment": "Malware payload", "value": "b2a1aaa9f7c5b9a0f8be60d658541cd918a0489fda3f1cc61be4d73fb496b5a21d9aa4599ac2ecbdc1159a8b3c275569", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794394, "uuid": "83109fd3-c4e5-4a84-9c8b-9c45e0a0b819", "value": "T1F525331C6AED27BA5CB9E2B1684354291F98D70EC419F1070EFBFC898C65824FA6D391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794394, "uuid": "ba0addfb-8d9e-4799-992e-2e97c6c58a85", "value": "12288:2jf7fHmZ0/XAcjSJekiFXOcFA3rMhUNgFspBD0x7gkvm4QoXjfOPN384WfnbCv/0:Qw2pSJeFOdIhUh66aOV3VebwSvO7of7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794394, "uuid": "a52119f4-d94c-4125-b877-f9daf4a63742", "value": 1036417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794394, "uuid": "87e31280-9823-418d-b96e-f748f73a214a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794394, "uuid": "2ab8b00a-5f70-4fda-bdf8-67fdd480a908", "value": "\u4e0e\u5df2\u5a5a\u4e24\u5b69\u5b50\u7684\u5988\u7684\u5c11\u5987\u5bb6\u4e2d\u72c2\u8279,\u8fd8\u548c\u8001\u516c\u6253\u7535\u8bdd\u8fd8\u5173\u5fc3\u5bb6\u91cc\u5b69\u5b50\u4e56\u4e0d\u4e56.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c53e6c3-cc9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651774536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774536, "uuid": "ea334db0-5285-4e37-a0ec-762dfc2ee312", "comment": "Malware payload (RedLineStealer)", "value": "f5f87cd3188412438a93ff8b9d5856ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774536, "uuid": "3e3e3292-1949-4832-bd0b-44911d274218", "comment": "Malware payload (RedLineStealer)", "value": "af5a06c613c3c0f80530ace573e1f1f70f5cb811c22d3a818096aa9371e64ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774536, "uuid": "4a2511a3-c511-4304-972f-5c81f856b44e", "comment": "Malware payload (RedLineStealer)", "value": "6d516147faac158bb0939c31959b95b019437aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651774536, "uuid": "42b0cba5-be76-42e1-80c3-60a726af048a", "comment": "Malware payload (RedLineStealer)", "value": "38e949d7dda5ab8757c5f1f437d719be9cab80ac39b753c9b38d5ff4178436841ef6cb21dadb6bca0af0870aa29682e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774536, "uuid": "dac9f127-f6ce-4518-b562-725b1d2efc40", "value": "T120449E00BB90C035F1B712F5897AD3A9B93E7DA15B3491CB62D52AEE56346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774536, "uuid": "69a0244d-55ea-4663-a7d8-b954bc04b981", "value": "3b1460c086d18e8083905953059d9e3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774536, "uuid": "ac1f5fe5-c99e-4cde-a77e-84fc63d60d5a", "value": "6144:UcFmwJuUFV/o+DfOzuojitLwxcbUd7v5Mnj6ZBCvnQ/:UAmXQfOCuitLwxcb0q6ZBC/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651774536, "uuid": "f8d9049d-c1c4-491b-b924-9e90ba733b8d", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651774536, "uuid": "24e17a5a-55c4-4332-8071-e572997424b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651774536, "uuid": "3f89fc61-db63-43d2-8539-ecf440df5a6d", "value": "f5f87cd3188412438a93ff8b9d5856ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ee053f-cc95-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651770336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770336, "uuid": "dc15d80c-d87f-48a4-8bcc-becdb7c1bfc0", "comment": "Malware payload (TeamBot)", "value": "61c2c73b47b133abcdb1895d04760e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770336, "uuid": "43dd42f4-c576-4164-aeb2-e1086cedbc3b", "comment": "Malware payload (TeamBot)", "value": "b056f0cc0015f03aca6d9884ef57a9aca014903f72dc0ce46749805f7bfd0985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770336, "uuid": "41dcc9e5-03e5-467a-b98c-583a231a66e6", "comment": "Malware payload (TeamBot)", "value": "124d283b5aef7c64d33c1b320fba70bf235e7564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651770336, "uuid": "4e0e2588-0df9-4b26-b143-12786ac844fa", "comment": "Malware payload (TeamBot)", "value": "1a9053b85d9166508735ab03bd4746d65aaa196eef4c8b1ef18f0192149838502b7ece08232b61f8b6d81dbb962cf8da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770336, "uuid": "6079c2df-f283-434e-a496-a93eb708e288", "value": "T10944AF00BB90C035E1B712F48A7A93A8753DBDA19B3554CB72D52AEE57386E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770336, "uuid": "8ad5868f-42d3-4877-86c5-210242ff9df1", "value": "3b1460c086d18e8083905953059d9e3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770336, "uuid": "f5c37a93-e5de-4a03-83e0-1c18f221ec32", "value": "6144:e92zWUBtKXusqd7wj4BTZUzRbb+Pb7+bL:exWK+jd7wj8ZqbqPn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651770336, "uuid": "ff3ee421-d976-46c7-a195-0f0d906d3e3b", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651770336, "uuid": "34735e4d-b7c3-4fb9-b1b4-f78d9e632ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651770336, "uuid": "c535b8e2-fb35-470b-bd25-afe838fd0302", "value": "61c2c73b47b133abcdb1895d04760e84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c12f094-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651729036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729036, "uuid": "710e0d17-4753-461d-9da0-769bb35c2028", "comment": "Malware payload (Loki)", "value": "7caec61801f4ba17645db4a413b04a0a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729036, "uuid": "5f586d40-33d0-4578-aba3-e9e9dfd7b2c7", "comment": "Malware payload (Loki)", "value": "b0e0a79528bf5c2e8f7e908f0f926e687cfc3dff8138b4610cdaf08034e27877", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729036, "uuid": "952ad670-72d4-4118-973b-51b45134390d", "comment": "Malware payload (Loki)", "value": "be626e66d316e173ca684d88b83be9ec1d405543", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729036, "uuid": "a305ee32-c80f-46e9-b113-94f13239d7ec", "comment": "Malware payload (Loki)", "value": "68702ed4a08b3915f5de8cce8d6c222d6cf5a00fa11b4218a87e1836b054c4340d0cac9bf74bec5b308d1cb7f194bed1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729036, "uuid": "9bda918e-6334-4ff6-aa15-25ba7b306a8a", "value": "T1CB2412A5BA18C326F5A74CF82374ABA80EA6BCD5EB41848EA11C7877703C1C17D65F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729036, "uuid": "fe4c4e08-c8b0-4ae3-a0be-8dd4fea478ca", "value": "3072:uVZfA4cbfMrkzRrBY+1TPG6s0/9Yg8VOROWnVd/rzUtPPUZYQU98a3smMDedjPpJ:WskoRr5NPC0Fcizgt3Uj28v6jPL3fUVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729036, "uuid": "722193b6-4def-40eb-8d9c-195c14b42ad7", "value": 212008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729036, "uuid": "a10f8123-28af-410b-abb8-ea4c34a4a4f8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729036, "uuid": "046c928b-3946-4350-a4c1-e30e1f551199", "value": "PO0975.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c71d26c-cc2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651725144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725144, "uuid": "1d37533b-a907-4b28-bc1a-fd2afbb33a59", "comment": "Malware payload (Loki)", "value": "1af1d66c3471ff80aebf1079be6c9b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725144, "uuid": "51777d7a-9981-4511-9222-519bcd0354a4", "comment": "Malware payload (Loki)", "value": "b2110a378d750fec1151e3cda11fcd9633f2aac8a8899366714b420b44201acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725144, "uuid": "92149825-f21c-4611-bbb4-57ada9f364cf", "comment": "Malware payload (Loki)", "value": "cf9ffd6326c68208f1d0f070521220fff3a46380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725144, "uuid": "71b774c6-523b-440f-a651-f970c06d60a5", "comment": "Malware payload (Loki)", "value": "b3a276626345b2a0496162de644782d4e5f94c47fb0a5960117aec00fdbcbc471db919ff70672e7a0107fa2cd1b58c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725144, "uuid": "f4ec830c-9704-4201-ac30-80ebeea6d9f4", "value": "T17CA4010A7E655A12C26156F5C0F7517903F269CB2272E7D63F8A52C11E413E28ECFBCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725144, "uuid": "d2943af6-16a1-469c-9b16-5ff764bd3fd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725144, "uuid": "7f5eab37-4c20-40dc-8bd8-20118b502ec3", "value": "12288:P4djSOH9jd8c6vca931ZB2Fk0mhySl1q:PcSOHL8cecaXvHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651725144, "uuid": "55dfe43b-26d0-4d85-9770-6cf2c5a3009f", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651725144, "uuid": "e9cf8064-6345-4c60-9283-2ac8cec46ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725144, "uuid": "9689b11c-38c5-49e3-9697-9835649733b0", "value": "SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.21741.18545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98abea2b-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651759605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759605, "uuid": "0289cc5e-3f04-4227-bcca-181002fd06c6", "comment": "Malware payload (Quakbot)", "value": "e0ee98fdde0856216be08666b4b1a602", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759605, "uuid": "578fd8d0-15e0-452d-b085-48b8151667c1", "comment": "Malware payload (Quakbot)", "value": "b2836b4f7e90321048bbd5a6b6d61877efec98631d6357672fff9ff933f88253", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759605, "uuid": "6672ef98-00f8-4e95-8f75-e6a3ad199874", "comment": "Malware payload (Quakbot)", "value": "8aef603c30ac9e8eb6d9b5d19cba109c32288a5b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759605, "uuid": "15c631ba-8f47-4f5b-8701-3b133af85846", "comment": "Malware payload (Quakbot)", "value": "630a6a1ab62295737bd2fe250c59486edb21d68d5208abf080f46277c539c40490305818c126c8b22b9ccc1f2b7e4fa3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759605, "uuid": "66ebe660-6fe8-4aa3-882f-4f6bb409b6d9", "value": "T111F48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759605, "uuid": "a137971d-763c-4c67-848a-d7605dcb22aa", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759605, "uuid": "784be7af-6e62-43da-8edc-e4ea5e4870e2", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPir0Q1acvZRz5Bt:bUzrOKfQUDZCx1RZRdBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759605, "uuid": "346543c9-e0c3-4882-a4fd-8e5b4811876e", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759605, "uuid": "43fb98a9-f19a-4f2c-9070-45ee6510bef9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759605, "uuid": "9626d2b0-1876-405c-92fc-ec6828cdf045", "value": "44686.6703604167.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73680cde-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651733772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733772, "uuid": "fdcb4f5e-bca4-4307-886b-6f64618cb150", "comment": "Malware payload (Stop)", "value": "ebb84a287af9d1d7880f526dbbe37ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733772, "uuid": "c36d4187-8278-4759-8c94-b9ce7fc0e5fb", "comment": "Malware payload (Stop)", "value": "b3c2275f6ab70c724683d9ede98d481d209208033d75a431f65fad8a500c1b85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733772, "uuid": "346229e7-a5a5-43e6-a5fd-43468f612663", "comment": "Malware payload (Stop)", "value": "dff198410434cbd010cb9f7ad3984879e09ff7ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733772, "uuid": "1d24b4bb-d798-4a14-904d-b40817e0ad48", "comment": "Malware payload (Stop)", "value": "2b5abee719c467ed677c6b635b2c2c4cb46c831de3bd02754f98a5facd047b352ba7b3224662034652391a2621b5c169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733772, "uuid": "e8a2def9-b54b-4b32-a3a9-30ffe20d2045", "value": "T13905F100B790E035F2BB25F44979D2A8B93DBDF19B2450CB62D52AEE46346E0EC3175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733772, "uuid": "b6410dc0-8c93-42d6-84ec-619878b8aa67", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733772, "uuid": "34462c45-e680-45bb-9e43-c1e119c71afa", "value": "24576:bVcqTVvdlOFKLeQYbimxyUiADJGDeGMxbFimO:SqvlOMityKDmeGMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733772, "uuid": "65c38a7e-cf6f-4774-b210-028fa6a2c46f", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733772, "uuid": "827c1a9b-159b-49d4-80ec-b81b9a889109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733772, "uuid": "408d0aed-23e5-4fd0-9de8-61f8e4b84084", "value": "ebb84a287af9d1d7880f526dbbe37ddc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88171f6b-cc32-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1651727794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727794, "uuid": "e06ba7fc-8d86-4e63-8bf0-8c250d8ce31f", "comment": "Malware payload (DCRat)", "value": "ba89ad2dea381ff242dcfd761bfae121", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727794, "uuid": "552220ca-1a64-4cd8-918f-32b40d026c52", "comment": "Malware payload (DCRat)", "value": "b483938661c2095fa0e85c704031b81525cad046633095a2adc1f5992db43b0f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727794, "uuid": "03b999ee-f16c-4932-945a-62643a5930be", "comment": "Malware payload (DCRat)", "value": "8bf44c7f4e7e0ecefe28e0133ac8594dfefec3eb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727794, "uuid": "296dae8b-1f8b-4c52-ba48-e111789b7168", "comment": "Malware payload (DCRat)", "value": "f4ce9ceb00a72cffb053851bd40820acac01e63d495eef84d78c89fedd5bb7e1d1079135ec19b34f01f0b98a840c0627", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727794, "uuid": "f5d06d97-6e85-4b01-a909-2c8cd2bc7bc9", "value": "T1CC158B89A95401ADED520F70D733548B95EF5AB379A881F7D2B6FE4F3A20378E121342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727794, "uuid": "e2c45778-7ac2-48e3-8922-db5ed6bb4af0", "value": "32c5de998b5f069b26c94c8143b13c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727794, "uuid": "8eca709f-7327-4fbe-985f-d9c756865264", "value": "24576:FXO5ID07c/0BqGtFpW/g/h75lmHqV2wfxIfeDbaZLetHt:FXMID07c/0BqGtfW/gZmKVffx/2ZLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727794, "uuid": "8aa309ae-f504-471b-8fe3-b7196b1691d1", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727794, "uuid": "49df6d21-225d-44e1-9a84-557ca832f050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727794, "uuid": "0a7207dc-7cd9-4bfe-a490-a4ac753dc2f5", "value": "ba89ad2dea381ff242dcfd761bfae121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8994e90-cc80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651761349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761349, "uuid": "49d5b93e-1dfe-4666-a1b1-794215262e65", "comment": "Malware payload (Quakbot)", "value": "2fbe61ac8593a80c536329b938cbae1f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761349, "uuid": "48fc0ca2-9c61-40d1-8245-5ee40df4af0c", "comment": "Malware payload (Quakbot)", "value": "b660a1f7a7d88cb931721e680c9911a28e83dbc6120eae3cd2875fad107206f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761349, "uuid": "ab59f019-f63f-42ee-a507-258e6d63305f", "comment": "Malware payload (Quakbot)", "value": "7e3f5dc527fd730f582e37a98a698c6993091e56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761349, "uuid": "1900c4e9-b16a-4003-9430-97712f16ae95", "comment": "Malware payload (Quakbot)", "value": "a712a940bca5eb33ceb2adb9374ddec8b9647da38d868ef90935bd989993cfad0087bc9b93d75c3f8a5b3c7b973f197a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761349, "uuid": "1d3be5c7-6c61-47bf-991d-eebe010bfa07", "value": "T193F48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761349, "uuid": "6fcf1ede-f848-402b-a641-9266d2fe38ba", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761349, "uuid": "5068d310-eddd-4d04-a5e7-ebabdb7bc1e1", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPiU0Q1gcvZRz5Bt:bUzrOKfQUDZCG1LZRdBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651761349, "uuid": "69d1ac39-99f4-4b86-8036-f17203a4763f", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651761349, "uuid": "ba797017-2bc1-49c1-9e98-c027678a79b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761349, "uuid": "f2157e2f-d605-448c-91e2-080b73830772", "value": "44686.580625.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa12dfc-cc50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651740603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "d836a4d2-53a8-4f5b-9986-860b3d607c51", "comment": "Malware payload (Mirai)", "value": "6b66d511ab870359d852c1c22dc5bd02", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "7e1f707e-a335-4225-a502-3866c385ea9d", "comment": "Malware payload (Mirai)", "value": "b709da784c86075231421e49b9e37bab4723857395785442b06eeabaf4d8f887", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "103d7bf9-39d0-43b7-a133-51e14ef09bd1", "comment": "Malware payload (Mirai)", "value": "cf9d71940f6a14955c82a7979c9d3a78fd5f1069", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740603, "uuid": "acdf8a73-8997-4708-b4dc-f80998d2ab3a", "comment": "Malware payload (Mirai)", "value": "4e3c09553937e644e16867b8b4e02987bd144cd66df985f2afab3f8642c155e929b0b7ce31889d96be6d7b077e1e8cf9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740603, "uuid": "aa17669b-fac9-4b26-b31b-e138fb6fe25f", "value": "T1B3C2C0BDE5A47F93D21C5E3CB2EE63F5A56AB081338EFA0C53126C02B52669BF154074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740603, "uuid": "d4e8ccf2-db7c-4ac3-84fd-752d864e8b88", "value": "384:Iy2NN08zn8TLEr/FWq2C7SRPqosE1FCEEzy6DHKTWQaIjTxug29xVMRWGVCz0NvE:n2Ny8z8Tq2JdHn1cESy67jdf9xVsW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651740603, "uuid": "11befc46-fc1f-4a4e-aa56-19ee3ab643d7", "value": 27280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651740603, "uuid": "5ebc1832-4293-4603-bc4d-9229f7e2667c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740603, "uuid": "a76318d5-e40d-4ef3-9d5f-1b4b3d076816", "value": "phantom.mpsl-20220505-0850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefc9186-cc3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651731778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731778, "uuid": "8279f573-fe0a-49a1-b823-5bafa323ee03", "comment": "Malware payload (Formbook)", "value": "a07e6fa72fed053ae43c7d72f5d8f592", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731778, "uuid": "53c4bbf2-8037-4822-b53c-041bc45b271a", "comment": "Malware payload (Formbook)", "value": "b77167ef1dbe1ee6dcf7aef23a4b47087bf229237612ed5ca6f01c2cb2a28b3e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731778, "uuid": "24a6d3d1-eeb9-4d46-85d0-62592a40da11", "comment": "Malware payload (Formbook)", "value": "8c1967c71712765c3f21fe7e9cf4d084da7622b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731778, "uuid": "0d0b2203-fafa-404f-998e-e103ee010296", "comment": "Malware payload (Formbook)", "value": "767e6b6e0c344f3b13b646d07677c7a7537792aa513146158ffb9cd330ed46aa12125ed848c504eb755b955389128997", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731778, "uuid": "5a40be93-c812-48c4-9a22-ad675a6cb6b9", "value": "T14CC423DE48F6BE184DEEC81A54C7D780B1697EBCA49B10B1720644178A367C4ED27FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731778, "uuid": "5f57de6e-3902-415b-ad6a-d4f0c5ff7b30", "value": "12288:z/B/rQN6NYzBax+yp5yUYxUjTSfoKxHm50VjLwDPxWWmZMQVOec6kA:t/EEyaJryUVVP2Vo3XQPSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651731778, "uuid": "a025b0a6-a6ee-4d3e-a0d1-ad6709edc330", "value": 574370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651731778, "uuid": "dc12e321-834e-4845-90fe-118484baffd7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731778, "uuid": "611f33b0-064b-494a-9f62-faba7644d218", "value": "BG032442552676.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6454da-cc39-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651730731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730731, "uuid": "35a8da11-6633-4f72-9ca3-77f115a1df7e", "comment": "Malware payload (AgentTesla)", "value": "0f6c975dd9dc51bc14522c8f55864724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730731, "uuid": "6e67b594-b45a-43e2-9319-ddffe53ea054", "comment": "Malware payload (AgentTesla)", "value": "b7c3b077777303227947d62064fea23a1473f57c07575476e97c92a811b37c46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730731, "uuid": "5ee5326e-916f-442c-9335-29fcf668bf73", "comment": "Malware payload (AgentTesla)", "value": "ec4b675e8eb45d4caf359e0cf897b855db29dff7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730731, "uuid": "18eb5f89-4263-4b3c-bd85-2d080a6d3ce3", "comment": "Malware payload (AgentTesla)", "value": "c0c2c2fe42209f16dd84c35e414ebc0168267594a7742a6afe95ecc03acea8ae75502e67044f52035ad70521df3fd4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730731, "uuid": "14a4205a-dff2-404e-92f8-271d33b0227c", "value": "T132D40200B066C77ADB3457F1662A429013F63ABF7051F1687CD497CBB666BB81E00EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730731, "uuid": "67651f6d-ddbf-4ee0-906b-335ea03f4988", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730731, "uuid": "7a99878e-61f7-4f90-b406-ab5c4ff920ed", "value": "12288:b2L2Ij3hfA94QJVU+s5vgXesxzh3ptsXBGP6Oznh9a7g83bUe:b2p3iR1+g9Fp1Rzh9QgE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730731, "uuid": "3cd25de7-c266-4bea-b8ea-bb3ab09bdd9d", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730731, "uuid": "ea7711d4-5ca4-44e7-b0bd-8274744c71af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730731, "uuid": "459edc1b-acda-4401-859b-191c61d41165", "value": "0f6c975dd9dc51bc14522c8f55864724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c250d03b-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746790, "uuid": "07a6bfc8-6713-4189-9368-a15f3040417a", "comment": "Malware payload (Formbook)", "value": "a3aee41648e9fa62d3bfd4db586d97ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746790, "uuid": "43a0eefa-ee27-4934-bff0-7337895c32eb", "comment": "Malware payload (Formbook)", "value": "b86196be9611b795234dff0f3d10d7d59678288391944190b189ad6fad017882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746790, "uuid": "61802402-1a7c-4619-ba5b-bba718d7a5c9", "comment": "Malware payload (Formbook)", "value": "ea6d36b400e9566964bca70e1edeeb0f096059e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746790, "uuid": "4ebc6768-dd8d-4d69-a31c-5ba14d3e97ac", "comment": "Malware payload (Formbook)", "value": "4726e8f31e6812141583e8e3d5800b6b97ff49c623b964b0d94bc95e661fb795aa8fac15b599629f1a3a8f5781135141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746790, "uuid": "ca4af19b-20c8-4f09-8de0-bf29ebb48ad6", "value": "T1C02412406BB586A3D5A39B370A77ED25EFE9EE1130A8470767101B1E3932B81590FFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746790, "uuid": "235b4695-9d61-4217-9c71-642da13fefd9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746790, "uuid": "9d2f29f8-fd59-4c99-8b28-b0c59c8e8144", "value": "3072:l1NjcVVnLpPunb6G2nM0eiSFdEDMIhnU4kXDR+DgLgmHVMGzukvtgXOJbqg+mRF:HNeZm6G2n6+MI9U4UDb/1hjvd9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746790, "uuid": "076fc80d-971d-45a0-b322-089c96ca4040", "value": 219646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746790, "uuid": "527871d7-c79e-44e4-88c2-b73af6ccb90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746790, "uuid": "4ad72c3d-5f0a-4576-8b2b-a5adcfb4445b", "value": "a3aee41648e9fa62d3bfd4db586d97ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d299476f-cc3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651731785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731785, "uuid": "ad6319a9-2f25-4054-8757-72a9e6a7ccc9", "comment": "Malware payload (Formbook)", "value": "69d7fd7b1cc3a2517941731fb9c3aa2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731785, "uuid": "b3eb2f54-a9e0-402f-b26d-288a1a254a0d", "comment": "Malware payload (Formbook)", "value": "b8866409889805cd3132c7f3db0d02294eb25e747e0e095e913e2d75d437df59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731785, "uuid": "268293b1-22a9-428f-99d1-648ce180fb0f", "comment": "Malware payload (Formbook)", "value": "70e96be6d19db9218684b29882e424e877071db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651731785, "uuid": "993812ee-38ed-48dd-bc62-08d4c177a90b", "comment": "Malware payload (Formbook)", "value": "eea01ebcdd3eb96b3c3af0b06625d2594325a6c28ec1a4d0f63cf2445aaaaece6ab141290d1a8e425892b1331b35bb6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731785, "uuid": "91151447-861a-463b-8e45-d3be6e21a3a7", "value": "T11C459D51F351CDB2D7371A385C7766686E25BE302D696C4B3AED3D082E3638138261BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731785, "uuid": "e0257e92-e73e-4895-9eee-6fab5f03426a", "value": "20c65ee8d75b4a04b432a21c90b12de6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731785, "uuid": "0b43d855-1ce2-481b-9233-b705d8ef1e34", "value": "24576:MEolFGCzQw4rZLRWPghPHNjWsVz6HtVSn52XcNV:MJPzChVMSn52Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651731785, "uuid": "7f9ae7a9-e413-41f0-9cdb-6f00cacaa289", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651731785, "uuid": "b251dc96-b9eb-4ab4-a75d-8cfb1e3ecc87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651731785, "uuid": "2853ffc3-da5b-4b49-b602-a5b3690bc532", "value": "BG032442552676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f668711-cc4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651740074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740074, "uuid": "f7bf7672-92b2-4ab3-9b26-0994b3b9e9a9", "comment": "Malware payload (njrat)", "value": "0faa7920641f5cc24e5ce2d57675bec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740074, "uuid": "3b3f63f8-fdb8-4466-9aac-40e73d489233", "comment": "Malware payload (njrat)", "value": "b99596d33d8b0aa19e2881def2798f3e46afe0153bbdffaf865be45c7e97b45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740074, "uuid": "0e344ff6-dfbf-4f2f-b5de-a2b479d862aa", "comment": "Malware payload (njrat)", "value": "34092bf86d44ab5c5a4c38cae05448bc6fab25b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740074, "uuid": "dd153a05-be95-44ef-b89d-c884766a2e72", "comment": "Malware payload (njrat)", "value": "461ecababec544197ec27a968578d2954f2d977c2b9b328e234956de42da3a591c63fa8c3080e5d61278dfb1cf602fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740074, "uuid": "58b31013-d93c-426e-b55e-c7d32521f306", "value": "T1CD033B4D7FE18168C5FE467B05B2D01207BAE04B6E23D91E8EF5649A37635C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740074, "uuid": "98c3f99f-b821-49b7-bc52-f61c88e0dc0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740074, "uuid": "0513c0f4-b553-4b29-88e9-cecea31b9c2d", "value": "384:QCveoixJhl7OHg1WykrppPl48uiX60rAF+rMRTyN/0L+EcoinblneHQM3epzX0N7:tv+R1NkrppqFidrM+rMRa8NuyTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651740074, "uuid": "9021341d-ac8c-42c6-ae88-09599401723a", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651740074, "uuid": "a3dd53e2-c426-4535-baea-9ea411b213dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740074, "uuid": "10b8b333-e02a-4bbe-8c48-7dae84a578ff", "value": "0faa7920641f5cc24e5ce2d57675bec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992d3949-ccb2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651782798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651782798, "uuid": "11a89c66-bc6c-4758-8abf-ca584b23e098", "comment": "Malware payload", "value": "722d20fb6beb499ed89df402e543a29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651782798, "uuid": "57f1464f-4c01-47d7-83cf-760cdf11fc40", "comment": "Malware payload", "value": "baaa0c66f015368029f46de92c341d6aacc7646c13491e95e3f87829b18cbbb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651782798, "uuid": "98c5a0ee-61cc-40a0-8f38-9024729d9b92", "comment": "Malware payload", "value": "56e637fcd38949bc8826b1cef2a1d6e2436884f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651782798, "uuid": "645755e5-52b8-4599-b3d3-12425993897a", "comment": "Malware payload", "value": "f54e4f2cbf6812c09ffd24c38b275299275be41aafdec05ad4d7076a41381652cf6a4cce2497035bdefa952c5402b794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651782798, "uuid": "66563fcb-f40d-4782-8971-8ed7d4e29eab", "value": "T152F4E1727340ED66C1739335E3134764A1F37E6B54E5828FB219BB2D69B018A120BFE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651782798, "uuid": "9ba7140a-bbde-4707-99a0-7f4e52cab314", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651782798, "uuid": "78231eb8-c748-433d-bb1a-4c14e3da25ce", "value": "12288:eYpEvp21QIkiWsNw/idQ5BJlfLPeAy0doiCCVO0ioYbsfOMJb6l+id:eY2pcQhiWsNZdslfLbdoQJi7yOMJbE1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651782798, "uuid": "aae6e6d3-74c4-47b0-82fd-bfbfb7a374cd", "value": 775224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651782798, "uuid": "90ac81e4-55fb-43e6-8ef1-970dc25d1cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651782798, "uuid": "41d6dd0c-3f1c-4b2b-ab0c-e11e800e4e2f", "value": "SecuriteInfo.com.Trojan.Win32.Shelsy.gen.14496.8578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a903d6-cc34-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651728485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728485, "uuid": "aa3df37b-9a42-4d01-877e-bf18c4c9700d", "comment": "Malware payload", "value": "e4ad714963d3858f00d552ee02bf956c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728485, "uuid": "7a4c2e7a-558a-4cb5-856e-df0a546e91cf", "comment": "Malware payload", "value": "bb844107525558a6598d2d6173dfd555bb0b6cc03d74131125d606afd0c84a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728485, "uuid": "1bd36e02-8147-47ee-8c15-58aa932c7d26", "comment": "Malware payload", "value": "d39c6720d27cf2ac37884d3a23076ba7bd631d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728485, "uuid": "736e4a49-f89c-491a-9dcb-1ed44e3d93dd", "comment": "Malware payload", "value": "27cdb78ddc7541e82c71f7237a6ff155381e73688a301e9f0148888efe0e95a87d6b479b778da7d9c332477894f5c002", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728485, "uuid": "7e4adbe4-05ce-47bc-92ae-34eebe832835", "value": "T1A0F6333FF258A53EC4AF0B7155B35260887B7A60A81A8D1E07FC780DCF765601E3B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728485, "uuid": "25ae43a8-7abc-492b-a8df-919a92464e3d", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728485, "uuid": "052de4d6-e033-4518-a668-bfa720f10cab", "value": "393216:hPXZtqtnppt/If5tSoOKoT+9MnNyKDKBX2:hPptWppt/k5t3oT+JA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728485, "uuid": "66f42af1-e6f3-42f7-8efe-1e6afb775b90", "value": 16733335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728485, "uuid": "ab3dcca2-b507-4f57-a07b-a0743d472aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728485, "uuid": "400140a5-a7ae-40d9-ba03-83e6094f7d65", "value": "Snake_Game_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ca13fb-cc36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651729287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729287, "uuid": "8ca6c34d-5ef5-4554-91ba-a7a8ae1006cd", "comment": "Malware payload (Formbook)", "value": "ca3a57a6b1feb39cf130554c73ca8681", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729287, "uuid": "04028f05-dddd-44f3-8ff5-79c9b4d75914", "comment": "Malware payload (Formbook)", "value": "bbc249b1ba93cacc8bae2d88ae2bbe88fdeedcffcc35f55645acfe94fdc67bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729287, "uuid": "97de04a2-d6e3-4269-942e-a99392ed87d0", "comment": "Malware payload (Formbook)", "value": "f7b0e31a12b866dec0fdf82fa8657401132ada45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729287, "uuid": "f0199ac8-8471-4802-b5de-f8e83f02ce4f", "comment": "Malware payload (Formbook)", "value": "919f5432490f6f97c2f9b66841664eac71ef0a3116e9802590a2c743b1cfc62c30a8a9e584f27875d365a1da204a7ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729287, "uuid": "5bca1b25-2e1c-4a10-a382-92117cf726a0", "value": "T159133AE276448265C86E8730D863CEF01FB9FC228901C67B70D9F92F1D737405966AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729287, "uuid": "43d9a08d-d723-4063-9e66-0616df3f9d51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729287, "uuid": "325958e5-13c1-4b56-b6ef-a7d6dbd31e0d", "value": "384:c0xyPxYN9RRskHgMff0sYAnqATtFLm1scSrbCn/zuRG//NN+ugmZiuuLFarIh7AG:Es/xTthmbzTn+VuQakFAtMPQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729287, "uuid": "66be0890-b944-4888-8057-4bba852e8f1e", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729287, "uuid": "8b5f242f-09f6-4937-b560-eb98800b2ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729287, "uuid": "0381ce8a-ab2f-4523-b774-27672c55b1fc", "value": "ca3a57a6b1feb39cf130554c73ca8681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10253337-cc08-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651709554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709554, "uuid": "29e360bb-f369-4d96-9e47-d28cc59249e8", "comment": "Malware payload (Quakbot)", "value": "19e82142b89749bf4c83f5b8532b3d57", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709554, "uuid": "e3cac0b2-e32d-4c1e-9475-4bed2b9d84d4", "comment": "Malware payload (Quakbot)", "value": "bbce623c5860160100744a5403421fd6bd9852923702a56ac2363ddf665853ad", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709554, "uuid": "08843741-a37f-4407-bba2-041d85e38120", "comment": "Malware payload (Quakbot)", "value": "3958a1b4a24081b274bc168722c2655e05c3b6b8", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651709554, "uuid": "a7b9a65a-a39a-4a50-b6b4-cc7fd766a3be", "comment": "Malware payload (Quakbot)", "value": "95c3336d79634d5a7ae023ae8eac7db78dbfc2a20c560c423465a5d657505c321dbf0ab741d7b2e8145d34f59f532c69", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709554, "uuid": "b4e7f460-b092-42c3-8fcb-f50b4441bb7f", "value": "T17105F8DBE54561DCE4CDCE37C918522718EE2C706A591AC77AB07DA470B66C0AE33E38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709554, "uuid": "dd6c3d31-51d9-451b-a622-c9281cfa8a2b", "value": "5cc475923ad266a0ad396df7fdc3b568", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709554, "uuid": "3009b2b1-1ad1-4340-bb1a-b73d83cdf61a", "value": "6144:TBykbaSCz8SdwkjBMmq+zN3DC9juc4+hFSlOAUaqM3cqgbhus820Vhiy7fvhMnF+:TByBS0xoRucc0xUsUimM1nSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651709554, "uuid": "201b5a24-cbd6-40dd-8331-a7b2c45c8b42", "value": 842752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651709554, "uuid": "d99903db-0fa4-466d-a914-a3c21c4b1f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651709554, "uuid": "2c0d6835-c8c4-48be-a7d1-ec4f60ff798d", "value": "PeJl8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17661c2a-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651730182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730182, "uuid": "5379c34c-451d-40ea-bca8-d7e20a96a08d", "comment": "Malware payload (TeamBot)", "value": "a0a5642cf6c831b6f9b00b73ec50f7a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730182, "uuid": "71dd2c98-abb1-4f52-85f9-152059dda16c", "comment": "Malware payload (TeamBot)", "value": "bcd642198ca4283bdf07a711b45cc13abcd9666ab4bfb29c57a3d5538a4ccee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730182, "uuid": "99460c5c-8e0f-4d02-8c45-75d0e8907d77", "comment": "Malware payload (TeamBot)", "value": "43f40a6a387c13913a131d08e9d86f5345ba40f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730182, "uuid": "b3589f9d-1c7f-4062-9187-7b27f369b588", "comment": "Malware payload (TeamBot)", "value": "bdaa1410c50ba3fa177985df1e9401f98fcaa061d31939d3ee591389bb5a1f069e3f54ef434292e3a46cda8a1199590d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730182, "uuid": "f4f15f13-3cea-4aaf-80ba-965b23739db0", "value": "T186548E00BB90C034F5BB12F5597683ACB93DBEB19B2451CB62D46AEE66346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730182, "uuid": "75cf2c59-ed4d-4300-b480-f5b2fa19f5b4", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730182, "uuid": "6b93a17d-b7db-46d8-9a7d-8bfc0914de7b", "value": "6144:GwzGma+PrH6FUnlI7SaBIIDv5LVsK+C52PLKueq:GINvzaFUlIxBNvdlfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730182, "uuid": "8d475092-429d-4fbc-8291-df2f7a71b10c", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730182, "uuid": "d5edb18b-a145-4f07-9519-dd6c6d9f43cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730182, "uuid": "a7ddcb0c-20c0-46c4-b3ce-e52ea033b257", "value": "a0a5642cf6c831b6f9b00b73ec50f7a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3335440b-ccbc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651786922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651786922, "uuid": "fcd258bc-74f4-49f8-bb00-a27ef95dce5d", "comment": "Malware payload", "value": "73561d9a331c1d8a334ec48dfd94db99", "object_relation": "md5", "Tag": [ { "name": "AwfulShred", "colour": "#814625", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651786922, "uuid": "c2753d6a-674e-4871-9130-d23e9fc7a405", "comment": "Malware payload", "value": "bcdf0bd8142a4828c61e775686c9892d89893ed0f5093bdc70bde3e48d04ab99", "object_relation": "sha256", "Tag": [ { "name": "AwfulShred", "colour": "#814625", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651786922, "uuid": "8f28fdcc-2235-4521-acb5-3f99decc333a", "comment": "Malware payload", "value": "3cdbc19bc4f12d8d00b81380f7a2504d08074c15", "object_relation": "sha1", "Tag": [ { "name": "AwfulShred", "colour": "#814625", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651786922, "uuid": "a2072874-1fb4-474a-a6a7-ebbeda254b9b", "comment": "Malware payload", "value": "600adee6c7d50156064ddd012500237bffe35d2ea06a4a248dd8abd07930213e381471f3dd795a839ffd24168209fcd9", "object_relation": "sha3-384", "Tag": [ { "name": "AwfulShred", "colour": "#814625", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Sandworm", "colour": "#AB48ED", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651786922, "uuid": "293f38ff-294d-4107-a875-6a47cc3d7284", "value": "T1912242CCE1913DB0301609AEEECBA068761D120B484869DA7E9D26D53FA426DC3F1F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651786922, "uuid": "3e888ac7-a6a1-4050-b902-110ab46a1c02", "value": "192:jNhE21baNxtrilGAL4WDnEHgCyLslERTJx+f4:jNS4OxtOlTE6EAJsp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651786922, "uuid": "d9daa34e-eb28-460c-b4ea-3d85e21dfb17", "value": 10046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651786922, "uuid": "63c4c95a-4cdf-4316-b73b-7337f8f1d118", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651786922, "uuid": "f15dc0ac-8947-4a11-b42f-51cf91e2857b", "value": "bcdf0bd8142a4828c61e775686c9892d89893ed0f5093bdc70bde3e48d04ab99.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30197e3-cccd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651794438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794438, "uuid": "66172b1a-ce02-4cb0-92b4-f0f2da91260a", "comment": "Malware payload", "value": "e509d1ec441a4d7d34ead591c1c6365e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794438, "uuid": "6d1845b9-27f2-4b42-aeaf-7965c74b8584", "comment": "Malware payload", "value": "bebcbb0d4b010ab419fb98fac5e92e27b91a169673186064c8f8b2711b699651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794438, "uuid": "4320eba1-0af7-4514-81d5-5fe2fa1b9784", "comment": "Malware payload", "value": "92354eb3833c8361b831b35d91b51b9572df85b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794438, "uuid": "be5284e5-2e6f-4d33-8183-2fe06952ea67", "comment": "Malware payload", "value": "dcc42bb858a47fa3d22252fce313b8bf0114b402effb3de2ded90a54bcfd9bcdfb54d34cc9c33bc1c7b432406437cfea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794438, "uuid": "eecddc7f-f5cb-4921-9ac1-3a4c14d1ad08", "value": "T18EC2F72C37B68232D1EE067E4562EA5042B5D04BF223FB1F4CD994DA4B5B78A0B41FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794438, "uuid": "022acfbf-1dd6-49cb-a1a5-fec3658cf369", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794438, "uuid": "cffb8491-d5b9-41e2-8490-195336bba738", "value": "384:j3LdGztTb+oYjc+W+ohMnFbCGEPBNBpM+AQk93vmhm7UMKmIEecKdbXTzm9bVhc8:PIBS6+W+oqv+A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794438, "uuid": "1c24f601-6b4e-45a0-8109-459d2b73289d", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794438, "uuid": "017bbd98-d05a-4590-918c-15dfb69954d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794438, "uuid": "9ab078ff-ab9d-4e5f-8dbd-279e926ca9da", "value": "Payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90efab49-cc50-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651740694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740694, "uuid": "241bdd66-a63c-48ce-8c8e-c4a67dacf3fe", "comment": "Malware payload (Loki)", "value": "1d6858ad89caa755c90ed144994a64c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740694, "uuid": "c96dacf9-c0fe-40b5-bd52-f4c82ba513fc", "comment": "Malware payload (Loki)", "value": "bedb4c3914d8365e11b7dd7b8d208e4d63ae6ac4dff4316ce2638b429e3d1e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740694, "uuid": "eeabd7c9-5964-4d15-bd25-4bae7dd9ae30", "comment": "Malware payload (Loki)", "value": "66732badef4b83ff39824167d1d510b3a248fbf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651740694, "uuid": "e9ee2a0c-951d-4447-a88a-69a45cc8256c", "comment": "Malware payload (Loki)", "value": "5249f08ec05700335ad7d6d2073bbd1f57847d785aa510fe19f62f3737708f7a028fc5b843d445597eb7a23eb78d5da8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740694, "uuid": "ea79a012-558d-4349-bb21-5f37aa19f4b3", "value": "T128C3F15421A4C463F4A34A355E3897777EE6A6222824C34F47A07F9E7E227C2D60F3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740694, "uuid": "f9de158e-2c04-4956-bc8c-314a00f73120", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740694, "uuid": "e63b4260-20c7-4570-b2fc-03b4e6324a8d", "value": "3072:l1NjcVVnLpPunbd2Jw8+yyBXfoTx2rQX6AofHGdR:HNeZmdGwpyypJEdo/cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651740694, "uuid": "779bf233-3db2-4d45-ae2b-af0cfe773fb8", "value": 127002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651740694, "uuid": "851191ab-9fe1-4a2d-ba9d-37ca4d6ff386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651740694, "uuid": "cea67250-03b5-4264-9bb7-78f2fdd0bac9", "value": "2022.05.05- Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4b8e3d-cc10-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651713092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713092, "uuid": "3ff95a28-af62-4687-9038-a8e55262156d", "comment": "Malware payload (Formbook)", "value": "62ed80f638e9551e1e59b4ea9341bccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713092, "uuid": "274cf555-b792-4fa7-a32d-034c5e00b960", "comment": "Malware payload (Formbook)", "value": "c1143945d2559da08d0fe82b3eb88e1e7238c752b05f3b8c7970e6bd3f6c97bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713092, "uuid": "5322baed-0ab6-47d0-92d9-c588890d783c", "comment": "Malware payload (Formbook)", "value": "44196e8cb0f5774decf60e12215767f092c3c008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651713092, "uuid": "e1683e34-75e5-4d90-855d-cdd3ea2a2dd6", "comment": "Malware payload (Formbook)", "value": "e15731c41ef1f93553e02eb1db06495c1007810d8f91ce5752567074ec92e2b5d0c4e75e4b890e4fdc06d03161d29cb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713092, "uuid": "d97a7f10-fffb-4d5b-bb46-34c7bfa961ba", "value": "T120362351B708AD8BF87283B210B4E7B5C7B44EA57904C6C255F0EE2FBDA75860F1A5C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713092, "uuid": "6aa41463-613c-4ff0-ae05-cc4b4cb246aa", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713092, "uuid": "192d831b-c7ce-4c62-b757-bf13fee4aa96", "value": "98304:khnG2iy9Lc9fzDKc21wVWC786gF53//4Ui40n:kN5i9fawVj786k53/ti4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651713092, "uuid": "1e39b6aa-06f5-40ac-bbe9-20b657531205", "value": 4867120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651713092, "uuid": "ee1768f9-ea62-4376-bfed-467a35ddf825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651713092, "uuid": "26bf7516-47c2-4112-88dd-7917f729fb6a", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4087bfe-cc71-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651754953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754953, "uuid": "d2277321-bb06-4489-9cd7-d83355777170", "comment": "Malware payload (SnakeKeylogger)", "value": "eb5ff3a182c3cf13f12ec8b82be2e553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754953, "uuid": "b7805e7b-dc9c-4c10-8345-50a9eb0b707c", "comment": "Malware payload (SnakeKeylogger)", "value": "c25fe1d24cb9421c1e3041d7f6577cd75d9ba964a4744732801d12205df4b827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754953, "uuid": "e547e58b-1d64-4d36-b540-0a65861586bb", "comment": "Malware payload (SnakeKeylogger)", "value": "2242e9e9cf11365c0832f4d681ffd66983c47251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651754953, "uuid": "6816baa7-c5ec-431f-87cd-0bbdc74ed4ee", "comment": "Malware payload (SnakeKeylogger)", "value": "740934ad463daa48cbd426ea5c262f7c619ed234ba0f5e5a57fed2365cbb853a3dbf0d5ef8b2ab537fa18328a202552d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754953, "uuid": "8f54b898-1979-4974-bc7b-4c94bd0deb83", "value": "T1C3E2903736C4FEA3DAAC767334EA5A3E5AB2AF411111D23F8884794F88B77002573695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754953, "uuid": "6145965c-b6b7-4790-8767-475e66a687b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754953, "uuid": "d253efa3-6567-4673-a903-12d76811c9ae", "value": "384:WwPYffA6rMXgMC4X9Af1ggQVD7k14hPsyr:WwP3pagyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651754953, "uuid": "3825aefa-3b70-469c-a8f6-853aa548365b", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651754953, "uuid": "5139dc7a-990c-48e9-9799-c7ffc3f0472b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651754953, "uuid": "e694dad6-c536-413b-81ff-a696bedeeaa9", "value": "MT1201780233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dec4dbc-cc46-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651736179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736179, "uuid": "6946dded-0589-421b-a01e-aa0fca6c0402", "comment": "Malware payload (RemcosRAT)", "value": "b368f8894cbb1fdaa8ed0ec935b183ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736179, "uuid": "8c0cd43b-d298-45ed-9beb-24516e08c1af", "comment": "Malware payload (RemcosRAT)", "value": "c32a878240bdd4de7b8ccb5a013e97fec1ddf804ab1e6481592971eddb5033f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736179, "uuid": "0d9e5ff8-5a96-4d03-9b50-b4c477966a25", "comment": "Malware payload (RemcosRAT)", "value": "2a54ac14def74eee88dae6d83cf4a982b0ec9db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736179, "uuid": "87134821-0950-4daf-b14a-e1aca6f354d5", "comment": "Malware payload (RemcosRAT)", "value": "1ffcfb8bc06d98b6050f2fac06869bd52785055be13be2559abda6667af709b4fbe17c281a42da077290985581d3acfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736179, "uuid": "211534e9-9690-412d-ad9b-7638a4b9cfd3", "value": "T17615F19C721072EFC857E0B29A9C1DA4F66135BB932B5143E42716ADDE0D88BCF184F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736179, "uuid": "257e1ea2-40b0-4ca6-b9dc-6363b46311c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736179, "uuid": "fa32c06e-6669-4cb3-b8d0-ac9e5880350a", "value": "24576:EY122EEtZjIu3MQ9gm8bsC59Aa5X6XLvQ3:VgCOu3T8tHdQLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736179, "uuid": "418c2502-db57-4518-9113-085403895c17", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736179, "uuid": "13544a5b-f247-4043-868a-0c426191b8d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736179, "uuid": "6aba3602-d176-46c3-b3a7-01b1fd31cef7", "value": "FIYAT TEKL\u0130F \u0130STE\u011e\u0130 HKERTSAHTV NETES M\u00fchendislik ve D\u0131\u015f Tic. A.\u015e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06854d50-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651730154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730154, "uuid": "888b0134-bfff-4338-a147-9b83d353bedb", "comment": "Malware payload (AgentTesla)", "value": "5bbcc9d01bd32453756a8e65edd2723a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730154, "uuid": "75c2544c-3b23-47f9-88bc-1e003462a258", "comment": "Malware payload (AgentTesla)", "value": "c36ec3f847b81b6e59ee1e6d17544ee886a3a85105d1aa06646df073f8590838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730154, "uuid": "c9684d58-b957-4c3c-8b74-8a5b423fd59f", "comment": "Malware payload (AgentTesla)", "value": "48a5b77ef099971fb4d7e9fbd47cc20d910767e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730154, "uuid": "a744e711-b6c3-4960-b567-6716b38778f3", "comment": "Malware payload (AgentTesla)", "value": "ab8b85504817133ca4fba9eff8822cbde23b559a3ac481a9edb685cb9fe31dc85d115d15a4dbe8209b22c5ba13fd90a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730154, "uuid": "38b715ac-dd22-47da-9fca-e83b90403514", "value": "T1E7D4E19C715172EFC467D0B29E981DA4ABA179BA932F5143E02316ADDD4C88BCF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730154, "uuid": "0fcdb83f-b3c2-4959-a5a2-45474ff0f000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730154, "uuid": "da9c887e-33cf-4932-ba19-521c9d752f56", "value": "12288:4k+Ef3acL8IztuR0b1Ivtj/9m2L2I26JEScveXyrbREL8AMOwvPI4IsHhIDL:zR128T2XyrbRET4I4lHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730154, "uuid": "2ac69e69-ac54-4d11-b35f-cd5d55a833e7", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730154, "uuid": "abb431b7-f96b-41a2-966f-f0f29a883381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730154, "uuid": "c7c7b16a-51ca-4765-b4da-a4bdf44bcf96", "value": "5bbcc9d01bd32453756a8e65edd2723a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97872d45-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "bbe767d9-4cdd-4a9b-af71-f00e14541468", "comment": "Malware payload (Mirai)", "value": "95d5fb25fad2002e627aee08afe565d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "72cee1e2-9fdf-4948-890a-8a3905077166", "comment": "Malware payload (Mirai)", "value": "c3d9c1668b07ae15218c3ea5b03cf74659564774f439b5125b6fa40de93406e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "ecfcd8a2-cb8a-4e6d-bcf9-6535e5069b86", "comment": "Malware payload (Mirai)", "value": "ff9642ed7242f0eb77393b35b159baacbecd2379", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733403, "uuid": "f718ca84-ae2e-41db-b6be-170e0a047d3a", "comment": "Malware payload (Mirai)", "value": "31009ac343557fe848503c00f885910962c593fd6d825e741df2c81484fa44b85882d44a9a74147ff1f05dba299a3070", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733403, "uuid": "f285a742-0e8d-448b-81e0-5532fb6dc6f9", "value": "T1832302A1D32E62E2DF278DF94C7F05C02A6E5A35C1EEB87610E43458AB571D65BB6002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733403, "uuid": "a0313487-5de6-4712-ad4a-0c8a671e9f83", "value": "768:/5lpPa7bsNlTLDrJVlfweGJFuPsOKxp1iqgX9q3UELuyTQPvfaYvCinHpl:/JPa7bsN5PrJVlfweGWEOHdmLNQPvDvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733403, "uuid": "0efea08b-e441-4086-a10b-6ba415749758", "value": 48992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733403, "uuid": "9dcb9100-b6e5-4ad5-9d2d-f581b30ff4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733403, "uuid": "b3736d45-c5e9-4a19-9c09-980a2083b4f1", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79df070b-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651745809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745809, "uuid": "7846d18b-0069-4810-afe8-b1d8e92ddcb7", "comment": "Malware payload", "value": "88b0a469b2290f53a72b2fb1adfc4818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745809, "uuid": "39caffc6-2b05-4f6d-9ecc-05827cb52038", "comment": "Malware payload", "value": "c6444873bd4472d18936edc216ae2e754f222e7b082b12a615577b05bb55b1bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745809, "uuid": "a9da6900-39dd-4c1a-956e-7a00b0dc88fc", "comment": "Malware payload", "value": "d8cace9aa013ac8c44a42fe93e1f4d4256d21096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745809, "uuid": "f33c6a50-c8e9-4528-aac2-85b2133ada6d", "comment": "Malware payload", "value": "64d3eb1952d44d8f25cc8b2275ea5ff69092a131efa494736be95c12df310bd6091681361bc60380b11cc302fda96329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745809, "uuid": "525175a4-0445-41ad-bb47-80d182f4a019", "value": "T1D1C292515386111ED6BF77310749A34012334BBFD162D736FE70BA0EDB612AAF606617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745809, "uuid": "ceee6da0-cd7b-472c-9625-2cfcb82b4c21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745809, "uuid": "0d01e25d-4488-4f5e-a482-9948d41a5592", "value": "192:MR+KbBpPz9xewWsDBVwbsHz5dYZzy64TYk4XffdVVIIIIIIaIIIIIIIIqDJ+FII/:I+wBfxewDbwM5dYZ8ToXffdA1Vxy0+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745809, "uuid": "733dc880-e8fa-4635-9633-2cf64d4229ec", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745809, "uuid": "8f13177e-d110-4443-bb47-50f6b82701fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745809, "uuid": "c3806726-8369-4bed-a0e0-5267504d94d2", "value": "88b0a469b2290f53a72b2fb1adfc4818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f37152-cc48-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651737135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737135, "uuid": "513f89d1-1820-44c5-92b4-f68a71c5c128", "comment": "Malware payload", "value": "8acbad4d73ae40fc43f4b88bbb29b2a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737135, "uuid": "5bf54b3c-5715-4344-b46e-249cb72fe699", "comment": "Malware payload", "value": "c6bfba1f2b0e23fb2c4d7ec0ccdad382f3a483b00d6cf045a1ef0ba686129a04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737135, "uuid": "c74320b0-3316-444e-8878-1987f0c4e99e", "comment": "Malware payload", "value": "25670487c31f949954a28b478dce03a4bfd8232e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737135, "uuid": "ef153d2d-2686-43fd-9030-dab958015748", "comment": "Malware payload", "value": "1095f01a90301b4291a880e60965fbedb845f799ce9ad7a175d2cdff1993e5a0a250cba7f4c71e563e07b75f7c915809", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737135, "uuid": "d4553342-bff3-4efe-b1ab-9aead341d1a4", "value": "T199C5230E765071FFD4B7C5319EA94DB06B64BD3A43272297A1531AAD5E2CC83CF182A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737135, "uuid": "b477b9c9-6911-4cd8-9a5f-0241d2ca0a63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737135, "uuid": "e58912fa-e1a3-4f92-b7fe-279e58537865", "value": "49152:0gCOu3T8tHdQLvQfXExK51rgXteP3Vz9oI2mhoNosVDP+fX:0gCb3oHo4fOK59sePl9oGoNoswf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651737135, "uuid": "7502ebea-13a1-4038-b194-6a3ef721a5c7", "value": 2582528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651737135, "uuid": "1615e1a1-a172-467a-8831-3ab2da8dce47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737135, "uuid": "0a470000-8b3b-4092-a899-a6713bdc2575", "value": "b2057249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fef367-cca2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651775700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651775700, "uuid": "7ad6a043-ae3d-4134-a442-251188506b5e", "comment": "Malware payload", "value": "e641c2fb4b71b12e4f7abae53d89a5a8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651775700, "uuid": "cfceac26-3e55-413d-acaa-07bb9baabbf9", "comment": "Malware payload", "value": "c75a9108d565dda4d08d4673f221c53cce07b50680e62df43f30a1aa56a9957b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651775700, "uuid": "0572733f-b8ea-41bc-8d8e-4a92deaf7aac", "comment": "Malware payload", "value": "2d531426181c0ec14d2d1f8250ffc85eb4916fec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651775700, "uuid": "c1dcfdc4-a248-485a-b929-76abb1514806", "comment": "Malware payload", "value": "2fdfe326ad6c49c73eb80c7fda86c161922fe9b9bd684d2c9cfdb356380de0825ba60f95d61f69f4ad3e46366dbcc432", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651775700, "uuid": "3db163ac-82a6-4e8a-84ab-0257df2e525f", "value": "T1B7C50207DA545F63D02D43B0BE870E5C2B149E08B5A562AF366E6E4E3BF31613D8E60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651775700, "uuid": "cdf23c21-7961-463a-b66c-83edf5195c56", "value": "49152:A7H/mvzXmRjSnXwDGNwyxZ0A/3jYjammamJkp72NvuBudOeqi9uahc1DGN:YYwDGNwKNfj6z/mJSidlOWB8DGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651775700, "uuid": "46ba6456-c7da-41f6-a0ad-f82125028c8c", "value": 2698240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651775700, "uuid": "7e868187-c225-4d0f-ad13-1960089cefcd", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651775700, "uuid": "923f18be-b826-4ef3-b69b-ea3df9068d61", "value": "NetWire.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa05471a-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651759634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759634, "uuid": "5876b12d-ef95-4c3b-a1ba-9140525f4796", "comment": "Malware payload (Quakbot)", "value": "c7abdf94f46b34005ab7ff2d353159c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759634, "uuid": "ee18b717-fec9-4b3f-bf21-d8b4050613bb", "comment": "Malware payload (Quakbot)", "value": "c7c420b02b00e4a8abfb23baed70bfa3051821d5405f3183926768acd4517971", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759634, "uuid": "00afb654-02c6-46ce-a880-b0420ef06229", "comment": "Malware payload (Quakbot)", "value": "96816f8b5c2e793550509ad88256f37997c75d22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759634, "uuid": "1f60dbc8-174a-4b28-9437-3f0a19a1a0d8", "comment": "Malware payload (Quakbot)", "value": "4ef69b077618a8918cd065f41bf971193be4dc32e8b9e7cc7d0474a24b83e9b7a0215c6b58d7b78460a9f9b80b91f966", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759634, "uuid": "d629f2fd-b52c-4342-9d73-a3ada62d5dae", "value": "T187F48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759634, "uuid": "f17c1dec-ba66-407a-8589-104e813853db", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759634, "uuid": "b7e15087-aca1-43c3-b358-5a5fef39d1bb", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPib0Q1acvZRz5Bt:bUzrOKfQUDZCh1RZRdBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759634, "uuid": "e0e4e818-fa25-4a2d-8fe0-2d059866b40d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759634, "uuid": "8f811812-24e3-47f5-8bac-238fac3c13b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759634, "uuid": "854b1983-1c86-4d2f-9e8d-89b8cba4a57e", "value": "44686.6703604167(1).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f81e729-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651729041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729041, "uuid": "e6dcfb87-5ab0-44f6-8c6b-9402b91f7d40", "comment": "Malware payload (Loki)", "value": "bd648b51d4bb7cc16a5c9a5d833fd2e1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729041, "uuid": "c4b34206-2162-4c28-bc8e-49035a8140fb", "comment": "Malware payload (Loki)", "value": "c8f1cb8f06fd084160db80083329a46292017b1f9e06dd09887384e4c53ac754", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729041, "uuid": "53237d73-cedb-435a-bec4-72733aa5f60c", "comment": "Malware payload (Loki)", "value": "6471c356f9c9c14e8875571f84ebed6855bce38c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729041, "uuid": "7a1b2820-0ece-4f11-aad9-25bcdd9a6e79", "comment": "Malware payload (Loki)", "value": "64378bae5d93188cad41a9865406bbc4db184b91f7eb63831f6bc38bbaf0316d3eff62a46e0f7e67988e6600c024977a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729041, "uuid": "04647e0b-d2cc-4871-b3c4-aeb6ffb8579e", "value": "T1592412BD67E264F4F71591F21C06A9254793DF0308B6622A20787E681EB31DB277DE32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729041, "uuid": "5d46e025-4f83-40b8-9461-098097324d93", "value": "3072:nT8gASI3uGRYBFTnahhYY5gz4Xx4Q+WmDFHw/ZrAJVpf5o8y7omJ+29jdwy8dC1l:WBeG+RZG64havw2xfIMyzIy8OkXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729041, "uuid": "6cfc5f0c-7d6e-4303-8125-dddd2b87432e", "value": 210840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729041, "uuid": "8f06ec0c-f25d-4ac3-8112-997265b14bf9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729041, "uuid": "9677b125-417b-482e-a00c-b165472be622", "value": "MOTEX AW22.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de55d9f8-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718919, "uuid": "b68c78e5-a86c-4de6-a9d6-fef3b7ea0a28", "comment": "Malware payload (Mirai)", "value": "5d67ab517b416d60b86c0c04efb21907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718919, "uuid": "707a3d47-e850-4738-99ae-3c16a436be0b", "comment": "Malware payload (Mirai)", "value": "ca351c14a9b77fbfc2bcce85abc894bc848593da2c740eedffcd0176495cef77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718919, "uuid": "86d0ce46-86a3-4ff9-aa59-92cd61beb067", "comment": "Malware payload (Mirai)", "value": "d8733ff5f69998e0d46319e1df612e85d5fcee33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718919, "uuid": "b33e6355-18e3-4dd7-a196-0d3947de854e", "comment": "Malware payload (Mirai)", "value": "8aa13910e2e15b9ca3f8aa2a00ec2312641a9bf1aa3173fbbdfcfbbeccd7325075e2d79674a57a79b1d848c042b7e91f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718919, "uuid": "13eb87f6-a827-4172-8870-fede2195c289", "value": "T132E2E03C671247ACEB3D58FD9BD507212E710BC59A419825926AC3E38B784CA78D7CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718919, "uuid": "71eecb2a-6015-4a9e-ad67-33514eada65c", "value": "768:u1+D5be5PEG1R9CkEHNfwiKGz3HIkAYuBcYm/zJgGlzDpbuR1Jt:u1+DJe5LQkEtfOOR3UcYm/pVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718919, "uuid": "b4335639-1145-453e-8139-fc75bb9d3fe1", "value": 31300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718919, "uuid": "eb3104ea-4d9c-479d-84ef-682a00b505cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718919, "uuid": "ad10ca66-1779-4035-b436-7936332038a3", "value": "5d67ab517b416d60b86c0c04efb21907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa37635-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651746087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746087, "uuid": "889705ec-bcb4-4126-829d-6d9a3b8e7314", "comment": "Malware payload", "value": "db6f62946832241d0eb6fe6e05846e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746087, "uuid": "bc9ae0ba-01f1-415a-89b3-43c22d98ff4a", "comment": "Malware payload", "value": "cab31c58eec5fac87df0c7cf52df12ab43280e4e8b9ee50fcde4017689c976b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746087, "uuid": "f32d961f-feee-433e-a25a-240a1199f4b1", "comment": "Malware payload", "value": "1ebc1ec76e1be0876cee8a916a06d041156005e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746087, "uuid": "90ef9c0d-8402-4613-862c-c42f312c398c", "comment": "Malware payload", "value": "b16cf6aff224283f65087c9f60e7a2fe98caa4ccf72a056cce790f5fc56cb9ab7203a1da79f5138071b6e614ea2003b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746087, "uuid": "21da2591-bad5-4965-a874-3e3ff247f088", "value": "T171D4E010BB90D039E5F761F0597A87B8A92D7EA1972440CB63D82BEE67356E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746087, "uuid": "fb296325-cb7b-42fd-ba7f-4ea12005a210", "value": "385a4b49bc7f35a1da1bc61d9c1bfe6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746087, "uuid": "edd2cd4b-a6d1-43b0-aebc-b9063187c3a7", "value": "12288:xP5So1YXX95xMd+8zTAlXeFvwwfEh7DcmUfhjrSrTLtcCZoQWIJ:/32njxMd+6TbFngz2hjrWjZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746087, "uuid": "05823d8f-0c5b-48cb-982b-e8777c62a534", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746087, "uuid": "7b07a83d-aceb-4f8b-a0ef-1b9321606c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746087, "uuid": "14a20296-76be-4876-97c9-ea1f66a220c9", "value": "db6f62946832241d0eb6fe6e05846e02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ce5a8d-cc3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651732387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732387, "uuid": "d2acf3bf-6852-4e88-bb0c-83d7aaa2a33f", "comment": "Malware payload (AgentTesla)", "value": "9ec309f0857a97606d4346e004644bcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732387, "uuid": "3e583bb5-0cc4-41d3-bf57-52cc8ac5f914", "comment": "Malware payload (AgentTesla)", "value": "cada39d66d8f87ca051fdcc03e5e5b66cd35b8088c71edc96ce88c1f48880cbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732387, "uuid": "5d80bac3-4cde-4da9-8edd-5d787feae915", "comment": "Malware payload (AgentTesla)", "value": "181a74a3769db4edc978fa2f2467d1cafd4d1740", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732387, "uuid": "485090f8-7718-4f8f-a2e9-d4aa5f2b3628", "comment": "Malware payload (AgentTesla)", "value": "68b68f4a66efba9bda199284e80e010246718d93f616a4e02786b86681f62223d7be67e0d473473eea9db4f0987fdcea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732387, "uuid": "821fd777-1547-40a4-99f8-59a997dec5f0", "value": "T183441380B6E4C4F3DAB12571477D46627FFD8A032060536B4760EB7E74736866E0A793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732387, "uuid": "7d2ae166-f377-4700-b209-9a9915687c45", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732387, "uuid": "b63e4265-6226-4e72-9bf3-8dbd6816a5fe", "value": "6144:HNeZm5qumDp4tgbr7rmb9SBC3scrzKfsnnQHDFfm7YZU:HNl7gP7rm5sCPz3nkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732387, "uuid": "eef24280-c783-4968-af30-a08cc306f932", "value": 274747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732387, "uuid": "da2a49ac-e557-45c8-b155-b12aa65623dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732387, "uuid": "59c5cc24-8319-425d-8c1b-75747e089015", "value": "LUA22030.PDF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a84e18-cc47-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651736892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736892, "uuid": "002ab357-abd8-46f6-b633-8e39c417a1c4", "comment": "Malware payload", "value": "3bd93e6effa7bb69a21f0aa68a9133ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736892, "uuid": "af19e50f-f8c6-4a24-a399-9f81d5e10b0c", "comment": "Malware payload", "value": "cd8c5e613f97520398a478fa83c38bb08f6d2ccfdadab383c051aca7b8fd15d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736892, "uuid": "050f3918-bb7a-4665-a88f-ac9bc947fc3c", "comment": "Malware payload", "value": "9d762f2113fe786b229971645a5c823df8d4ebcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736892, "uuid": "a829f694-32c7-4d15-bb2e-e45831219373", "comment": "Malware payload", "value": "804ad215477e51b325ce6f6e7fee5fd91cffb2be8d836b60310eea8b6fc4b421ff723cbe313f232ea1aa2e6aaa69db5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736892, "uuid": "84da58d6-45e6-4e7d-9e84-fd3e4cabc5e9", "value": "T11883C5255A68C32DC6E98175FCB55635CB738A7730E0FAB29B50FDC93E12713210887A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736892, "uuid": "8182b352-2c07-4886-9ceb-92d8c861dffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736892, "uuid": "e0b85417-d469-440a-bd37-8825e2d1ceeb", "value": "1536:N/+8UlzbCvx5XP9ppxD+4CJ4xDhoc/Q7gdyxc3oYqN:WlzbwxDNNmzQyxc4YqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736892, "uuid": "f13a6a66-8f07-4ca3-b92b-10cce3a1291e", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736892, "uuid": "bf90c2c8-601d-4566-9015-c6922b84b1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736892, "uuid": "c0d660be-2478-4860-b3ee-f1f4b3761aae", "value": "TSMHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de55a02e-cc45-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651736099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736099, "uuid": "6188c81d-dbd2-4972-ac58-8bfc3bc6f2f7", "comment": "Malware payload (AgentTesla)", "value": "7aeafe5b73c4cebcc8d62aaf23757389", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736099, "uuid": "8160b063-3b3e-4725-93d7-c1bdb11b753e", "comment": "Malware payload (AgentTesla)", "value": "cdc13d990cd46b8aa3cad3cf1191359cc32f02c654ebf2e932880b9e77e658de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736099, "uuid": "7c44fc6e-3d97-4cae-bb3b-0c5bc6ed7c64", "comment": "Malware payload (AgentTesla)", "value": "cb62e4a6fc4bca778d12a60a0bbf1b35786b82de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651736099, "uuid": "422ff44a-e1f1-4a56-91a8-c972d5c886ce", "comment": "Malware payload (AgentTesla)", "value": "062daca43dfa89737a14b42931ba8f9697d6ffbdf985b998c4693e93d9a05ddbfdbe59b93a01375b69e726cfb5303c9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736099, "uuid": "72ed63dd-41c7-4184-a482-770badd1bec7", "value": "T16AF4CE9C721032EEC453D4728A9ACDB4EA512C76931B5143A4E32DAFFD6C59BCF184E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736099, "uuid": "ea2651df-e49b-464d-84bc-1554c9545c29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736099, "uuid": "23cae28d-95f7-4748-a780-b9b06e9b5039", "value": "12288:pFEX+lyMFHCy2L2I6BnsA9xSycj9TQOhugTjIjVnMJpjmW5KxXfrk8WwHAQlkJ8:pFF2Mn59xvcj9TDIgjIjaXmW5KVAQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651736099, "uuid": "6ad19879-3f83-4da0-8cb2-4e84c0c50584", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651736099, "uuid": "631424be-5a6f-475e-9ccf-6c7d4462332e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651736099, "uuid": "fb9d9728-9f50-4e55-9121-17c7cb5b8f8d", "value": "Inv_PL_ref2022047475,DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504821bc-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651757336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757336, "uuid": "d3ecc7bc-b947-4d16-896f-3ba03bd0a537", "comment": "Malware payload", "value": "e7020dccc06e9b38302352f515056c57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757336, "uuid": "ea9bbf72-15c4-4a0b-bc42-d91fd9cb910b", "comment": "Malware payload", "value": "cf693fb0c08e8e23de98bb5b848e6ee6f359f1efb26d1488bb9030c899d45005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757336, "uuid": "840cd50b-1d0c-41ee-987b-66fe1b12ea8c", "comment": "Malware payload", "value": "ef89c823157cdf19c8bd3f2cdc12738e1f12ef66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757336, "uuid": "a12f8b0b-6971-4846-ae5f-d24186090f8b", "comment": "Malware payload", "value": "679508e9269a85c854b9ce945d832df8e531438bba322a1ce85fe54b2ae0222276e8af2ffc6b1a9a105ded7603b3b9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757336, "uuid": "3559978e-1fac-4cf7-9363-fe194f6e639a", "value": "T11BD4F110BB90D034F5FB12F04A7A83A8B82E7DA19B2451CB53E42AEE57346E5EC31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757336, "uuid": "d1a08955-1287-4cce-b171-8cd711df1c8b", "value": "102925d1127f9c0032b267954e8e052b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757336, "uuid": "f573bb4f-d6e2-465f-b40c-b1d7e264759c", "value": "12288:ZQJ/4WXwcUWEGYcrFTyDD8qP5ywLk9fu13EdbjvW:IwhlWEG9yDD8qPjZ3E8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757336, "uuid": "e8bc1d10-fee3-4052-ad28-df8144a5b43f", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757336, "uuid": "80e953cc-9b7b-4234-b42f-5303be3c8a42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757336, "uuid": "182488d9-3af7-4844-baa6-eb363591a6e7", "value": "e7020dccc06e9b38302352f515056c57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d1d8eb-cc67-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651750550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750550, "uuid": "d4e325a5-aae3-4095-928b-1e7da32c4649", "comment": "Malware payload (Formbook)", "value": "f6bdfc8b44f06b6bf6c0e904131bbeeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750550, "uuid": "5a6ab9e5-6271-4d85-a558-4477bdb9dc52", "comment": "Malware payload (Formbook)", "value": "cfb5c7e930e81acd950ecdf05d148c637acd3242ec9c5a35fe8b9af8e1abc623", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750550, "uuid": "3ec35c73-2e1a-4ad4-acc6-90b6a46e4d13", "comment": "Malware payload (Formbook)", "value": "0244122e1bb438ca733d85dc2cf9ff806cf13a2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750550, "uuid": "69f3de78-f562-4d33-8c5a-53ab0008e93b", "comment": "Malware payload (Formbook)", "value": "2c54026c1838ee27d559fc48da87fe1fc3e1f75a4a9440e570605e4fd6b3ad0a17a9da41d16b0be9908a510dd8a1a4d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750550, "uuid": "07b99f4e-4304-4bff-a760-5ec79de30ba0", "value": "T1A2241210B3B0D667E9A64B756E358B073BBA671124B4434B9B609F4D3927FC1BA0E703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750550, "uuid": "8898583c-497e-4f3c-b868-6ec28bc8dc4c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750550, "uuid": "97950fac-464b-4574-bd38-2b1beeff8860", "value": "3072:l1NjcVVnLpPunbwTsKMvYfx0uq3qB9QUVYD/JqBEMgNAYaIN9HIUcTk7bcKIBJta:HNeZmwTsnvYfxxCC/gNqMy9kcKIpAq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750550, "uuid": "41428494-ed51-4f17-a369-688662bf4355", "value": 219481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750550, "uuid": "17aeb9a3-fa81-4bde-95b1-ba479e1d3035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750550, "uuid": "ed21fc18-6539-4a7d-97c7-df0de55f84b1", "value": "f6bdfc8b44f06b6bf6c0e904131bbeeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f346ee-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651732936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732936, "uuid": "1677b04f-7777-426f-90dd-120b6d5b9a99", "comment": "Malware payload (SnakeKeylogger)", "value": "d7899556e88ad3b3531d886d1a810d2d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732936, "uuid": "ee1487b4-6a0c-4780-9893-3f17553d6e99", "comment": "Malware payload (SnakeKeylogger)", "value": "cfba9e7232df7743b763ede9dd97b24e48e5d66c4fb1dae4843cb3c4db467a2c", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732936, "uuid": "2b43727f-3074-466a-a572-88aef055ce68", "comment": "Malware payload (SnakeKeylogger)", "value": "9ff2020410eddbf57ca68613e547d6c60153a5e5", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732936, "uuid": "3325f051-08e7-4903-ab8c-dbec15f9e9df", "comment": "Malware payload (SnakeKeylogger)", "value": "122d93ff58dee02dadd4f8de5c340857efc8d255d62a9ff6800c3d3b7a6066088cd4485691ec2b05fc219a17265822c7", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732936, "uuid": "3064e7e3-4ac6-4d96-a48a-36f1d9e0f3ce", "value": "T1D69433B9A0D9BF39CFD1279B2380B30A4913A18DFB439DA8474D4ED71B465353EC5648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732936, "uuid": "fed2ff29-fa17-42bb-a1eb-73d0216f0470", "value": "12288:FdIOvgpDafw/qSjwje9hg7AHKjX37U6Ehws3gaw:FdeMoqSjwjebMAHKjX37pEhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732936, "uuid": "acb19032-a96b-433f-85c0-d268312cd34d", "value": 439750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732936, "uuid": "08bb55a5-63df-426b-8da3-9d6d3c8514e1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732936, "uuid": "738df0ab-7bb7-4607-8286-2e5caffe3d54", "value": "PO#22-4500 22000482,pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07dd489-cc67-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651750706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750706, "uuid": "c84a688a-2a83-4aab-b352-27c889c9835a", "comment": "Malware payload (AgentTesla)", "value": "e7797fabc8ab8dec904355c6306e02ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750706, "uuid": "0379048b-951f-4ce9-963a-c91b73570304", "comment": "Malware payload (AgentTesla)", "value": "cfbdb914bd52e0fa0961e928eb818cd0bff52c5cc3e3b83f8c87c225e8d5af52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750706, "uuid": "84f4d20f-59c3-410d-9ed7-37a5d0bb0f2a", "comment": "Malware payload (AgentTesla)", "value": "1f31d5d6d9064b4890b14b6c7b8e2f85f77d30ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651750706, "uuid": "95118f8b-c63c-4a03-a552-99aa0a981cc1", "comment": "Malware payload (AgentTesla)", "value": "807f2f4410b07003310a64105bc9b8ddc57f0d50f169f468d39b41390a9d554df9d8893fd33517828714fa48ca489b98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750706, "uuid": "0c30d2c1-df29-429d-abbc-d0b8ad480538", "value": "T10B04A381D4DC7CE0D49605B42CBABB50311EEB5E982A0E59BE73B52986761E73073E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750706, "uuid": "1f92f763-f5f1-4b61-876f-afd858a42243", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750706, "uuid": "e3865322-65c5-41d0-a2de-eed28a5e2035", "value": "3072:eg8HtJFBG3Qxb6OlLfWX4TfX4t4KAX4eAX4AXRX4Mmn4A454AX4OX4pX4jAX4AXw:6NJb0Ypo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651750706, "uuid": "8d78e750-76a9-48e7-aa89-62c4fd521a66", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651750706, "uuid": "5f4d9db4-4aaf-4df4-befb-3ec3d8936bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651750706, "uuid": "b18b73c0-27a7-43a3-bcff-93d49c7e0561", "value": "CASTEC VINA TRADING Co., - NEW PO#2022CTV05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6745bd55-cc39-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651730745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730745, "uuid": "4f801b98-8892-42e4-b946-257956e85357", "comment": "Malware payload (Formbook)", "value": "5fc986129c3d833b1c7e5ba6ff3678bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730745, "uuid": "54cff384-7cc8-4cad-b1d0-f3ce12ed0145", "comment": "Malware payload (Formbook)", "value": "d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730745, "uuid": "9b2c21aa-d696-47f2-adf9-97168e234843", "comment": "Malware payload (Formbook)", "value": "2ace6bc0488df9b8592e25be3de38e6c9a0c16da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730745, "uuid": "8384885e-6a28-4331-8371-8b66ce05fedf", "comment": "Malware payload (Formbook)", "value": "4a00a2d75a0bda5629a1704adfc3ee1646e43efbdeca3aa45d75bbfa4c94ae78c3f750dc4d2e0c023ae7f652658ee928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730745, "uuid": "b8227f8e-adde-4c81-8e33-3732b6b63b7e", "value": "T1DA2412351380C8E7D91B07305E392BA7D7B9AB366375931B139826ACBCA1391E31F794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730745, "uuid": "dae2169e-cba9-42b2-95f0-d10d42d8f524", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730745, "uuid": "1bda8995-0f82-40bd-ac49-6782f66a8129", "value": "3072:l1NjcVVnLpPunbD0r9X/MP5LsCIVa1aP+KQ4kFHP67DzJEhShrM/joS9zAQNgOau:HNeZmQrV/MP8XXklIiheMLPztvau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730745, "uuid": "69475ece-02a6-42fc-bc6d-7bbc0e58bc21", "value": 219440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730745, "uuid": "4c6a9f58-99f0-4a08-b91f-471d79803b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730745, "uuid": "0e954267-0ecc-4e13-b9ba-a4c5c5422c52", "value": "5fc986129c3d833b1c7e5ba6ff3678bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e6ab43-cc12-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651714073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714073, "uuid": "a090953d-7315-49ba-bd6c-ec9f176c68ca", "comment": "Malware payload (RedLineStealer)", "value": "310eb5bd45ac9c5767d28e63ab64635b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714073, "uuid": "cb497a50-1596-4e94-bead-8f969ebd90ae", "comment": "Malware payload (RedLineStealer)", "value": "d1d622e31d20a69fc6fea0d98996607f37f6204bb02625bfb329cfdbb8edb6e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714073, "uuid": "281bca84-62b3-4aea-89ae-cf0225893d93", "comment": "Malware payload (RedLineStealer)", "value": "4ac0d40abb71e9fcff34c8f67511fc590f495f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651714073, "uuid": "821c4ef5-72dc-4e2c-8ca1-9291064548b1", "comment": "Malware payload (RedLineStealer)", "value": "d0b5e6e9c88ddecce0904dbe5d96bb9dd8b90a1e39ef29509bc8b8713c429c9a21be351148db7732d1df492140f0f433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714073, "uuid": "869e0751-2478-4f1b-95cb-7e469ba27254", "value": "T1EC75ADB7384C859AE91B8E70C834E6620B5F9D238F55089652DC3DA7B83B1F0647DD8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714073, "uuid": "c999fe4b-5238-43ab-b0b1-b58c4e2d3ec4", "value": "efad26290bf4d1a676b7ad79139e8cdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714073, "uuid": "fd5ddb05-6ecf-4f13-aac7-901ae2b28701", "value": "24576:07L4j8tb74F0xt7ruJV/QujUOycEvgyJrDybsxXX+ZVGNVooHI9s5KCfj2:07L4jIIct7w/QujMvOgUwLoKIG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651714073, "uuid": "e5ea2ceb-a619-4486-a36e-c891aa8b1582", "value": 1579064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651714073, "uuid": "b321dbb9-7626-468a-bad1-95f73bc90461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651714073, "uuid": "1283d237-e78e-4aa4-9fe5-05da9f8975d5", "value": "CryptoMiner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2c3c0c-cc38-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651730166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730166, "uuid": "1f969687-4541-459f-abdf-d491e2a19a01", "comment": "Malware payload (AgentTesla)", "value": "4bd987fadc09715256aac483bd096588", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730166, "uuid": "50db4e9e-f486-4d88-acff-387c8572ba36", "comment": "Malware payload (AgentTesla)", "value": "d2a15bc37d82c300a6f57910ea624261a5d71a73776d974dccc7c2eb6e62f80b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730166, "uuid": "323553d2-242d-4894-8d62-83013aedecbc", "comment": "Malware payload (AgentTesla)", "value": "ba1cfa7efda4becdf54f8f9abd3b1ea774d47b69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651730166, "uuid": "4cfbd09b-f502-48a0-b4b6-ef850dfb2b64", "comment": "Malware payload (AgentTesla)", "value": "eb05750e6997f2098ac8a9e5ebf8f845bb38a29e473c68acd8db4f88fa07e24d0546dd3a98a579d1a8dd62598768d050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730166, "uuid": "07f6384b-5a4f-45b3-acd8-b81658b16a50", "value": "T143C4231592F7577AF27137B925B403C413B23C5FF82BE7D928D0A2EE58507924268BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730166, "uuid": "e62fdad6-6a78-4d66-ad31-0babfdfe59d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730166, "uuid": "71d45e44-f144-49e5-b743-6e860c25956b", "value": "12288:52L2Ik6RD4OcIBK6R4f3Nn+uXGHrzlR8q90xmI:52W6qOBp4fNv2XlOq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651730166, "uuid": "12913b6b-e883-473f-bca0-31babee70ed8", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651730166, "uuid": "e26b3e12-40b5-4673-a8f0-a4319692e1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651730166, "uuid": "a00bcfa3-f4f4-4407-a7bd-8c23a3bacfe9", "value": "4bd987fadc09715256aac483bd096588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe3804d-cc0d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651711969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711969, "uuid": "41a16cbd-a655-43b4-b8d3-1d5cf02db2d4", "comment": "Malware payload (RedLineStealer)", "value": "72c3ecf8d0bbd0474f0cdd9b985623e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711969, "uuid": "565d20a2-1795-4688-96d1-43dbd16bcb25", "comment": "Malware payload (RedLineStealer)", "value": "d3695e6eec03bb66addeb0a25b25d3a910648fec8c4af1f00dda9f40953d98c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711969, "uuid": "97e2d99b-94c6-48a2-8e48-b0d2c80c54aa", "comment": "Malware payload (RedLineStealer)", "value": "6a066d6f722ae2d50b3a0e142ad0b6d5506703d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651711969, "uuid": "c7938bf1-c045-40e4-ad80-b54ea9954930", "comment": "Malware payload (RedLineStealer)", "value": "7c38c1944fa89a6f8f7e5aa1c7045a5af05f423b4366de96c4c1bbb00a0536138188b6f1acfb0c288e1b271444ddee88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711969, "uuid": "c75ff781-e61a-4de3-856b-004a5d4e2776", "value": "T160456CA7C382511FF6633032C25ED676961623312A4F78ABB7086FF8D72B1E15925B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711969, "uuid": "66927214-e410-4736-be1f-1452b211513c", "value": "95c60137b5c1bf3b2e377aefce384dee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711969, "uuid": "fbfcacf9-4067-40b3-869b-d0572862ce79", "value": "24576:2L7OOVtstl3e/+hPY1QogwZpxPeBwPRluapy2KVCxYeo2RBhzXRiU:2fOFs+hydCwtpyTeo2RBhDRiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651711969, "uuid": "2eab4826-b049-4142-a95b-048f1cb44fff", "value": 1240616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651711969, "uuid": "70e08c46-824f-4f09-a1a2-aeb0c2d91dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651711969, "uuid": "1186c5d8-5da7-4cfc-985e-a294a5bbe3d6", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592dad4f-cc3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651732440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732440, "uuid": "86787e55-9d26-4b17-9acc-26c5cdeb0193", "comment": "Malware payload (AgentTesla)", "value": "69bbf1c20493b681c0da04f7eb4abad7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732440, "uuid": "d3fa3a5a-0d85-44c7-bbe4-f114b3d9e2c7", "comment": "Malware payload (AgentTesla)", "value": "d3be2ee3efb4181dfeeb50d0a3aec292733ab22c39ee474dfd7f3f18780f1224", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732440, "uuid": "84f1e622-8c12-4cd6-b395-6365fdae6a15", "comment": "Malware payload (AgentTesla)", "value": "b63ca0d52272d97ae8e56c0de2c875b1c36aa919", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732440, "uuid": "216411c0-531c-499b-b6ce-1820a1dbd8f6", "comment": "Malware payload (AgentTesla)", "value": "66387e839ccf2160c17c4e16f5dfe948a823c573c8b977047e6f9b44f965876cb9af3b78e01855e7ede995aad9fc21bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732440, "uuid": "7cd16272-6b54-45e9-aafc-672d6c8c96f7", "value": "T124041D52EBB6EF35DE34093F8245B3255F2E5E9181F2BD8D704DB1642EB9E00C5806AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732440, "uuid": "6f6bd2a5-0208-45df-b8c1-50accf80490d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732440, "uuid": "a7d1cd19-c546-4364-9ffd-c9c6c88b8cac", "value": "384:qz5pff+JJMCjoHitQmwww6BKpwWowwwl6ES0JXtZhVm13j2tSHPWcDeaY5:qz5tpR6ES0JXtZhVm13j2tSHPWcSaY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732440, "uuid": "f4b386ce-a0dd-452a-a0b8-b6466127fcbd", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732440, "uuid": "bc9b7292-4abb-4ad1-afc4-ea160250fe40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732440, "uuid": "b6c343d8-8738-4c79-a130-23db6bc15df3", "value": "SecuriteInfo.com.W32.AIDetectNet.01.20266.7009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7814d41-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651745966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745966, "uuid": "b9d33b87-cba8-425d-9a2d-350686e964db", "comment": "Malware payload (SnakeKeylogger)", "value": "77d3bc0edb49384980b21eb976fde07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745966, "uuid": "08420fb3-7237-4f5c-9040-9d43abb40fea", "comment": "Malware payload (SnakeKeylogger)", "value": "d4d1c3d345c6c7e12ad33daee3b333c965e89682987e109f8dcab813f0fff64a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745966, "uuid": "bfff98f3-9cb4-4497-be77-8749108b9790", "comment": "Malware payload (SnakeKeylogger)", "value": "14267db00b18222bfde5391b8c2f5d0167459299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745966, "uuid": "35269873-7e69-4211-89c1-aad076a017af", "comment": "Malware payload (SnakeKeylogger)", "value": "d93e5ba0e3c64194bbb1b27c084ad884feb549a34977c3bc3502c32ead630c2d3b957ac919267f4ac61ed589d9bdb84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745966, "uuid": "7eed262a-9024-424c-bbfc-48b553e2a2dc", "value": "T124E2A2373284FEA3D9AC767334EA5A7EAA76AF410111D23F4880794F88B77002573695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745966, "uuid": "e82e83cd-0f4e-4e22-9d6d-21164b661111", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745966, "uuid": "a831cc26-583e-4c86-9cad-473ebfaedf10", "value": "384:M6iCffo9LfhX2/JiFzTAyOw/f1rvgQVD7k14hPsyILf:M6izKJiFzTAcFzyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745966, "uuid": "b8e0ba26-ee49-4b5f-a009-1b46559cd132", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745966, "uuid": "69904b1c-5eb6-40a8-8b1e-54a3863c6d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745966, "uuid": "8417334d-ff60-4133-8b28-5f5e69317a27", "value": "RTL6078510006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e4190b-ccce-11ec-8e58-42010a9c0032", "comment": "Malware payload (MimiKatz)", "timestamp": 1651794596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794596, "uuid": "4e60ec68-0a33-4e44-882d-d56d201c5b12", "comment": "Malware payload (MimiKatz)", "value": "5d2a1283d3c29c884df2cada55a63e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794596, "uuid": "8e685293-45e6-49f2-8f4e-7918e160418e", "comment": "Malware payload (MimiKatz)", "value": "d5ffa8d752453355afb189875f6cb5e5ba4c3f00846573b56d1ca53e8fa9aa29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794596, "uuid": "151506a3-ef65-46ec-882b-3acca2a20ab6", "comment": "Malware payload (MimiKatz)", "value": "06f09df0737880b81bd3cb7374c48f104d1d1276", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651794596, "uuid": "86c51745-72c9-40d3-9462-396fd3ea9cd1", "comment": "Malware payload (MimiKatz)", "value": "cf78dafb1fe21905818af85f13e0109bcac5c6fc9195126a2f70f083245f652f87d383fe0b7d0f080da064e34b6d870f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794596, "uuid": "7bfebf7c-40a9-4932-b0ce-8f982b16859a", "value": "T16C45D8A13C004398813795BDB4985FDB356468CBC254E22930D9B8F83D5AFEE5A8F4E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794596, "uuid": "0c709ebc-dff3-4cbd-b9ad-6f29ca0d24d1", "value": "74cf8a4d5658900fd8658c07f4267cb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794596, "uuid": "0965cf73-3a7d-4e8b-8261-d51287128bf9", "value": "24576:2a2RgCeV6jac65BcO5CJIOIomF7zT2J9F2shPd:F7CeV6jmBEcshPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651794596, "uuid": "179b07a3-722e-4db9-9ef3-0c02474246e4", "value": 1271808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651794596, "uuid": "cbd9097a-787c-4b28-bed9-9aaa10518bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651794596, "uuid": "c9ad4d01-0be8-421d-95d9-46664233b1ce", "value": "\u8868\u59d0\u7b2c\u4e00\u6b21\u6765\u6211\u5bb6\u505a\u5ba2 \u5c31\u6765\u6211\u623f\u95f4\u641e\u536b\u751f \u5b9e\u5728\u5fcd\u4e0d\u4f4f\u88ab\u6252\u5149\u8863\u670d \u731b\u624e \u9ad8\u6e05\u5728\u7ebf\u89c2\u770b.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d46a53-ccbd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1651787490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787490, "uuid": "aa44d539-4408-4a4f-9b70-696262173f5a", "comment": "Malware payload (AsyncRAT)", "value": "2e25a30c76eb1348402a45e3a3b72c71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787490, "uuid": "b5d5065b-e2b8-4cab-b758-47c607f9e74e", "comment": "Malware payload (AsyncRAT)", "value": "d70380869b6e15ff6788965d1569ce009c3e5e36f279fbd2052efb1c88e2faea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787490, "uuid": "abd1014c-7949-4ec1-b808-a548ae524e87", "comment": "Malware payload (AsyncRAT)", "value": "efdc7749fc9f70a323090c345f3de61d5c14d623", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787490, "uuid": "ff1d2b4e-3883-4dc6-bf2c-f755260f219c", "comment": "Malware payload (AsyncRAT)", "value": "03397b3643503abd12ba944700f0e090f31a282d7ae372e8206d3cb497efee402c56220930898e530b6c468b6aebc54b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787490, "uuid": "e5fd477a-600a-461c-96a8-bd6375b93a7f", "value": "T161A4F12071139967C17907B2DAD552A003F62E6EF056E24B7DDA13CB9652BFA1EC0F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787490, "uuid": "5ee28968-dd15-4ccc-9109-2ad3f301273b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787490, "uuid": "7f362c2f-1533-4743-9352-31e859cca060", "value": "6144:YzrDe3g42YuO7sTBMI3W3hwMh1vI8Y+IXWs4hC0U2JHgjetE1bhEGNUvNDYM8l8G:YR42L2Im3hn+rXD2CDMH+hEGNUTOIV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651787490, "uuid": "1020ebb8-bded-48ce-ba5a-66b1fee7a9b2", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651787490, "uuid": "6781f525-19c1-4370-b30b-0f47dc7aa70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787490, "uuid": "c0433ca6-72ba-4c40-9393-047771da87d9", "value": "2e25a30c76eb1348402a45e3a3b72c71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285a6a06-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651757269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757269, "uuid": "06d43c09-9de0-4cba-a64d-27bd75714ed6", "comment": "Malware payload", "value": "13df6443bf24d0e49566735b93f22646", "object_relation": "md5", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757269, "uuid": "be9cd865-622d-4288-82a1-653beed26fbf", "comment": "Malware payload", "value": "d73a1fcb447423601c0320f401c3af45be01c74c31aa803a8ebd07bf6f65a051", "object_relation": "sha256", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757269, "uuid": "7a15d3e9-34b6-4d45-9ba7-31b084bae653", "comment": "Malware payload", "value": "fda9557c7a1f9cd21c41634f82206efaa6c74692", "object_relation": "sha1", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757269, "uuid": "5fa501ec-0fd5-4226-953a-6aa399311298", "comment": "Malware payload", "value": "257371158e960ff9e8040df8bc5a8a2a25d908ad2c6c235676fd5804ca3d8f0b708bb066ba414701de77b3f2b5a6b656", "object_relation": "sha3-384", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757269, "uuid": "616eb262-9eee-4796-80be-f3ddc7169178", "value": "T17C46239AE718A02FC9B755734E7B472112A68D4E05C3AF233A58721C2EB7A844F5DFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757269, "uuid": "8995cf02-7865-41a7-8235-b85496d9676c", "value": "98304:0ysjdQHwRzUrkPtYpP2Ap5Leld6WxeNIUCwyQAZPsM+yJPLOYfifCNPKg59ofrpq:rl2Qr9/zO5xnUCwXgd+yJ2CNPKg5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757269, "uuid": "f0b66a6c-7f11-494c-b26e-b461acd2ab33", "value": 5442279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757269, "uuid": "e58fa4d6-3de1-40fa-80ac-6b2fe8382f36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757269, "uuid": "af14f925-4eb4-4255-a42a-ef0b0e6e4ee4", "value": "QR Code BarCode Scanner.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c00ee06-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651759449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759449, "uuid": "34bc8557-a5f6-4cb9-92ea-868fd703e35f", "comment": "Malware payload", "value": "abe87097d1d02fc8bc472cae4808412a", "object_relation": "md5", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759449, "uuid": "1f37c9c8-9237-4f7c-8d14-d1c21264d460", "comment": "Malware payload", "value": "d7b86bd5b6d01d6209c575a6c84852fc2dcba8d5da0170cd1c1e21763c4ef68d", "object_relation": "sha256", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759449, "uuid": "a2d907b8-145a-4b0d-a91f-01544dbfa662", "comment": "Malware payload", "value": "6a448fce7b160c4391e052e626c5fca084e95edf", "object_relation": "sha1", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759449, "uuid": "d52b83b2-63e2-46a8-979d-6beaf5c41a84", "comment": "Malware payload", "value": "2e9f3850b5b046103abee9c97f429eaf08e6dfbe0c10cf55aa48ff3235b30fc0f3e8e85e543d657559fe3202c93a2585", "object_relation": "sha3-384", "Tag": [ { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759449, "uuid": "c92a4d75-f0b8-433d-93c1-23898e169a92", "value": "T1253533871E36244D6E50C0B48971B313B78FB06AAEB6746F1AB1975F19F378F0428627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759449, "uuid": "425e07c2-93a2-4e85-a1b5-74dcb1a49739", "value": "24576:CrxiMBfwwxar8FX4PNWNZG886THEJTyKT1KFj9G3IZ5FEC:CrQ0YEFolW/HEciKFjk4Z53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759449, "uuid": "7b7a0fe0-5cb3-433c-bf2f-dd2bcf4ec038", "value": 1067140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759449, "uuid": "57831a95-20c3-45a0-ad9d-52bffd1216f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759449, "uuid": "c3339c47-e723-41a6-941c-e3d77fa144e7", "value": "Cancellation-1541944530$-May5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a8a9ca-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651746184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746184, "uuid": "03e899c5-1c29-41cb-822e-605a65d2f042", "comment": "Malware payload (Loki)", "value": "d12a7345a04b01ec1ace83acc44b56a6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746184, "uuid": "eb1f660f-9bed-45f9-8e3a-8b88e414d84b", "comment": "Malware payload (Loki)", "value": "d9525da047cd45229d1070d60b47d7ee31db6af075b1337d87a9a69f167b3f81", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746184, "uuid": "d3a0a953-57f9-4ee5-b1db-400249b3e8a6", "comment": "Malware payload (Loki)", "value": "93b7854b51f38c1778d54481ecc86704fb70a614", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746184, "uuid": "35146e59-0d70-478c-a9bb-054fd0102c74", "comment": "Malware payload (Loki)", "value": "d6dd36fd8ba185fe38a54394485b00c266739c9fcb10e69f67e3546d62672a031a602fea68e854e64c7867fc110d09d4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746184, "uuid": "12646ca9-19a1-4247-b636-dca42de4a9f8", "value": "T1562412067220CA81D37EA4B99FC9054B41DACC90215BF5B01AA073EDE777EC65978F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746184, "uuid": "4c7a2202-b542-42ef-bb5e-51c977df36b3", "value": "6144:1gpKBlmQWthALu3etDgZ4HlSFwMiBiLl3qpZcd:qQsQWGuORjlOuOopad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746184, "uuid": "3c5d378e-37bd-4ed1-9cbd-d654d57635c4", "value": 211848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746184, "uuid": "3a612d2c-1100-4407-8771-1772d5993c2c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746184, "uuid": "3e823200-1c36-41e7-a2e2-858bfc301818", "value": "RQ0849.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fae907-cc5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651746239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746239, "uuid": "763b7761-3011-498c-85dc-092a3ab75fcb", "comment": "Malware payload (AgentTesla)", "value": "15d34a4afb6603e7aa9136dfc7203110", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746239, "uuid": "3c59587d-883b-4087-9e44-77771dd796a2", "comment": "Malware payload (AgentTesla)", "value": "db5db22edd918c7e68663664b48455c0a4b59055ddbe9a70cdcb405db6fdff36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746239, "uuid": "bc870ae1-c211-421a-ae54-74a04bd61946", "comment": "Malware payload (AgentTesla)", "value": "8163afd11b30717ed6941f53b22be2e2a8f6abb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746239, "uuid": "ca941bee-0244-4504-9d09-b51f148509a1", "comment": "Malware payload (AgentTesla)", "value": "5bc5b7bd4b96afff64a2aa772676a1ded2c792cb2f508eabf9cba04b1dc9c9f2ac1fbe92443ca49705fc537149e2b0d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746239, "uuid": "f72a33e4-9522-4240-a060-6df180322fe0", "value": "T19844124876A1D1A7D4E642320F794A146BF8792314A4074F1B20DF6FBA26BD0C5CFF9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746239, "uuid": "6f078fa9-2f19-47d3-a6f4-3db0c79b5b12", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746239, "uuid": "a89e14c0-479e-4317-85e6-6be461142166", "value": "6144:HNeZm6h0gkFqDXNFVBCZt4lZSlIH9vnxiYcNAbnZbnp3mtJznx:HNl6h8gDX7vC9IH7iYcNSZ9W/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746239, "uuid": "017676bc-38ff-4ae8-be91-d4ad22dbacde", "value": 270394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746239, "uuid": "28edda33-bf8f-46dc-9774-ae3ec6ad4cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746239, "uuid": "f089001b-fab1-417a-b1f5-eea658168aa4", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b743f3-cc7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1651759895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "cb223031-c435-41d7-a33e-5ca980777638", "comment": "Malware payload (njrat)", "value": "097dd527ce73a5aeb0a31a372ebe12e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "3ac48012-6d78-46c4-9df1-dcb6fb13c840", "comment": "Malware payload (njrat)", "value": "dc3ff238364d0e6bc07b0024d5239020a364bc9c54b1a2ee078655ec55be792e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "84de27d4-33be-4278-bd38-56084cf6c81c", "comment": "Malware payload (njrat)", "value": "4fa6f2bb5328e22bba549167cfb68dbe4d26ff4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759895, "uuid": "be0d77d4-8a8e-4c10-9d2f-c22e47076c2c", "comment": "Malware payload (njrat)", "value": "a9931866eace0d2737bb2cf37fa1b55747663094df67c141a104fef56efb5067798ec00411b7b4648948d06871cb4131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "c16422aa-d5ef-4bff-92bf-7f0835071662", "value": "T1FFA429693A879BDDF8B9C7786A18519443F8FCE3C306E1DCFDE870CB1416B45AA62421", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "96b2be03-51fa-4be7-ba14-5cee25a8aecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "ff736166-9f9a-4ea4-ba06-824c7d3081e6", "value": "6144:tTpsHYXmy5mWFRSstebkTl2uvP2svx4G08Ur8iZ64080aBfyUD3ss48/n:tTqzzSnJ0Rr83Z8DRXLY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759895, "uuid": "9bde257e-896d-4d11-b4fa-c39b1ee19b7c", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759895, "uuid": "7a5ab71a-4c2d-40b8-b8e7-66dfbafc5bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759895, "uuid": "6ee36481-a445-4f05-a0ca-4341747108a7", "value": "097dd527ce73a5aeb0a31a372ebe12e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efecb4b-cc93-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651769413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769413, "uuid": "ec8c040e-18a8-4a0d-a603-766b66df29d1", "comment": "Malware payload", "value": "863e2527f4428524d5c074dd22fba55d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769413, "uuid": "d30dcbd3-2e74-4238-925a-f2e2da24753c", "comment": "Malware payload", "value": "dce67cae19ecfa93b4ea54ba05784752315638a2317dc5e2c1476855e6787937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769413, "uuid": "97725e54-66fb-4371-8e78-4eb5a2fbbd9a", "comment": "Malware payload", "value": "185238f2c1713d206b78d4704228a5bb154e81c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769413, "uuid": "858ac42b-e5c7-4754-bac5-d2a152052bb1", "comment": "Malware payload", "value": "e409b2a3d3be5562e0dcbd7c505d1bcd6030e2cbad16cb1ba96199f7ac187a671cc0fb6b40c1c6321ab1225c8d056222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769413, "uuid": "da518076-9e92-4467-941a-bf4bbf0a2a04", "value": "T10ED4EF103A5CAA01C97ADE745883C17283F79C8E7E62A13A9BD3BD7F7850741D663A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769413, "uuid": "e00c6c4b-b78f-4e82-8b68-0f6e5d001bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769413, "uuid": "f3f8337a-6478-4aeb-a2a5-126d7ea16c34", "value": "12288:I14uLjdAOFPcUedLTQbkohR5iokYof2cHhNsj9eUrxfeS7JG4TpC:iL3RZcUQTQ4o96YofRHEjfxf37JV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769413, "uuid": "d1591fbd-ee94-483c-bb6e-49cb90ec5b9b", "value": 621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769413, "uuid": "eb66091f-a106-47fd-a6ab-d56a3b6c95ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769413, "uuid": "20a571bd-9601-40ff-a42e-0b92cac2dab7", "value": "sales contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9efd6dd-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651733058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733058, "uuid": "478a2274-fc12-4ce0-a0b6-6b2cd0d0ba30", "comment": "Malware payload", "value": "b6028f4f988de34a17bdbcadfe3f9be4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733058, "uuid": "43700fc5-ac8a-42e8-90c2-e5ed34ef8149", "comment": "Malware payload", "value": "dd10ce357b0e31392236a4b6087232fc50aca97424f7ae1187c0b004058716df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733058, "uuid": "d71194ba-1e23-477f-bec7-47e3da9dde32", "comment": "Malware payload", "value": "46d3fde9946bb2de2168c47e48de2900a98fecd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733058, "uuid": "e30a0006-4ea4-4fa8-b539-7842ba4c79b7", "comment": "Malware payload", "value": "f03a44cb167517becc1a3886d2cf8a3c38a7aea865f916f9c24872d26e915d06492f2490ecf69b10e2db022414268418", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733058, "uuid": "6489b437-ee58-46b7-bab3-218bde31219a", "value": "T19784BF10BB50D034F5BB22F05976C368753EBEA1972554CB62E43AEE66346E0EC3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733058, "uuid": "6c71ba5c-ec6b-43e6-ad8c-a0dcc99fa780", "value": "385a4b49bc7f35a1da1bc61d9c1bfe6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733058, "uuid": "00118188-e174-4958-a48b-740adb1e3869", "value": "6144:bhOGCoKoz5+lHWNt/YV4Mcdv/IYOHPJ2hgLQjANYOyOKjSBFMeFxaJ5HJ4:bgJxoE8xYV4Mw/ITQ6kkNG3jdMM5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733058, "uuid": "79b4920c-53cf-4c36-ac1a-03103ca69a1e", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733058, "uuid": "1d1948be-2f5b-483e-ac16-ac296600e501", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733058, "uuid": "14e4f432-e10f-4cf7-8759-07005b57a5b4", "value": "b6028f4f988de34a17bdbcadfe3f9be4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52c25e0-cc51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651741238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741238, "uuid": "cff3c133-aaef-44aa-b76d-f9678f766900", "comment": "Malware payload (Stop)", "value": "991afeda6fe58e51a11ee7e16bb7bcf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741238, "uuid": "bda38ab0-c1c5-4886-9012-2f078d75970f", "comment": "Malware payload (Stop)", "value": "deb7fd4d9fa4e337954fc8c6ee4664a77e162465eac8c40af4b5f7a6f2536b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741238, "uuid": "342455d9-b64d-4555-aff8-8816d0438fd4", "comment": "Malware payload (Stop)", "value": "9910e025f95e788fce7f943662f817ed4ec4f635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651741238, "uuid": "5eaee889-6b2c-4035-9bcb-af8cf4398070", "comment": "Malware payload (Stop)", "value": "43d032edfbb6c90ca448ad2251034f9d6916a0bbd96e4834f7fca1822044a0281118d1edf3cb1b401ded443778de7217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741238, "uuid": "5d1d5757-8acd-4a50-8d79-a3640cc677ac", "value": "T1DE05F101BB60D031E1B762F0497993A9693E7DB1972454CB63E47AEE1B34AE0ED3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741238, "uuid": "4a6f162a-4e92-40e2-a2b4-5960f8d87414", "value": "385a4b49bc7f35a1da1bc61d9c1bfe6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741238, "uuid": "57a7132e-b874-467f-9fb8-de1f870389eb", "value": "24576:4uia5D75kZD0tNba3nVvCwk63CxNmhS9Z:XiORk10tNba3zkQCfm8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651741238, "uuid": "35d23c05-2b66-49ea-b494-e9f74e0223dd", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651741238, "uuid": "91c7d79b-5779-4e16-bfc0-4cd36f9fdc90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651741238, "uuid": "0b82428f-292d-4cf0-b6a0-d9930b1c0cf6", "value": "991afeda6fe58e51a11ee7e16bb7bcf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bb33db-cc6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1651752052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651752052, "uuid": "c39d5b3f-7dda-45a5-9fbe-1ca4dd508bf7", "comment": "Malware payload (TeamBot)", "value": "70ad60f3383f5f8a3e05d5cdc952a84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651752052, "uuid": "c1aed139-2181-43aa-b4c5-7b5f6e27b841", "comment": "Malware payload (TeamBot)", "value": "df88af4e45114c998871c654fd2a3ecd28ee20928f04ff9bd5a19bd8b6b5816b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651752052, "uuid": "7d9775a5-3a2a-4a9a-bde8-bd5469138952", "comment": "Malware payload (TeamBot)", "value": "4b649c84ba283dcaa897174edeb4805952ff37e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651752052, "uuid": "6842788e-9808-499d-82d6-6d058fb24a1e", "comment": "Malware payload (TeamBot)", "value": "fa426d4051f66869be91e07840d3223ccb78c1dda1b4915310ac1d55dd6b1bfbfe1384139d496b95c757776e833e5d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651752052, "uuid": "99b34961-52fc-44b2-abd4-425775497f59", "value": "T182548D00BBA0D035F1BB15F54979C36CB92DBDA19B2451CB62D42AEE6734AE4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651752052, "uuid": "03a455c5-abd0-42fc-8624-731b83fd0370", "value": "102925d1127f9c0032b267954e8e052b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651752052, "uuid": "30fdf65e-7d54-4166-a60e-5a63aed924a4", "value": "6144:IIDGhkXt1W44AwObSVYePI47HbJ+5jDMmL6e:Ica4/Z4AwObSNPIEbJ+LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651752052, "uuid": "5aebe3a7-a927-4de0-8b24-7d2b29dfcd4c", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651752052, "uuid": "f860846d-7f94-43d3-8298-d559218cddf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651752052, "uuid": "d8271f1c-bdf7-470e-b3f2-10a303afcd4f", "value": "70ad60f3383f5f8a3e05d5cdc952a84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe6dc32-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651729284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729284, "uuid": "7074975c-671f-4678-aaf8-d9f744b1362b", "comment": "Malware payload (Formbook)", "value": "c3f3bfc5d28585cfdd0ffe3ca9d27466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729284, "uuid": "738b7c0e-36a1-4bf9-8340-013c4eefc79f", "comment": "Malware payload (Formbook)", "value": "e068472192705c282033d8a215d5ba5f63d9b80d339df9a419f7ab93bab042d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729284, "uuid": "0703565b-17a3-4aa3-be17-10fcca31e53c", "comment": "Malware payload (Formbook)", "value": "19f998f85c9828804894c7819af8aa4371d6cc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729284, "uuid": "4b51b598-520e-4e51-b81b-4c277487225d", "comment": "Malware payload (Formbook)", "value": "8bffd88fd90db7be82b580641aaa58cf025ceb52bf5d2f22a70a212c69607d8d8e211cd73a4b790314c59bf36110733e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729284, "uuid": "868064ce-01d7-4900-a96e-e1a2775fcdee", "value": "T1F52412C1B2D9C47BE4F346321D3693772BABEA371228860F47218A5D3E25751DE0E396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729284, "uuid": "97c800bc-d1d5-446c-bbd7-6951aa187344", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729284, "uuid": "459ebbd6-ea62-4d06-a74e-131f2d1046b4", "value": "6144:HNeZmDlmMhTvecUTEwCLylkaeXPgMDL/EcrBKtWqjB:HNlPlULCyk5gwL3VkBjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729284, "uuid": "3226201d-d287-4c96-9f2e-23d5d8b64cec", "value": 219468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729284, "uuid": "0c92fd6b-27e5-4453-99f1-11c6cdecf666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729284, "uuid": "d9e5a440-ea39-4a2c-ba60-953ab11ca0e2", "value": "c3f3bfc5d28585cfdd0ffe3ca9d27466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95450f9-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651733031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733031, "uuid": "c99a6c56-e6ab-4616-8311-3f9d9d375061", "comment": "Malware payload (Loki)", "value": "d2ce3b2a5f3efb1fcede96304e57a531", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733031, "uuid": "f2652ee8-2dcb-4c65-885d-e383a9d0e761", "comment": "Malware payload (Loki)", "value": "e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733031, "uuid": "804a760c-7ea0-4e3a-86c8-654559b17854", "comment": "Malware payload (Loki)", "value": "d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733031, "uuid": "d1adc9b9-ea57-488c-bd4e-c9183de32c67", "comment": "Malware payload (Loki)", "value": "cee682e68b73477bbda081ed8185c5224c0ca2f995f3b43640f534661932f084dfa2921a663f0d96a71951ab52f9d106", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733031, "uuid": "73d8e322-a337-44db-a84b-c5c93b6dd5dd", "value": "T183C3F1157AE0C467C8631A712E3A5BA75FF2D5331234538F5320AF9C7E36A91990E743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733031, "uuid": "2053441b-f948-4864-a9b1-904fc0bcd7dd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733031, "uuid": "83608e60-34a4-4b5c-a810-585e2166c750", "value": "3072:l1NjcVVnLpPunbrclqvVjW/GAk+dOH6yzqwr1O+5ZFy:HNeZmrc+/AkDBzqwwqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733031, "uuid": "f03d89bb-6822-4be4-a95d-8f07c7325dfc", "value": 126706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733031, "uuid": "b5be925e-69f0-4b1f-96d1-01072a386b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733031, "uuid": "46ddd2df-6858-4198-8990-e91354a48a6c", "value": "d2ce3b2a5f3efb1fcede96304e57a531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77322b7a-cc81-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1651761696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761696, "uuid": "a77ea4fd-cf28-4598-8403-f57c37dcc889", "comment": "Malware payload (SystemBC)", "value": "7b7328a020bf16f8a3915f1a0b4e7ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761696, "uuid": "97d883a0-1a6d-4a9d-b048-5c69d2b223ac", "comment": "Malware payload (SystemBC)", "value": "e2cc138b0051fc6d2dce76941e2190d964c51754dac13705f63dad2941ccbba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761696, "uuid": "648f8c19-66d6-4d84-a16c-2d379f66f780", "comment": "Malware payload (SystemBC)", "value": "dd3636d4d11c4a1b9618622cbf758c18dd89cffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651761696, "uuid": "5a3edbdd-08c1-4df1-b7b1-fcf29e12b2b3", "comment": "Malware payload (SystemBC)", "value": "c62970dee3ad3e9c0caaff6b9c21f2442b38ceab14afcb843b1c5548dcd53d1e2ff0ca6286b26fc0ea1970ef0b4b3806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761696, "uuid": "d3d0e678-ea81-4ec6-be14-476b928d6b9e", "value": "T1AE52E7D734618D65C016C6B07E6FA720D4BE6175153A9039EFE00F287B3EA63DB2271A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761696, "uuid": "aa2a7938-d7c5-4639-bb83-643953fa1d22", "value": "801793b2be29822524e8824fc3c47535", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761696, "uuid": "29216ad1-9779-45a8-970f-019b5f8ec476", "value": "192:3kWjQTlZ1eB+pvdNtj2+SPwHP+Q/ZCv2qwvuCKK76n9bJHOkrUNM:3kjTlZ02NtvSKP+cZC+qwZPGn9bJrUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651761696, "uuid": "0cff39ec-68d0-4438-a006-156011339340", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651761696, "uuid": "d4d1aad8-d2c1-42d6-80d8-2b0185b97955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651761696, "uuid": "3ff9bb08-8940-4f23-9be1-f1337023a7fc", "value": "7b7328a020bf16f8a3915f1a0b4e7ecb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1958aa-cc93-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651769571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769571, "uuid": "28bc3c65-5c11-4e08-94c0-e99ad4aa351b", "comment": "Malware payload (AgentTesla)", "value": "1cdc4a0e08300a403f1b806cbd8870a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769571, "uuid": "ccdd1732-c983-43ef-988c-32906e7c94d5", "comment": "Malware payload (AgentTesla)", "value": "e55cecdcbe1ea88fe5bb5a483297fc9df3947ee543cec8a30ecf2f3aadc59413", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769571, "uuid": "336e8d4e-b422-4e23-a58f-5be69d03e4c6", "comment": "Malware payload (AgentTesla)", "value": "efffe1c5d64950f22b20e9aae635f8c76f7bb067", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769571, "uuid": "4e1ae257-6d6c-421c-94f7-266aebb1ea9c", "comment": "Malware payload (AgentTesla)", "value": "8b1adf747367e2282fa6b4b2d758faf635c30a49f0c43be2bba0ba2f64e63448881eef1fdb62c6e292066f7343433c77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769571, "uuid": "06ccda1c-9a7f-4882-83e1-897d2b50f17d", "value": "T179F4E0142A6CAA10C57ADF745993C17593E39C8F7922E13AA7E7BCBF7914700C263A31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769571, "uuid": "d5206882-7198-4e57-9cfc-9d7e5bc282bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769571, "uuid": "2a254bbe-d2aa-4931-82fa-2aea9d2b4037", "value": "12288:p1vuL9xk1O9fOQb4OYeGQy4Je3O2WpXmHs6dfgXqn7B44JiREpe:XmUw4OYeGQFJGO2WpX+1OqNlJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769571, "uuid": "654fd1b2-4f74-4172-a45b-8eb1a6a04b92", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769571, "uuid": "1ac945bb-d417-4cf1-b6d7-e600e77e698c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769571, "uuid": "9ef2f3be-4dd0-4e97-bb93-90a8ab5c333a", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deb2be1-cc61-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651747990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747990, "uuid": "1fba4ad2-1fbd-446b-9aa0-eeb53f2f5a25", "comment": "Malware payload (Formbook)", "value": "4915f9b3f1f8701c746f8e1d41c42c10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747990, "uuid": "5d3569ae-a18f-4d75-8484-f9158c63ae73", "comment": "Malware payload (Formbook)", "value": "e6151eb0148e2cc0e89eabc995cb5e6620131a8a658d1eb3c78da753066543be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747990, "uuid": "913fee25-aee6-49e2-a9cf-381d86abef7f", "comment": "Malware payload (Formbook)", "value": "30399ef50fd09099f31c93f3a36e1b6fd2ee07e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651747990, "uuid": "95eed386-e9a5-4e30-b6ad-3bbb16bfa712", "comment": "Malware payload (Formbook)", "value": "5fe5a975ecaf38b775c4bcbe04c88a138d7d05004c5d81a70e5cfc23cd97f0d7b3b9299eeabe73fcd737c5a7b1070b95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747990, "uuid": "4a996972-0dc8-4224-b0f2-7cd51ff096f0", "value": "T150356ED1F15088ABED6B05F1BD2AA53024E3BE9C54A4810C659DBB1B76F3352209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747990, "uuid": "2b802add-adaf-4e79-a554-4e2e3bd52350", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747990, "uuid": "1c8d689f-f196-4a4f-9b41-9cb60291c69e", "value": "12288:g3xUlO41oSaMxU/1hUgCt9uoUoLeugYcGkWfipt8yXGRWVWgyjo34goijV3gtTjt:LO4wH1NoLeuyGBiH5GRvo346jZt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651747990, "uuid": "aae043a0-0fb5-43d8-b170-0f528f4196e8", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651747990, "uuid": "3df7d1af-9cc8-435b-91bf-cca2bc20c9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651747990, "uuid": "852d6509-3c3f-4978-9caa-3d77f155e0d0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.5198.19647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169b2be1-cc20-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651719873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719873, "uuid": "d9212c7b-2771-4c6d-98d6-d3d278fac735", "comment": "Malware payload", "value": "40c6d6d0194688cf981bd2c090efb08a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719873, "uuid": "306bc09f-e925-44a0-a273-2a605e0680c2", "comment": "Malware payload", "value": "e9338c5d2bed541d261f279a69418853e6effbd5d96a06cc11a22168e2ae31a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719873, "uuid": "349c7b56-c2ec-40e6-a675-7d694b49095b", "comment": "Malware payload", "value": "4f9f0b45a298a7ccedb69890c24a1df51483392e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651719873, "uuid": "94fdfac6-56b7-42ef-b7c3-fd1a74c491ce", "comment": "Malware payload", "value": "83106593812383707eb17cc1b9a223bc9313e88d2c57afb8ba8149ffddb79cc089d007bff7d1cf077239b9a7f00f6cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719873, "uuid": "a57fce66-b2bb-4a85-b757-fe0db48739b9", "value": "T18C84915263E90964F5F76F70D8764622AB333C859E3DC24F0290955E2EB2B94EC38763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719873, "uuid": "439f2fc7-445b-4deb-b23f-0f1e3c8514fe", "value": "1e639356dd901bb602ff9ef5b3730809", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719873, "uuid": "2d7cb114-c346-4fb4-af61-ade75049d4b6", "value": "6144:kKrRlByVChnelfkylErdaooMArkOYZ41DWrDpsNX2:kKN7wChnel7lErkoAAsNX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651719873, "uuid": "0c1eb906-2859-4380-85fb-c06df366156e", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651719873, "uuid": "d19186cc-1947-4d69-aecc-aa47b340b46f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651719873, "uuid": "074e84e6-fb39-4a48-864a-6ebacb35a3c3", "value": "winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf013cb9-cc7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651759696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759696, "uuid": "45ef4efa-9eb9-4026-8712-2d1b2bcacaa1", "comment": "Malware payload (Quakbot)", "value": "16f6f4abd19fc1956a536d13ec18088a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759696, "uuid": "4674f5d4-87bb-4d6d-9efe-b4f4a07fecb9", "comment": "Malware payload (Quakbot)", "value": "e941c28da1fca27de32514686e3c5dfa6fbc713764d16715bd285534bd983fd3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759696, "uuid": "adfc493a-5b31-4bcd-9659-0dd6de4e9cfd", "comment": "Malware payload (Quakbot)", "value": "e8fe64cf6e4e1088951a664c85957f4bd7112d48", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651759696, "uuid": "45d7c88d-a1e5-4a45-87d3-42fcc07bb858", "comment": "Malware payload (Quakbot)", "value": "9ab76bd868b5dce3cd9e83e4ab0d2ce34d54bdc1bc2d2e253bf368476f32f51a7d91090218ad149c1f1ee6d379045843", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama182", "colour": "#064599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759696, "uuid": "21118476-a658-4f2a-b438-88f3696ed2fb", "value": "T1ABF48E22A3D34836DD77163D8C5B93949825FD413D34DCFA2BE4EE6C8E39A403A1529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759696, "uuid": "c1bfaebb-a95b-4e11-9544-9ebadda3c850", "value": "1f323ccab9817929388091e1b9ddaddf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759696, "uuid": "2501f685-32d2-4116-b8a8-bba467eee524", "value": "12288:b0tFRlN3qlI7Sq77ti3kKvKJPXWwvPi90Q1acvZRz5Bt:bUzrOKfQUDZC71RZRdBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651759696, "uuid": "5ac19250-e0c4-4544-ad16-1ec7ac4c74f1", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651759696, "uuid": "6dee13e8-c59a-49a0-b725-4009b865093b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651759696, "uuid": "e48eab5e-7fee-44d3-91f8-b781caab1f4f", "value": "44686.6703604167.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3a7f42-cc79-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1651758080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758080, "uuid": "0bca321d-670c-40e1-83b6-26b567d454c1", "comment": "Malware payload (RemcosRAT)", "value": "d174700f8ac3d45fe7e401ce0981b660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758080, "uuid": "afafa601-e804-4c6a-924b-020e7bc8328b", "comment": "Malware payload (RemcosRAT)", "value": "e9f0de091b5fd4d63fb10f0deca4e360a78341675f2bbef4c03f8cb89c081844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758080, "uuid": "20419d7e-e2a8-4d7f-8005-0a7e35e882f8", "comment": "Malware payload (RemcosRAT)", "value": "783308adb61306d105297ab0fc4d651a53bac69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651758080, "uuid": "d11838e8-9328-4b38-9b84-ef4f6f16f27c", "comment": "Malware payload (RemcosRAT)", "value": "41ced67cd92f53e72f3e43f9e0d7a53590c8ba22335c239195fd7c5f42bba29ded933c41da9fb7967b20fcc53559b6fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758080, "uuid": "5dd6208a-ec4f-4583-b208-797945bcaf8c", "value": "T13515F19C325072EFC867D4B29E982CA4FA5578BB931F5243A01711EDEA5D88BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758080, "uuid": "075bca09-81e1-4982-b312-17149e63723a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758080, "uuid": "e15e5b4b-1f0f-4b9c-a9cd-7f18234eb943", "value": "12288:Gfbbk1+fMQcMTwgoVCbS2L2Ipgrkx6cppRXAyibQCwSoOlpfiP1zkuwdTmZANxUN:Gfbg20kZbRXLi8CloYpO1zgU8sX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651758080, "uuid": "72e0148a-3298-42fb-a548-b74f18db8ae4", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651758080, "uuid": "7c1b9118-0a58-43cf-bca0-1e95d442124e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651758080, "uuid": "ad5e9ae6-5d1d-4bc2-88f2-4ae7aa7bab00", "value": "ENQUIRY 20220505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bcaa1b-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651733405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "4562ff15-3d50-4bee-8792-bfaf7f619415", "comment": "Malware payload (Mirai)", "value": "77b3b81884de158d0be17078d6304aab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "424bcb8e-8259-4d4b-9d4d-6bd371e3d8b8", "comment": "Malware payload (Mirai)", "value": "ea7a4c6e2b6bbe76da460ccc0f14c5717027b35ec11498b3ab6d2ed747dd010b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "1be012a7-20d3-45d5-b642-db865da03948", "comment": "Malware payload (Mirai)", "value": "ca186826e253b5fd15c750ce6dd7ad95e261dfe2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733405, "uuid": "813da998-e50c-4ed5-b8c9-478ae8c59bfc", "comment": "Malware payload (Mirai)", "value": "b587ed4ef73eae4cdfd3f881aeb8c9c3f87e7e1ab109896b018d52a269fc2d82bb5e90aa88adb4bcaf341b9d597e0fd0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733405, "uuid": "b8084db5-148f-4ea0-8029-9dfa77cc9aac", "value": "T10AB2D03455CED9F1F3B55C32B179824371974359C5E8B0531209DF7888CAE9264B9ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733405, "uuid": "5a4ee058-7abb-4e4e-aa42-1b36a37df855", "value": "768:r9MhmNhHXqPpM/eCkWsQ2a51e7i/rA2b7As3Uoze:r9QmNhHXqx4ec2M/E2dze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733405, "uuid": "f08586a9-6536-4872-bd34-56d431e279a0", "value": 24656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733405, "uuid": "bf7398e9-9bf7-434c-8e9a-3dc65e8883db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733405, "uuid": "9b1df337-06ce-49b7-b2b0-ef069f5ffbe4", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4c07f0-cc2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651725142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725142, "uuid": "553f8aff-46e1-4d7a-832f-cbbe009946d6", "comment": "Malware payload (Formbook)", "value": "86d56360aded47a00d23049357c6f69f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725142, "uuid": "fab25c60-a5cb-4d8b-8783-66b68254d474", "comment": "Malware payload (Formbook)", "value": "eaa4e2adb72f1527d81303db909e73c696bfe29e3ed0d91cb4ff35f47e4abfb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725142, "uuid": "e2a7445d-a29b-4dad-a228-cb8ef5d0731d", "comment": "Malware payload (Formbook)", "value": "b0fdcdfaeeebd751b8f0a4bcf68f8485015ba241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725142, "uuid": "febfd75c-698b-4a4d-bd7f-768d54ba696d", "comment": "Malware payload (Formbook)", "value": "f7e35abceba61b86d79c4a272584b239b0047201b64924181ef21f53703a98e7070b8b3232f7373d65c146fa77c1bd66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725142, "uuid": "bc4254d7-2822-465b-9239-e037c7098fd7", "value": "T185056AAD27BEF619F0BE2DF62608C0807D1C4A9B519DCBE321B589227459E4D04EF2F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725142, "uuid": "61ef1a4e-f5b1-453e-b9e1-84d1017d926a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725142, "uuid": "8b5ad7cf-e9ee-4683-a4df-c3e6811f9a93", "value": "12288:531MYVTk8uQLO0W4LBzPhz0RUnRvv959voKYaq27wYvdB+DJX76cHZ:FGYJhbx0unhv95hoKYa37JdB+D96cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651725142, "uuid": "1f70ec03-d6a4-4aaf-9a4e-308bc33d2c47", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651725142, "uuid": "03ae9637-8419-4316-ab99-0a9463ea67ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725142, "uuid": "dd09f50e-aeaa-49e3-b555-42e40404269b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.23554.31646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7520702b-cc40-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651733775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733775, "uuid": "54aa8e35-1281-4343-9486-8f2d3a41f982", "comment": "Malware payload (Stop)", "value": "f0d1a0a4623d96f3414267739210601a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733775, "uuid": "6d208291-cb54-4d09-aa45-3470bb90b944", "comment": "Malware payload (Stop)", "value": "eab73d395002cf2dad653902d6a913b19dd06c61132d80119d2f888e0e4255c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733775, "uuid": "92e2b96a-60b6-4a4f-a8e6-097593f8f21c", "comment": "Malware payload (Stop)", "value": "813f7a04a6621dd5861e3db79569258185f3b4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733775, "uuid": "ac98c7c5-b72f-4cd4-951c-c315390ff913", "comment": "Malware payload (Stop)", "value": "973a6b2ab69a4927aad112a40dffe37161366ed2e9faeffbdb6d7463124776ec0de532228e3cc6043fa0cd97d00b0597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733775, "uuid": "419cc1c0-da7b-4c38-abf0-2763b64de144", "value": "T1C20512117980D832C8B5C131D774D5E05E2EB816AA740D8BB7183BBB6E706E05FB636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733775, "uuid": "a0bf4b28-96d9-4f39-ac18-253359b2e206", "value": "c92c44d7360054a6004a469108181909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733775, "uuid": "9ecfeefe-c823-43b3-a85d-79d2ab88c24e", "value": "12288:mtVNmldv4koZ0NmMU7z8FXDwRyO7m7ChDRZ2zsGBGXeRb:Omldv4viNjpG9vB8Rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733775, "uuid": "c8b39fd1-acdf-4063-b119-533cf2b8389f", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733775, "uuid": "fcd310f5-6bba-4e3e-a691-ae388878240d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733775, "uuid": "32365525-c510-4911-94db-f6f333274eeb", "value": "f0d1a0a4623d96f3414267739210601a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5119c4ed-cc31-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651727272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727272, "uuid": "a79ca7ac-c2ae-4dc1-aff7-51c8cac8425d", "comment": "Malware payload (AveMariaRAT)", "value": "3ad0dd796a3158c36f83672bce97e941", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727272, "uuid": "f4e5b2c8-348a-4acc-9268-4821a83381df", "comment": "Malware payload (AveMariaRAT)", "value": "ead18cf53833bfd5af8b6cbf60fb0d58d3f957ba1848b1ec66129926710d5deb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727272, "uuid": "773a7f93-062b-468a-bcf7-26814b2a3d35", "comment": "Malware payload (AveMariaRAT)", "value": "13d91c4aeb49427be53b005486429432b7fa323c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727272, "uuid": "666d3475-bb9e-4fef-9b8f-b7cc329ecd52", "comment": "Malware payload (AveMariaRAT)", "value": "7b0d759d68c8908a1bfc2f1c269af564f4c0e41da07f2761b8a82b8771bae093634b047bafe377ec4fbe982c0741519e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727272, "uuid": "e1767d65-9c66-4459-83c0-759e83197404", "value": "T17DA4024CA1AC9B13EA6F8BF86564261187F03A357186FBDB8CD570E40E7D7D18890E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727272, "uuid": "8c5d7c51-7adf-43fd-896e-b2d635dae836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727272, "uuid": "d3b2df06-9a3d-4da1-a40d-caed5e6b1c4c", "value": "12288:9bLWJeX8Zl/rF0I5JFfDnoUxS/fkhaHPyZ:9HQ/Zl/rF0sD6/fkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727272, "uuid": "7fd939d4-3b4f-4e64-9242-1efe0faee3c2", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727272, "uuid": "400c99a4-e2e8-48e1-a362-eb69ca8514ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727272, "uuid": "a03ed2be-afab-41c0-9d52-45f2bd3f1ade", "value": "3ad0dd796a3158c36f83672bce97e941.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778534e8-cc93-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651769427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769427, "uuid": "549c113d-dade-412b-b1c9-2d2fcbb71ba7", "comment": "Malware payload (RedLineStealer)", "value": "46c39efee1b645bdd2853be6b6b32ae5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769427, "uuid": "f99d8be6-6443-4707-a707-11bfdbaffc1d", "comment": "Malware payload (RedLineStealer)", "value": "eb17d6c767eab942cbdea2f4ee08e53207365606d713ede533336b7f6310bab2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769427, "uuid": "43a2eb3c-2316-40c8-bc9d-989e37ccb51e", "comment": "Malware payload (RedLineStealer)", "value": "765e815e50ac98fa600b9b41705923ca2a03263e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769427, "uuid": "c81f9aa6-ad9c-4b03-bad6-1116f7322b46", "comment": "Malware payload (RedLineStealer)", "value": "28b958f0cf56120a4cc55b4ef2e5d73f8372828e7a8a4fe1ac155c4af46d90974a13fd6892e45f20d947d72c57e0066a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769427, "uuid": "2e7555c0-8e65-4685-adae-4dbbaa9e77c7", "value": "T1E8448D10BB90C035F1B722F4497A93A9B93EBAA05B7590CB63D526ED06357E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769427, "uuid": "0ebc3c46-ebb2-4247-9d9e-abc266ba3294", "value": "f22c415437cc9d7cf824990538373125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769427, "uuid": "5f83ce2a-98fa-4e2d-964e-76a9b4b58e4b", "value": "3072:3jE7Wy7LZE/iO4MV+YNK+bly6ZrrJHA0WRkecnBJYvKmPGN50wLnEy4WewHlGAK:3Kyb4MUUK+blrZrNA0WRkTwvKqNWpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769427, "uuid": "faf9321a-a2dc-4398-9b84-b7dc2ab7f848", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769427, "uuid": "d5ad5cce-6ff8-4569-93bc-c805b779f017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769427, "uuid": "a3764185-2b96-4cd4-8406-a4a9bf6959a0", "value": "EB17D6C767EAB942CBDEA2F4EE08E53207365606D713E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db30c149-cc1d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651718914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718914, "uuid": "337b7e96-0ec6-4da3-8381-4b42de43065a", "comment": "Malware payload (Mirai)", "value": "33d816aa780a1d3f32dc9de94b1eb1a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718914, "uuid": "a707510c-5deb-441d-9b13-6561cb8f95b2", "comment": "Malware payload (Mirai)", "value": "ec5966f8fa80c67f776caece31787f99b609747c86c576a44e24ad4dbd9e6450", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718914, "uuid": "5ab973a8-d29a-4ff1-9062-b7fdc13bc55a", "comment": "Malware payload (Mirai)", "value": "cc7e5c67cb5879c0dd4b2fb0907482e9c0aa1ff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651718914, "uuid": "db847691-ef18-47ef-aeb5-01726f2e0539", "comment": "Malware payload (Mirai)", "value": "ec6155c7f24eefe16b8de6ab0d5a532bbd5a901f77834d9763360380e91dd938b290acef4dce639eddde5b81022f31e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718914, "uuid": "bf5e4a35-d9fc-4aac-b124-a571c97308a9", "value": "T1B9D2D045E50B1CD2DEEAAEB11D89C3D0BFF20B8FB3D652869185FF011A1972A3904DE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718914, "uuid": "87693e16-7a9b-4ec5-bd2a-e7758a64bb70", "value": "768:STg8OxaNX0TxCLQl5rXBfjUeNeU4uVcqgw09c:SROINlLE5jRjNl4u+qgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651718914, "uuid": "0b1b0c83-c4bf-4ba5-a08a-2a33e528e217", "value": 28724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651718914, "uuid": "867b633a-2a7b-46ac-b584-307fa3d3dfbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651718914, "uuid": "366eadc1-d0cd-4a36-b881-25362c9b4dc6", "value": "33d816aa780a1d3f32dc9de94b1eb1a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0504bf8-cc15-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651715406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715406, "uuid": "00324f08-fd06-49ea-b00a-0d929ec196a5", "comment": "Malware payload (Mirai)", "value": "9c2ac2fdf7f17f0e40c81235f977938b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715406, "uuid": "e66a07ad-3b75-4d6c-9282-2f73334b2df2", "comment": "Malware payload (Mirai)", "value": "ed401f3fd6bd7d07fd5efdd8b677517bf289ee8c3b69e22a0693926cdff88551", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715406, "uuid": "e70bc253-7fbc-4884-aa29-b13ded11d495", "comment": "Malware payload (Mirai)", "value": "90bc61c4548bd5b32d421e74a5165607d8a0317a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651715406, "uuid": "6151719b-c31d-4e28-9f81-c2384caae809", "comment": "Malware payload (Mirai)", "value": "3ac85de008f9a9e1715517b2830e5d3e06491bbd4841620d281fcf6fc5992dd8fa414ed8cc7ae8823ee3ace00dad1925", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715406, "uuid": "c92472c9-adea-4d1b-b0be-e4d80e31064c", "value": "T137E2E1A1F305BA5AF63448B4D4C4DDC333936970DAEB321376903A0939D890B65F86CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715406, "uuid": "b9468bd6-d127-4c76-a7bc-143e17e33354", "value": "768:6VzWclMnf1LzbKP01VH1JC85QOV3zuTrLgJaus3Uozj:wMnhbKqZC8mae/Tzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651715406, "uuid": "88eb0db0-e413-4551-93f8-8aea391dd077", "value": 32640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651715406, "uuid": "c3614273-75ea-49a6-912a-f75ad2a0cc9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651715406, "uuid": "a72cbfab-4da9-4bf4-9968-a70b350893ff", "value": "arm-20220505-0150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb9fd0b-cc49-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651737657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737657, "uuid": "7ce25475-1f9a-4ff8-873b-aaedd722df3c", "comment": "Malware payload (AgentTesla)", "value": "dc95e75f87f7b9946a97fc9631789ac2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737657, "uuid": "a205e2e7-81de-4320-9746-a38cef0aa696", "comment": "Malware payload (AgentTesla)", "value": "ee06c118453dd664f0490f76690f7394e0918834138852402c4c4a384a20defa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737657, "uuid": "dc391b29-41e2-4107-971d-69daa615e195", "comment": "Malware payload (AgentTesla)", "value": "4a36310592f928b5aec9d400fced50f86a3e5158", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651737657, "uuid": "4ae9b140-a5de-4612-91ce-a5096d16552c", "comment": "Malware payload (AgentTesla)", "value": "9da90e19c957aceaaf0f70856a46c3f8f5c635ae1b4cbc6841713d0634154ab6c2edce971b29616045881fc673bacded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737657, "uuid": "516095ae-dbb6-4f22-8c35-88c5391caf14", "value": "T1B7D423353097D6D3FE701B76712A4EDC2781A646ED07B04E3BE6314B998FAD23E4A409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737657, "uuid": "c2c4111c-b5e6-43d9-b43f-5c441250b622", "value": "12288:eKSeLdPTN22KqKUzG/xoZZD6xgoL3e6FKs9FmjKSdKOTfk0yT:eKXb22KUGoZD6yYKs9ZSdKgfryT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651737657, "uuid": "3a93d6a6-3ca1-48af-8b0b-e4e4532fc305", "value": 601300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651737657, "uuid": "89503593-3926-40ab-9a45-86b669e35652", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651737657, "uuid": "0f979af1-6565-4292-8b97-412b3a2c59fa", "value": "PO#7A68D20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79aaa490-ccbe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651787899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787899, "uuid": "3f4726d1-c63a-4399-8f08-574aceeba7ca", "comment": "Malware payload", "value": "661d064b6e8b3673085a52e65659ccf2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787899, "uuid": "e0b05162-e2ba-4a3a-8d1f-f9746c550e9e", "comment": "Malware payload", "value": "ee62ef16793c13ff2b3965a2c8407ffc9744c830f1f39799749b0fd281bf2f80", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787899, "uuid": "c3ba56ca-426e-4dad-8f40-82db40b5763e", "comment": "Malware payload", "value": "c6b541e3a2376b4fd0bfbd072f1d953c3789a4f8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787899, "uuid": "8c2af99f-abea-4ae6-b318-d3192e3d2d21", "comment": "Malware payload", "value": "4d700197eb15ff877e567da808547f0a577d1a3ff3205db65615edf62f7d8217b7f6ccd5313a96c9ad7ec954cd7e3f17", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787899, "uuid": "e1e2f18c-fc1f-451b-92ce-15cc0ac86b7d", "value": "T11BA51213F6A1E95BC8F6C37220751635513B1E19CB43B78A281877FE68B7EE80B816D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787899, "uuid": "ee08cd46-896c-4eed-9af7-670b89cca855", "value": "49152:1F/NUkkSUXGD9HVBrhaWvirkxBfsnx4G+a4jB1oP/hK:1dKkkpXkHrQYiraWnx4GejBiP/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651787899, "uuid": "700b9ad9-6f15-4fd2-886a-f48742e450d7", "value": 2073782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651787899, "uuid": "0f633a66-b0ad-4055-adc6-73b60e10ff7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787899, "uuid": "40bfff4b-d78d-46b8-b018-ed2265ce5c12", "value": "app-3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582c3a0f-ccbe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651787843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787843, "uuid": "1e077f98-a691-465a-8595-cb262eb23669", "comment": "Malware payload", "value": "fdc88b40988c047025845ac1e67fcce6", "object_relation": "md5", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787843, "uuid": "c041fe4f-463b-4ba4-b00d-4f0ea5679747", "comment": "Malware payload", "value": "ee67d2045a4fd48c17424ef1e13b23212c8c687b42bc447df14cc737c6211d8d", "object_relation": "sha256", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787843, "uuid": "30b3a2c2-a7a2-48b7-87e3-a70a0387972d", "comment": "Malware payload", "value": "70b856f5e4610946652907184bcc8b362d49b681", "object_relation": "sha1", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651787843, "uuid": "0bf764cc-2531-430d-a2e2-50305baae161", "comment": "Malware payload", "value": "21ce6dab1819dd8d8709599aff1ab3ddfbe27ac49019daad573ba95b377652e40e4a373051e7c6908620639190ff4dac", "object_relation": "sha3-384", "Tag": [ { "name": "Gootkit", "colour": "#5EFCF9", "exportable": true, "hide_tag": false }, { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787843, "uuid": "45f3b66b-ea81-4be7-910e-bbabbc2c77fc", "value": "T1888302C50827A8C356CD16B9D86967031F3C9FB6A320EDB297B53204DEC27DB44EAD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787843, "uuid": "23cb86c5-6803-464e-b033-00b712533b42", "value": "1536:70dZsbMxRfsr2BsZPq/2GIAz5ZUIVhCI0zV3XiybIk67NnSXdQmFmsK4KBMWl:70dZ5lsrGw42GfzHiIiHIk67NSXdQ0lM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651787843, "uuid": "2f29ec7f-fb94-4259-a413-0e076ce1cbcc", "value": 87725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651787843, "uuid": "9e96a878-d125-402e-aced-f8afe3f4e4cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651787843, "uuid": "1c3ee4aa-6ce3-442a-b0f9-2c15b7e3486b", "value": "how to cancel a house purchase agreement(60905).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d49ef38-cc2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651724259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651724259, "uuid": "0208b0a3-e5f6-44bb-a561-70b2b8323ef7", "comment": "Malware payload (AgentTesla)", "value": "6f0e93c5c3c308b5a2ef5553b54061c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651724259, "uuid": "3ff637c1-18a5-419a-ac78-4a1995e944dc", "comment": "Malware payload (AgentTesla)", "value": "eedd8e36fccdd66ba60d50f2c187b6600550332a3d377338f3641eb8cff7f1e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651724259, "uuid": "65fdd265-be98-4f50-a400-745388b22df9", "comment": "Malware payload (AgentTesla)", "value": "22db00e2dc83edec11610b2775d5a7475c0d41fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651724259, "uuid": "209d02e6-53cc-4822-80a5-040d2ccb93cc", "comment": "Malware payload (AgentTesla)", "value": "1f4b40ae9d17c76f8722e4b851f56bc035588518527dc2cd5652d429127ea0a322605456666b4c7c74a01c9a0a887b3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651724259, "uuid": "f541047c-5813-4ffc-b1f1-409612ad03fe", "value": "T125740D91E8535838CA244778BA7396B01CF9EC70C907E6716B207EE6F13BA20ED75572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651724259, "uuid": "8ebfcf09-4d16-4b8e-90a5-57dc33ad65b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651724259, "uuid": "808c3f56-ab79-4a26-8897-8e2aad514789", "value": "6144:WXnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwwjwX:WWtWrnngnnnKnanxNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651724259, "uuid": "eb9aca51-2474-42f3-9bf1-ff24d7905fc7", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651724259, "uuid": "71e90a56-c286-4f74-ad6b-d03ba4c048d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651724259, "uuid": "dfdbfe45-5b1d-499a-9994-a2ba11ccf29a", "value": "Ekfrf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c6945a-cc59-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651744681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744681, "uuid": "3d1e2c7e-19ac-4786-9dcc-bedc424415c2", "comment": "Malware payload (SnakeKeylogger)", "value": "94593a748438a6310b61698a960d80fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744681, "uuid": "da777218-d269-41de-84b9-0ca739f113f6", "comment": "Malware payload (SnakeKeylogger)", "value": "ef1b0adc935ef86750b69b047a674cf10846407da6ce0b4479773d41697160b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744681, "uuid": "dd34b4f0-ab14-4da7-b4ef-201227d640de", "comment": "Malware payload (SnakeKeylogger)", "value": "c9ab9e1e5444a67a26609a1bcada3967ba536067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651744681, "uuid": "acab4bc1-78de-4035-8a55-c339b15ed7ed", "comment": "Malware payload (SnakeKeylogger)", "value": "87a61fac2d29d9db8d5ae091f45aaa1f9b0afee38dae64eb1ab6976108e7acb6d9774abe8158005d1201b6a7e9b2b831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744681, "uuid": "e7e61836-d6f8-49cc-8f09-d86c1656c4fe", "value": "T134D4079C366C31DEC857C972CAA81C64EA6074BFBB1B91039027159D9E0EB97DF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744681, "uuid": "ad274b86-9457-40f3-aede-e5cdf80c15ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744681, "uuid": "c03cd80e-e84a-4ddc-8809-1c67033ce5e4", "value": "12288:9eGRgjrqnZfvisJ4XbGQl4jiua+ba2iNnc15XXgda9B7ser9DRZrU6uRoGIVu5/D:9gHqpvisCL5lu5ba1RcbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651744681, "uuid": "01ce70b9-2755-43d3-a5c1-6cc074a751b0", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651744681, "uuid": "d25e93d4-2ac5-46af-bda3-66f4c22aa89e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651744681, "uuid": "b5ce7ae9-777c-4b60-bfba-91e0ed304945", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7408c9fe-cc31-11ec-8e58-42010a9c0032", "comment": "Malware payload (BlackGuard)", "timestamp": 1651727331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727331, "uuid": "825bee06-7c18-4e92-a4f9-33568e306de0", "comment": "Malware payload (BlackGuard)", "value": "5eeb48cdd75819735e3051c095ea142a", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727331, "uuid": "74816de9-77db-403f-9c65-621a0cc7fe38", "comment": "Malware payload (BlackGuard)", "value": "ef50e73a5cfe39668c16914a9d2b4d0f399c507486c0f240b0e9ecd1b3bee557", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727331, "uuid": "5fa74136-934b-4c16-996b-1bcc5a9ec757", "comment": "Malware payload (BlackGuard)", "value": "f9a9ffb27a2e7110ca30a1034ce921f3b794ed47", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651727331, "uuid": "2918f260-87ab-4785-99a7-11839f85a96a", "comment": "Malware payload (BlackGuard)", "value": "19e940595b3356cfe39d73907faa6d60f19aed22b262d3395a90de025e8744ec5bfd4b7eb3f15c466d5a4e32052b1d27", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727331, "uuid": "bbb20f98-b764-43e5-8532-cdfcf8ba1351", "value": "T151C50213FF898A12C2881736C5D7552447B3D5C22337DB0A7ACA13915E833EEDD8E69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727331, "uuid": "ec6ccdff-2d89-4c25-b0d9-25b8f975c5d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727331, "uuid": "82287a96-14f5-4d46-8560-da7bb131ab88", "value": "49152:jGI+d5quY/vtPOtibWn5ZrLk2SkHVri1q/ANq/TvqEK:jGhS/1mikHSyV2E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651727331, "uuid": "d1c796fb-fc4a-454d-9e1d-327a36fcfa90", "value": 2536960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651727331, "uuid": "35ec0c72-fcf5-43ee-8c70-a53b8745af1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651727331, "uuid": "abf6b4f2-0af3-4556-b3d3-24c20c3ab41c", "value": "5eeb48cdd75819735e3051c095ea142a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f0fd08-cca3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651776218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776218, "uuid": "fb58708d-8cc6-4de2-8bf9-cd198597b306", "comment": "Malware payload (Mirai)", "value": "18909ac4fe0e94d23768a7c4e9471c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776218, "uuid": "4ddd385a-5702-4bdb-8b44-a3cefd47685a", "comment": "Malware payload (Mirai)", "value": "f05e7c44bdef86eece45e1ecd1d71540e6021b2d48885bcaf77715a71134a17a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776218, "uuid": "a0a777fa-0c55-42cb-84f2-e785f9c541fe", "comment": "Malware payload (Mirai)", "value": "b55317a4e9939a888377b89f169bc52c124f776e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651776218, "uuid": "4d319ff5-4e66-4e57-8dd0-edb7fd15d9ec", "comment": "Malware payload (Mirai)", "value": "c62e8d3cd8057f755e82dce901727d6037611ba976e9f65e0ed80ef99cc2f7a7fbee204e82686499e3a9dece3e2d6fdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776218, "uuid": "63820d10-780b-41b0-9927-bc8825725a65", "value": "T1D0B2E149C5A643D3C153E232F8BC9C8DC1B77A8907CB4C1B2A09729C57A5B0263BABD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776218, "uuid": "57e2b4ea-de39-4a1c-859f-c506b61ce7c4", "value": "768:a/QOC0Yhn6ROHWFg5cwNvFDnN715NtIyDcT:a/nihneF9w/Nh5N+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651776218, "uuid": "667a807a-fa1e-48e4-bcf6-b19750fbb576", "value": 24720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651776218, "uuid": "5ab85ce6-df5d-430d-81a9-4dec3448304a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651776218, "uuid": "14c4ce92-b0dd-4d96-9ce2-3e5871d31058", "value": "18909ac4fe0e94d23768a7c4e9471c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1ce2d4-cc9c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651773460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651773460, "uuid": "755e4766-4803-4199-b29e-de5735c759e6", "comment": "Malware payload", "value": "b2c8b560cadfcf223e5deb4514222427", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651773460, "uuid": "8c8a36b2-bf2b-434f-bbfb-86bf093b6983", "comment": "Malware payload", "value": "f0a2cfd624fe220d2ed6ec019e7705543593ad0ee9804dd8871a03b0545b1d3b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651773460, "uuid": "703065db-fc61-4614-92fc-e73f90ce7955", "comment": "Malware payload", "value": "78b2143fd61d434afed4f9b045f6bd6129935e0d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651773460, "uuid": "3eaf868b-7366-459b-9b58-34364e7bb220", "comment": "Malware payload", "value": "f10f42b3a5f73ffc2976c69ec0686449bad10274607a4f908bf05c5478ea1885f1f78ed33bd399827221476d0cc12c8b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651773460, "uuid": "2969f8ac-e90a-4c5c-8266-b836fb84fc5a", "value": "T18BA51243F766A46BC8F2C2332175273911764E29CB43AF4A394937BE28B79DC8B915D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651773460, "uuid": "811c3265-69b1-497b-b22f-9ff0ac055453", "value": "49152:b/ItkCU5jtr3/IxyNs1MwZpe+ri0qlsAhuX:DwkCojtr3IyNsyq4tlbuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651773460, "uuid": "8b3855b3-17ad-4f8a-9eed-db9b0fc9639f", "value": 2106061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651773460, "uuid": "ce78125e-6dbe-41a3-9517-d6923b79215c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651773460, "uuid": "484f877f-b4d3-47dd-ba1c-20d1dc01f51f", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c75be7e-cccb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651793514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651793514, "uuid": "0ad20427-a246-451e-a993-63f59a2dbb0b", "comment": "Malware payload", "value": "7c95b97fe60101e4c4a3e3e6ea102796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651793514, "uuid": "730569c9-c878-437f-b15c-51b8ab475766", "comment": "Malware payload", "value": "f0bf66a361d1e4f1860bd3ecdb46989ba641335932f235939112b87388fce722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651793514, "uuid": "c56ab0b3-da04-4b60-ba26-f0c21840ab82", "comment": "Malware payload", "value": "728ffa69723d70d4a5a17ba154366f0517327826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651793514, "uuid": "1b7bee31-eb25-4be3-a8ca-af33e8a88edd", "comment": "Malware payload", "value": "e39e0a9594bd96682421fa6573ee23d0cb73706d48aed7601d955e60b7d1ce38ba778384c5f8586cf5444615abce3186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heracles", "colour": "#5A9737", "exportable": true, "hide_tag": false }, { "name": "HorusEyesRAT", "colour": "#CC8232", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651793514, "uuid": "3f76e112-ac2f-40cd-afad-535848c71c00", "value": "T1B045E7F63525F789FC3C35F4845BA246E2ADFE8E464C892EB887314487E53817BD1262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651793514, "uuid": "9549e573-9282-49f0-80d2-637302365848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651793514, "uuid": "fcd49837-9adf-496c-b68d-43b8d673f093", "value": "12288:Or6qcPn3VvxwLlkQ6jMRUKZNuUfvyMtDDirVQX6jMRG6jlR:hhjMpNjfKMtSjMNjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651793514, "uuid": "1eee6760-05ed-49d7-998e-f8fc9a0c4086", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651793514, "uuid": "35cf27fe-d6f8-497f-9aae-6ccb3dc349bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651793514, "uuid": "548d8040-e38e-4bf1-bf1d-8a57f42792d8", "value": "HorusEyesRat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83554aab-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651732940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732940, "uuid": "5cdf219a-ac36-437d-a689-b76d136c0f4a", "comment": "Malware payload (SnakeKeylogger)", "value": "65f594711f19f0f9b340a24c23e3aec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732940, "uuid": "57b70e76-c29b-4a0c-b0a7-493360515662", "comment": "Malware payload (SnakeKeylogger)", "value": "f0fc486333ab14b54a0464ababa7a8e19989fac095a9b0a6241d45f73308b4b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732940, "uuid": "890b9cd0-4d22-4c05-8b8f-894bb0f9bae6", "comment": "Malware payload (SnakeKeylogger)", "value": "fda32eb03b05f979db550658dda4c22a5756a54f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651732940, "uuid": "5d685d6e-e595-4826-b689-90f4ee34039e", "comment": "Malware payload (SnakeKeylogger)", "value": "c80788a8ee38b20576f9a98e693266dd31ba30d20538dd3966458fb7183f04de7d1bcdec6c931edf40dabbc427fe667e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732940, "uuid": "102fd5a3-75e7-414b-b571-4063fdf790ce", "value": "T1B8256D5271909E5CE0AC363BEF44246817386FD71A11F75B66DB7EE47C21E022C0EDAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732940, "uuid": "2404afb2-a1e1-4458-9e74-5d55bb34ccdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732940, "uuid": "7e8c130b-675f-44e0-b7ff-398ba9b3fc7f", "value": "24576:95vNZW0HFmqFErqt9a73/wK1hQ2gPxsqR:Dr9H/gH73/v1hQZPxsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651732940, "uuid": "2b204034-b06d-4c98-a077-b79e676444fa", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651732940, "uuid": "6dc12102-49e6-47fe-92f6-dddfa335abe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651732940, "uuid": "626276d0-c31a-4d1c-94b3-f43695dc765a", "value": "PO#22-4500 22000482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69951f8c-cc93-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651769404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769404, "uuid": "ebc61a84-afb9-4241-8106-f71e5c0398e8", "comment": "Malware payload (AgentTesla)", "value": "fb971857b4595d008d68a56ac095995b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769404, "uuid": "b8e42b73-99ad-453a-8a0b-bb3fd31aa7b4", "comment": "Malware payload (AgentTesla)", "value": "f13e967803fb14ea134c35f3d590d06cb8b62dac7776587b319c2c1026e2914f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769404, "uuid": "304c018c-44d6-4bfa-ba50-d7fa9bdeb262", "comment": "Malware payload (AgentTesla)", "value": "2c005e06c0f1866f2419ce845d9681e58be2f61c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651769404, "uuid": "1a5dd07a-f58f-4ef8-a1af-6c73e5411350", "comment": "Malware payload (AgentTesla)", "value": "c6bbeec47745f25b77ba8ed24339e8b059b737e51a3369a210e4f06675ddf913f5f3058d18e0f8b1261b67c7eaa0a742", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769404, "uuid": "d85e098a-f0b8-4849-ad55-18d0d222335e", "value": "T13F05F110296CAE00C57ADE304883C17193B39C4F7962E13AABE7BEBF7855741D263A75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769404, "uuid": "3dbbff9f-8395-4d07-a318-cd152870ca8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769404, "uuid": "08d9e4ef-2d79-4351-b9f0-a55e5e0cd830", "value": "12288:YFZuLBWG7htpbvfzHPN19nTwUnqWoqqLYRjfmjZoLKINzcK/vBC:CMgWhtdjHDRMJD34DmjG5N//5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651769404, "uuid": "cdb14082-39b8-4cfb-9598-e219e70432f9", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651769404, "uuid": "da2c4580-b70f-4393-8bc4-1b9abbce4bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651769404, "uuid": "9e7ba7ff-6900-4a72-bd5e-da60d9f24dbb", "value": "ATTACHED FILE (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73866322-cc26-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651722606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722606, "uuid": "39ab1594-9ac4-4cd9-a572-c4af53a84cff", "comment": "Malware payload (Mirai)", "value": "e25c955326a80ea9e840939bbc0c1af6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722606, "uuid": "60e09602-8fd9-4ac9-8d4f-30e1066faea5", "comment": "Malware payload (Mirai)", "value": "f35ae814eb516a6dfb4c4172a30018025fd287df976029bdeac8f2fa6dd2acc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722606, "uuid": "e6e6f658-0faa-4244-b937-7895fb0b65b3", "comment": "Malware payload (Mirai)", "value": "885f719675abb856fa59755d6cfb82ab1cbfdf9b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651722606, "uuid": "1ecd059d-3d65-49d6-ba7e-7c5673eb3adb", "comment": "Malware payload (Mirai)", "value": "709967cb7ece0354b7402040861eb0bf4e55aa78ac84c48f301dc57db9dc4ac12e4143c295c01eb83bf5481a1dbc14c2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722606, "uuid": "b56eefc2-ea9a-49eb-9929-d780d3584021", "value": "T1106319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722606, "uuid": "3e738290-2b2c-423e-941e-32f5d580e096", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKNM:at/LY0bKJwpvj3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651722606, "uuid": "e3921b19-f972-4e89-8ee7-3190a2657914", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651722606, "uuid": "77c7cd98-2d5d-499a-b45d-8c79d350f052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651722606, "uuid": "14cc4a73-ed08-4ba8-947c-f1c233882b16", "value": "pandora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c023d7b5-cc75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651756664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756664, "uuid": "f9905780-89be-410f-94d0-f75eb2d25f54", "comment": "Malware payload (Loki)", "value": "df16c981d691b515d28e44558fb1b72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756664, "uuid": "bd5eecff-e554-4490-9196-3e8f5683f51e", "comment": "Malware payload (Loki)", "value": "f4444d9d72b57601f4bd9c4a93036abc3940f589c002c2330e47877f22650951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756664, "uuid": "e9a8502e-f61e-4f41-ad7c-c5f77fee19c2", "comment": "Malware payload (Loki)", "value": "47541f74eb188743bccc348703e96de83edb670a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651756664, "uuid": "d17cce7f-d212-4fd4-9ca9-c7a9c8b67e03", "comment": "Malware payload (Loki)", "value": "939416c98ab3f5226be0d17e7407503ed2c477d25f213ba6d3085b4ddad58970002e76e9bea04551b786de45fb6010af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756664, "uuid": "8be85ce3-674a-4539-b4df-bb18127e01d7", "value": "T1BEC4224462A6A3B3D6F933F94562068017B27D867012EBDCBDD023ED59D7B890622F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756664, "uuid": "a8f36cc7-acc5-4d7e-b5e9-44d1efd89c4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756664, "uuid": "ae2dbf86-b555-47aa-8ca3-73e0fc293321", "value": "12288:2sbOPZvKDLiL0Sc1sZtAAXqiG0nPpLIvzoW2Z6w5hrjE92L2I:RqpiS0R1sVXqiG0nRLyLdiBY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651756664, "uuid": "909d284d-e8f1-4d2f-9618-dcd69129ba92", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651756664, "uuid": "0c116a36-5d0c-4513-97cb-497ab0690905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651756664, "uuid": "b1265cbf-4834-4dc5-ad12-f85508d79330", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a382dfc9-cc36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651729558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729558, "uuid": "afc5a662-dfb9-495f-80d6-3bb24d716be7", "comment": "Malware payload (Stop)", "value": "852dd8fb9e6a093d440b3a93f450825a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729558, "uuid": "ab0b65b9-f80b-469b-a071-321af070a53e", "comment": "Malware payload (Stop)", "value": "f5f1cf3cc14d3f0b24b4fb08833370f51c51d5feffc130eb2c60f0220c6cf351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729558, "uuid": "a821c9c5-becb-45c2-b942-60148ee006d0", "comment": "Malware payload (Stop)", "value": "67586d0c8cfd79c3e13fd9f4f0a297f84028ffa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729558, "uuid": "c7991e92-d070-4ee0-bf0e-8a54016bb43d", "comment": "Malware payload (Stop)", "value": "879105e1888ddb05a07943bb7384f5278f7b74f40188c0919226dd8aba7c613ad701013fb1228d46e3c1e15832dfe1d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729558, "uuid": "38882e58-cee4-4794-98e6-12a6d29e453c", "value": "T12905F100BB90D034F1BB26F0556A93A9B93DBEB19B3450CB62E52AEE17346E0DC71717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729558, "uuid": "ab012e2d-9216-493c-b4bd-398ddd4f0ee8", "value": "6155d4d1fe9d4982682a0787c78cb5b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729558, "uuid": "3fc1b774-4590-45e3-8f79-2de33802aaca", "value": "12288:dUVjTPFao6Cz7nzUePHTzPvOU5j1rBlM04lopggM2yLt/KnKDkgcu:83dVxz7zUwzzuwBlYopggMHLt/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729558, "uuid": "c2a327ac-4b76-4b9c-824f-8646e77051e6", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729558, "uuid": "b4edf5ce-473d-41d5-80c8-97280b725015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729558, "uuid": "3de49e50-122f-4512-9dd6-9e8c89c28f43", "value": "852dd8fb9e6a093d440b3a93f450825a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bb4677-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651745750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745750, "uuid": "327a9b00-d541-4eac-95f3-a0abf0bf6e19", "comment": "Malware payload (SnakeKeylogger)", "value": "dfd3a9653e64fc58776908087ccb0e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745750, "uuid": "03fa4593-31a8-4c74-81b5-446f9bd42fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "f6ee068e0a5aeeed0bd88bfec42fdaa2dc2e6ce24b920bf9ce666f48a8d17931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745750, "uuid": "d0bc5d6e-e804-4050-8d31-7198ecccbe11", "comment": "Malware payload (SnakeKeylogger)", "value": "37803d56cac9ea8bcf6f460f281ea02e585d0382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745750, "uuid": "486d9281-ab39-470a-8805-91595d2cd4d5", "comment": "Malware payload (SnakeKeylogger)", "value": "c11c7a2b53e5d7a62e1d25ebfc22dfd086a8b6e203ea26894ba8e7c66ed4ae0480a3b99689731de78eff7702f72f2dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745750, "uuid": "95357e8f-8bad-44ae-a2ad-7f605adbc314", "value": "T1B6D42285A5D643B2D5F237B6895986A013F63E39B011F18D3C9D71EF08B374A0622BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745750, "uuid": "a05236bc-1473-46ff-838a-788750a3ebbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745750, "uuid": "f75ea472-9523-442e-bcda-71d58df3d33b", "value": "12288:++50sS78nBFvkd2ngaupEZNCub2203bmqPzX6cfU0sb2L2IjCSQ68FDpWz:FU78nBFyIuq/2203bdr6c80sb238F8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745750, "uuid": "2aef321f-571d-44ce-ad9b-09991033747c", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745750, "uuid": "334d4afa-3ca0-41bd-9ade-c040df1c96d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745750, "uuid": "3bf84902-ad93-4e6e-ba11-adc80db14ce2", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc4534e-cc33-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651728179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728179, "uuid": "e166d5cd-9dfc-45ca-8af7-66a19fda8d02", "comment": "Malware payload (GuLoader)", "value": "84a7ffe6c1c4854a59dc917b8d47afd0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728179, "uuid": "c4514b60-5b9e-49df-986e-a5e006483c40", "comment": "Malware payload (GuLoader)", "value": "f850ef490d6b7c3b48ad15078ef8cef3f5cc051ed1378c6d686856aeea782195", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728179, "uuid": "6fb12c1c-4d7b-4a4e-9435-325f823bcf9b", "comment": "Malware payload (GuLoader)", "value": "a00a69793bf7deff5e416cba8e710c6832874dc2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651728179, "uuid": "c886a717-dfee-4ab2-a0d2-3f8b781c9fe8", "comment": "Malware payload (GuLoader)", "value": "b4c7b61b4a3a030a99d06b5ce0882841b36f48d0128fefa95576a769eb78e06f5318058ebceb7dc8001ab492119bd5bd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728179, "uuid": "ad473b0a-b9bd-4377-98a5-5255b88ad0b8", "value": "T16134B67BC282AEB400601D78F8159973C29FC794D9B48B95E7C78AA363DBD01E951CF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728179, "uuid": "c027c029-7c13-4ff1-a124-ab5633380ce5", "value": "1536:t8O1r+aLTSN4o9v9kIZInCcAqucQxC8eSl/9ysXhP56z/ZnOKnSxqvXvWXZwDuux:dHONH9h6JQJq/ZP4qWyhxhDNaFNV3qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651728179, "uuid": "16886849-b8ad-4997-aa0e-be42716226d7", "value": 250559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651728179, "uuid": "4114656b-8407-4e17-9b35-ef16016bac08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651728179, "uuid": "25781b26-4096-45d3-aaf4-d08318a5f86d", "value": "Flovser8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612a9a06-cc3f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651733312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733312, "uuid": "8322e29f-ffa3-44f0-9ac4-f3d900e7192a", "comment": "Malware payload", "value": "ca4300634986b52e8f02340a7a8bb90b", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733312, "uuid": "90235328-e572-4a8f-bcfe-afcb2d130b69", "comment": "Malware payload", "value": "f8ab290dae2f64da5ce1cd91cc35055e3773c3f2c6f4ad1850d255c0dd441a06", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733312, "uuid": "8af906f1-403a-4e33-8abb-279cd6a574ae", "comment": "Malware payload", "value": "bdf53b07bc16c226dd2d4c0110d2a4b387dbee14", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733312, "uuid": "e201422c-9daf-4fd1-b312-2ed654973a92", "comment": "Malware payload", "value": "e558dbd1c1d3ee57c0ab9b67fd25db31dc9147a596d159d347f091b5f425957ab9a62987d921b2fbde45352b02cb0dfc", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733312, "uuid": "3950d85d-a192-484d-8d4c-0a89b33ce9fa", "value": "T1CA2633187B5418FBF6F5123B8847C66AE0B6FD360320C24F4B9861169E73B906D3AF65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733312, "uuid": "cb010932-1561-47c5-976d-acf45ce881ab", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733312, "uuid": "ed0faed3-37fc-42a4-986b-0d0e40bed5ae", "value": "98304:VrTNvuvHmX8hTrrQCLi0G332QfvDuSR6qmZAgFWncmEN:V1v0HmMBpu0G332kv6W6xGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733312, "uuid": "c4d13ca1-6cfb-496d-b439-20c1654f0c16", "value": 4542643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733312, "uuid": "193c53de-db39-4144-be34-72e6dddea6af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733312, "uuid": "49e10881-8ea6-4bb9-8aed-4dbd1ad009ab", "value": "Snake_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c46562-cc6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1651753833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651753833, "uuid": "89b68277-23d3-4768-83a7-db735e5cef05", "comment": "Malware payload (Stop)", "value": "7faf3f5398541f39d4cf7664c6a4672a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651753833, "uuid": "5c6b632f-78af-456e-babc-b3fbba69487f", "comment": "Malware payload (Stop)", "value": "f9335c2ce7dfc83aedb887c855654af5f5f9f7e5317fdfd50e5e60a11dcdbed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651753833, "uuid": "d9cfdc6e-5b88-4283-b075-47e8d2f866a4", "comment": "Malware payload (Stop)", "value": "e675eb4246217c22039b07332706001ced386c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651753833, "uuid": "c12045aa-c70f-4efe-9ce2-3cd3ea0fbbc9", "comment": "Malware payload (Stop)", "value": "a383c4226948c15c3419c7b78b0b34e76e06ac5024c89d1f52e0f6ea6d02dfbafb6d36a5765919f27052c030ba9c3773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651753833, "uuid": "1b1d6c56-fab7-406a-815c-a45247641350", "value": "T1ED05F110BB91D035F1BB12F405B5D3A8B92D7DB29B2110CB62D42AEE5B386E5DC7270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651753833, "uuid": "9aa2311c-3d71-4bfd-8c26-664801c8d020", "value": "102925d1127f9c0032b267954e8e052b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651753833, "uuid": "5dd50ed9-5d18-4153-893c-a1c62648c47f", "value": "12288:MfqVrz4X2EExco7WHoJ+IGYhq6vX+C8bWjiJ4RguDv1rF8Z0DIiqASLTlD:tl5Ekco7J+sq6P+CkWLrD9LBZSLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651753833, "uuid": "54aa9c49-7524-4fcb-ba65-a06cda31c924", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651753833, "uuid": "9ce32dba-0c47-45f8-bf26-81261344d8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651753833, "uuid": "2263aa17-670a-412b-a631-814c0442b0e4", "value": "7faf3f5398541f39d4cf7664c6a4672a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55f8969-cc3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (BazaLoader)", "timestamp": 1651733051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733051, "uuid": "9610dfcd-f7e1-4e99-ada6-eaee708ca357", "comment": "Malware payload (BazaLoader)", "value": "c108ebdd14a2cf40e64411792987796a", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733051, "uuid": "08ae2b13-7524-4c49-ad5a-1bbe5957412b", "comment": "Malware payload (BazaLoader)", "value": "f9bff1ac8e6c15dde928e87a8bf733006ca805d42302387b2c24e11e555b7ee6", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733051, "uuid": "0ed4851f-a29b-4161-a933-1bae0ce12c10", "comment": "Malware payload (BazaLoader)", "value": "48f4f5376d0a571784fa03f89015c6a72f74998d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651733051, "uuid": "60a39b40-3cd9-47fc-b4ec-d28f720c1e4f", "comment": "Malware payload (BazaLoader)", "value": "b6a578f75130461f19f1006648b433659cfc568fb3d4b3be4c23d12312d0a4486bd8dbe2d40d45be55a2dfb0d8e68d13", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733051, "uuid": "5b8a57ae-abef-4a3c-9eb8-1fb1f5733742", "value": "T1543633DEB384B1CFCD7B91738A996C78D680A96BA72FD313805317ED4D5C0B6CA09192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733051, "uuid": "dcafb514-44ee-4e45-92e9-4d53d03d86fa", "value": "98304:mQi4NSWhwXCzdRTm4OVgThNEUdhgjcAwLgq+a6T8g/Ztr4JIs/:Hi4U+rTmoNEUfWcAZ5TPZtr4WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651733051, "uuid": "633148d1-91c4-40bb-8589-a0ff39182eae", "value": 4879360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651733051, "uuid": "2aa4b9b7-d6e9-491d-9df7-ce29b7a17811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651733051, "uuid": "0fa5df7e-52bd-4f11-b1e1-911870f9511b", "value": "c108ebdd14a2cf40e64411792987796a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2be9279-cc35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1651729235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729235, "uuid": "d90d5d69-0726-41a4-8340-d4d6ac3fb2d0", "comment": "Malware payload (Smoke Loader)", "value": "74bf6d85eae00e32437fdc455179b965", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729235, "uuid": "17f458f8-8897-4d27-a0d8-db124562b465", "comment": "Malware payload (Smoke Loader)", "value": "fa35418f18e541c0dddb9e19893ea0677133f47ee8a4871c35984c3ceb21cac3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729235, "uuid": "52154e4f-5d91-42db-b959-bd6ff4a1c754", "comment": "Malware payload (Smoke Loader)", "value": "212de5612bab8a57eb6670b60199b96c3932b60a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651729235, "uuid": "20da09fd-b298-4a4a-8627-fad4764b66aa", "comment": "Malware payload (Smoke Loader)", "value": "4d93dce23864e61161d1077e11ea8c01671f96b4ce643b1f67988bc43ce11514acfa9185c45d94047b10e40c95db1734", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729235, "uuid": "1c596d1f-2e2f-47bb-a36e-8dcefa6e3a84", "value": "T1BC349D12B6A0D431D1934A308874B3A51A7AF8536737C89F77A43B3F2EB02D15AB6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729235, "uuid": "9ef4839a-6fa8-44b1-9310-f3b3f3feed10", "value": "0f11459c321cab0226b9f29800679ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729235, "uuid": "8c95c1c9-282e-4c0e-8b4d-b4feade13490", "value": "1536:vBvRBnv67cya7em9zPI9STrmcn8A+PfsBCjPlsnStiQjQYe5qdwz46LR:ZJB3esU9YrliLrtiQjQYeR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651729235, "uuid": "646b5ad5-53a2-4749-8b74-5411b348d32c", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651729235, "uuid": "5199b663-37ee-4b07-a589-bcaf4ca370c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651729235, "uuid": "b9d65e52-8fd2-48f5-8c0e-3065b320a90c", "value": "74bf6d85eae00e32437fdc455179b965.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061900ec-cc77-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651757211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757211, "uuid": "c7516ccc-f6df-4b3f-976b-5e0d83101e8f", "comment": "Malware payload (Formbook)", "value": "b17f23cb1ba3a68121cb5baf6b351f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757211, "uuid": "44c1bd14-6df4-4dd9-95b6-b34d5e2c9f97", "comment": "Malware payload (Formbook)", "value": "fb9fa31687ab1f7be19743e141436f6a0c82f31cf8a77bbe51c298e3aeb9991a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757211, "uuid": "ae5c78a4-7293-4345-af55-3176c95c11ac", "comment": "Malware payload (Formbook)", "value": "b92079030eda4cda40d63f6b6a65a3f795852c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651757211, "uuid": "30934124-584e-4011-90a5-2d183109e073", "comment": "Malware payload (Formbook)", "value": "f573dc086bb93bb00ad378992d21c7540b126bc3086f4365b04b9d47ef9ee230dc8d7690262884a3674aa128d2ccddd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757211, "uuid": "d935f94e-5bd4-4897-92f8-5cb4daf7931f", "value": "T1E8C4D09C3251B2EFC867E4B29EA81D64FA5035BB931F5253A42311ADDE4C88BCF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757211, "uuid": "fc0dae71-b0a0-4032-af81-6fd7183fe849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757211, "uuid": "32eaa342-8056-4977-8962-40df4769b866", "value": "12288:72bhF4+y5K2CROI/qj+a4/V2L2I8My/4muMMvsqHkvZ9hR6ZWXUHXM:kT4+y62dy/4muMMAZ9hRAdHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651757211, "uuid": "6d26243d-a5b1-4eba-8b75-28b32f862995", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651757211, "uuid": "7b12f488-fdc8-404b-9f7c-7d23d005814c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651757211, "uuid": "7711e272-1f16-4502-8e65-1a800d6e1338", "value": "#PO USL4590070002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaae2ff-cc2c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651725141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725141, "uuid": "703b980a-7948-40db-95d6-3015a64829dd", "comment": "Malware payload (AgentTesla)", "value": "fb88be8dc85374d335d7726d6a33987c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725141, "uuid": "3a50a4f5-ee00-40c7-8ae0-d0c56e82d033", "comment": "Malware payload (AgentTesla)", "value": "fd4b9f41bd316749386949c263671e8a525d2c68d70006c9abbbc2f48f3ef0a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725141, "uuid": "fae60cf6-b544-4812-b25c-663d1db5dc06", "comment": "Malware payload (AgentTesla)", "value": "abab07e86f2276ed92b2ba908b00f6f2ee8caab9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651725141, "uuid": "0ca93c49-7a6c-41c4-b3a9-91fa3f587d97", "comment": "Malware payload (AgentTesla)", "value": "2e43731fd6fe39313466e1ef2801fb8f1d3eede7d7bfaa13d835cf9193a03e0ade8da4ea02fb3af5e7962ccf163ff9fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725141, "uuid": "cec905e6-163d-4b5f-8318-f6969d6887d0", "value": "T111D4E0AD67FCEC04C53E33746D64A194C3F2E5CB177A875B4089C6E57B313882B626A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725141, "uuid": "4a937c86-ed68-46a2-8a1e-0207a71c39cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725141, "uuid": "2bc31f1b-cdc6-44a2-997e-c3a302a654c5", "value": "12288:5NhFdtq0Gme8HXdEFaiCgWbNmY+0tO9STF5KH:DhFdtl5R3a8gWZ+0U4TF5KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651725141, "uuid": "1868d8a3-0711-4838-85e1-a5861eeb5f9d", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651725141, "uuid": "3f3861c2-16fb-4ab0-a2b3-356b9628c1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651725141, "uuid": "006eb573-c86d-4d38-b677-f8e6d67c363f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13486.27805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e79193-cc5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651746775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746775, "uuid": "52fb7592-503f-4f84-860b-8c0f792e742e", "comment": "Malware payload (Formbook)", "value": "f12fe68dadc0c9c8243bb5bc53f80952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746775, "uuid": "97ed1ae6-b304-4aa2-85e7-40b3846c5f1e", "comment": "Malware payload (Formbook)", "value": "ff4e7b32b4c4ac0f5fbdd12b9c2ffd894fe647d1d22fe009035cc307a540322d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746775, "uuid": "1d21597f-5e8f-4b3e-bb7d-03a9d4da988b", "comment": "Malware payload (Formbook)", "value": "6c868fe841068fc887c795478aec1c2ac939254d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651746775, "uuid": "4ebcbb87-0b79-4703-90b9-330195a12539", "comment": "Malware payload (Formbook)", "value": "5f3787b7ae2e8d8da899b427101233ac6c26a37a5f914a3f0140debb27f752c06d262eb6df9fab3b848008be174488aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746775, "uuid": "cce06857-3994-4441-a7ad-1188289cb07d", "value": "T1778401D2F940CCE6D4B90B3219668A1886BA7D359E60F1CDE244FB4E2F731624F1E653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746775, "uuid": "bff96509-c600-44d8-88da-a6de9b3a62ba", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746775, "uuid": "0a31b491-64ea-4f1b-b2ff-0f7473334f70", "value": "6144:2NeZ4nPyQ3Y0O6ypx6P8skMG3MOpKReLVpARXZiUIcGA66X2u:2NJPyQ3s6lkMeMOIRmOoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651746775, "uuid": "3de6b188-dbf7-4556-a325-3a97f64ec9d7", "value": 400697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651746775, "uuid": "e431a818-2e79-40e0-82ae-8a5414802726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651746775, "uuid": "61121631-8d97-4852-9d84-447e98e6028c", "value": "PO 240046647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7924058-cc5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651745886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745886, "uuid": "60331022-db58-48c4-a0a2-23b11220a60c", "comment": "Malware payload (AgentTesla)", "value": "029d4dfc4a9e1b24d70cf9f8b4348e5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745886, "uuid": "4f1d4c56-dd5e-4263-8495-c6da44c86cc6", "comment": "Malware payload (AgentTesla)", "value": "ff75c7241e090b211f4c9a2742ebf774ad878619eeef8701a8af3a6229da1e8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745886, "uuid": "09835e5a-60a0-4f13-8a2e-6c053dce3ffe", "comment": "Malware payload (AgentTesla)", "value": "c787cad3957ba36f4272a3fd36b7d7b6d9a2b9e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651745886, "uuid": "d8132ee7-8cc7-441d-acf0-44d04b5ad3ab", "comment": "Malware payload (AgentTesla)", "value": "9ba3322ee28c633695bfdce6eca75a58d0ed428e51da78d1bc0c5d13b3a64a650f1dd275d64c560331c6ab2babcc15b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745886, "uuid": "5fcf7859-dd90-495c-8ed1-c42a0c8f0cd6", "value": "T12A4423003AD988D7F95126304E3B8A77A3FE797234B9672F0334591D7A36944DE163C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745886, "uuid": "3dad0879-a423-4ccb-a61c-afce0b44c2fc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745886, "uuid": "0cf362af-f27e-4ba0-b42c-e65bd648fddf", "value": "6144:HNeZmxE6V7qiGaoCzs1lb7QlpzF4dD0JyXGqQGTaq:HNlxE5ZaodDb7O2uJygGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651745886, "uuid": "1619541c-11ae-456a-8470-7ef11cb776db", "value": 269730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651745886, "uuid": "a73a8745-ccf4-4c17-b4c3-6f763873d237", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651745886, "uuid": "bbab3283-c40d-4a50-9dd5-7b5dd1210c65", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }