{ "Event": { "published": true, "date": "2021-09-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-03", "timestamp": 1630713782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b90be7c3-3825-4e62-85af-5448a3ccb1e9", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e4fba4-0c82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630651520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651520, "uuid": "a8a9749a-590e-49f1-9119-0ca070f23cfc", "comment": "Malware payload (Formbook)", "value": "488b1d87610ca6784f99a777f990a1e8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651520, "uuid": "ef58f57b-86b6-42cd-9656-f03e2e4b2cee", "comment": "Malware payload (Formbook)", "value": "0062a862d8ddf459bc7856c5508210b5dcd2556bca253d5e3a944da6072a11fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651520, "uuid": "1fc09435-892d-4de6-8648-5586e6ffd281", "comment": "Malware payload (Formbook)", "value": "b7423a71efc72c6f43aae731c78324ccdc03b18b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651520, "uuid": "97948915-fcbb-4141-bc9c-0a85f356e451", "comment": "Malware payload (Formbook)", "value": "ab3039aa80690ef17477a01fc6d59c00acb61949059f36ce210d8abb122f7545001e59cad2a8e4ff743545fbea40d4f9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651520, "uuid": "e07afa85-4b84-4d7e-8b5e-27573fe537e0", "value": "T194258C3063C9C294EC1E8FF0167CFB9402F235E7B6D4CD6A16DA724C8E5A9D12A0765B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651520, "uuid": "b76d5639-f44a-440e-bad2-3800d3d0f2b7", "value": "12288:nvcsGI/c4fvh8VtkwODi42tTvwRPdywkYyzXlI8n3dYt2EObbZ:njHgODjmzVXywtYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651520, "uuid": "d5add7aa-6e1b-4154-a292-c7b59cda2014", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651520, "uuid": "f98e1f15-7b9a-48b6-ab71-f3c0b1aea051", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651520, "uuid": "b3980611-2c3e-4fc5-b610-a65ec4dae8fe", "value": "D190a.pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bc95ed-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630650017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650017, "uuid": "8c61867a-aeac-43ec-a7db-fd5e41b917cd", "comment": "Malware payload (QuasarRAT)", "value": "7f1ce620a6c5048705cd032ac3cf2f96", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650017, "uuid": "8141d187-e80d-440d-add6-8e48c68398da", "comment": "Malware payload (QuasarRAT)", "value": "00ee2269f8eef58b09aec3b8f2f57694d84cd1e71f0df0b39e50a185147d0eeb", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650017, "uuid": "e523494e-02c4-45e0-8fff-66b852af439a", "comment": "Malware payload (QuasarRAT)", "value": "f4cc8fa114282b7933ddd2809a48b486face915b", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650017, "uuid": "986b538d-9c14-476d-bf4b-adea339f1e86", "comment": "Malware payload (QuasarRAT)", "value": "34bef2ec37ad3e9a135216e8a1865e59b32f9a1723988ddffa2fdf9b2cd4227feb12abe394f59efdd632c85108e03591", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650017, "uuid": "34e603de-6df0-43ec-bf36-d50c7ab3426a", "value": "T101B4239942ED118A939F7B985332A5B808770B13B99E3F2DFD1513E36F2A1E5C22114F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650017, "uuid": "41225e8d-72be-41fa-863a-be1582bf9b6f", "value": "12288:Kdbxy3RYSkLZE+jFPrkopsW+gX3BucY8lutJzKp+m9EKVb:IxIiZd5P7CgAc3lutoeKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650017, "uuid": "0ebeeff7-19cd-4827-aa53-6be32e557779", "value": 503911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650017, "uuid": "dce8c0bf-eda0-4699-8cd0-5a96c6dc7a55", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650017, "uuid": "11bfb0ef-6f1b-4b85-852c-d3906c8dc07d", "value": "INVOICE#09090002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dc8a54-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MyDoom)", "timestamp": 1630674792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674792, "uuid": "18a19d5b-9bcc-4e5c-90fd-55ff1ccf9225", "comment": "Malware payload (MyDoom)", "value": "60599f51770b216d42a2c435f33718d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674792, "uuid": "1004f0d5-d8bf-46ba-be38-5be339a14fb4", "comment": "Malware payload (MyDoom)", "value": "014f8b3c7eccfd07a7f917982112dde6964f6d2cef2200e0f20519adb3c7ac45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674792, "uuid": "456c4f65-9af5-4069-8349-683a3d8a6a7e", "comment": "Malware payload (MyDoom)", "value": "fc2073bfd6d7c8be5b30f0196110056b3ed2b109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674792, "uuid": "a94889e3-4ce1-4da9-865f-3c7dced1ee69", "comment": "Malware payload (MyDoom)", "value": "00017b313c8ece2d526f12b3bc87212aa974ed01e3289647b3c53c45241bc5985be15aca77bba93aa228b41151feaf00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674792, "uuid": "5d668b9a-7139-4699-8db3-763f4df16f84", "value": "T12D13F1567E49D486C008823D9463FDE03876BD39AD7E90977F51B33FA97AA587900037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674792, "uuid": "ef4ec7ce-ce5d-4af0-a517-6c91e8159d53", "value": "5d02f6de12eb07fb22fe87e05e50d6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674792, "uuid": "d93f80a1-95db-4afb-ba21-8b72ce88d9e6", "value": "768:SCIqdH/k1ZVcT194jp4l5u5Gm88sRz6ry4qOGdx8rIe/GYHX5J:SNqaLV8a6l5uMm8NmyPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674792, "uuid": "cd359200-9237-43da-87dc-19fb022868fe", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674792, "uuid": "732d175f-40b1-4c8c-9a61-58b09188a20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674792, "uuid": "cad38931-7bd4-4c13-b0cb-dcb2875f01ac", "value": "readme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f1ff66-0ccc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630683385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683385, "uuid": "e09b5089-4d5a-431c-9b28-28a56fc76805", "comment": "Malware payload (Gozi)", "value": "dc8c09dcce354cf148b724e4b5210cc4", "object_relation": "md5", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683385, "uuid": "6dd63801-b827-40f7-bbca-3786ef5b9c45", "comment": "Malware payload (Gozi)", "value": "0191114a1ad51d073bd2084d21f70d71f2ae748a790455c4a708915ad7533d2d", "object_relation": "sha256", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683385, "uuid": "b18037a5-1d7d-4e67-a2b3-5aa698222898", "comment": "Malware payload (Gozi)", "value": "ad6ce1717870b37859094456b32c40f2682a6755", "object_relation": "sha1", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683385, "uuid": "315da9fa-5c8f-4849-852e-25efc83a7a44", "comment": "Malware payload (Gozi)", "value": "696da5be38ac1ed568747ff7b7092d12aa2dcc64f12b7b184ad3ceb874b17c6792b1d210da618fe8fc3bf1fe70796a0a", "object_relation": "sha3-384", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683385, "uuid": "9483171b-7fe5-4f29-a383-8eec976be49b", "value": "T1EDE49E26BA81C035C17252314D2AF61466BEBEA19B3246DF37D87B5E1F748C07A36633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683385, "uuid": "439a6a80-cdda-446f-86da-200984826e7b", "value": "f074115ebeb6621682ea6e2795fa238f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683385, "uuid": "e410b9a1-8e54-4873-9637-efb7b1b83cf2", "value": "12288:WqeAoQME4xL3Lq7ZAfsOU+1kGz9nHxUHmCrv+r:Wq1oldxTLoZcsOUaTzjumKv+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630683385, "uuid": "fa6bc683-208b-4804-a192-6e375e707b27", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630683385, "uuid": "86c1fa0e-2b5f-40c0-a2f5-e32b361eb828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683385, "uuid": "b89bdd95-d6ba-4b48-b233-df8048468592", "value": "pattern.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f726b74-0cc1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630678601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630678601, "uuid": "020b8437-fb3d-49eb-b7ee-27b4897cccb8", "comment": "Malware payload (RaccoonStealer)", "value": "f69bb2af3dbb3fac27f3cfffddf2993b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630678601, "uuid": "9ab40277-f8a0-4c34-a41b-f056afa19687", "comment": "Malware payload (RaccoonStealer)", "value": "01f4e7e10bb524b04e6c8e731f51b600ad5948e1001531b05df57eb3c5f2d0ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630678601, "uuid": "a7b64f61-ba84-4fb5-a2ba-847ce3376a6e", "comment": "Malware payload (RaccoonStealer)", "value": "f58415b8c6eb9d3bdbd8661423eb00c67d8411c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630678601, "uuid": "f467d732-4eec-437d-916c-8271f4725b49", "comment": "Malware payload (RaccoonStealer)", "value": "54659e36c789a4f643f95d19f3b41de0c0575e42d48394edfb105b73812e4511531a7c7c9e470ce0347a2a257ea5ad6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630678601, "uuid": "71f73334-2281-44d5-90bb-b7e6815c5d87", "value": "T1CC2633013582C8FFE3415572A988BBBDA23ECBE505311E4B2356EA9A1F7CC43A31655F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630678601, "uuid": "656cc519-e113-4ad1-a857-a9d5d3dd75db", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630678601, "uuid": "e8988740-ef1b-444f-a1b1-3b6985198948", "value": "98304:xrCvLUBsgD5dxEZ8Wj2e7y28ya45lsTBsMl1HU/P6nh8UJROWVmX6:xQLUCgVdDs75FaSlQl1HKPwhpRO96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630678601, "uuid": "9d7d935d-6f7c-49bf-b26d-0e2bbe035e5f", "value": 4536062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630678601, "uuid": "585cdb07-2e65-4d21-8281-89c7578bd619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630678601, "uuid": "2c9a4ced-ed29-4d85-8d68-ac0e7252698c", "value": "F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3417b19e-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659980, "uuid": "2d42cf3a-8807-4c4b-be8c-a7eb994d2106", "comment": "Malware payload (Stop)", "value": "4767113c2cd96c0cc18128d54b3f2b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659980, "uuid": "f16d0935-5d3d-4c03-8810-937c290ffe11", "comment": "Malware payload (Stop)", "value": "024006d3227ebcad88d38b577560b35332f7c9f9f5aeab15d3816fc6f7646727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659980, "uuid": "bbdf15f2-67e3-4e4a-b79e-ef3db7221776", "comment": "Malware payload (Stop)", "value": "8041fab048537277173d6fdb2b26b421bbedcc20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659980, "uuid": "373dac7b-3ae6-4157-9594-bc725d411f3f", "comment": "Malware payload (Stop)", "value": "10ba3896e3ca4be8d8c66efbb88bd1a635dd261fb337f8b593af61fd40df3ad401855c378a7bcf10622f035c761830a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659980, "uuid": "1e49b891-1c23-435c-82cd-c5401e643ea9", "value": "T1D5F40130A6A1C039F4BB22F949B687AC69397E715B7450CB63D906FA1B387E49D30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659980, "uuid": "83045b4d-d68d-4e8d-8734-59a4d1a7528f", "value": "e1eb14d2b9b63299ef24644e625b9baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659980, "uuid": "ddf9060d-bbd2-40e9-a029-14e793880e56", "value": "12288:P2Kv0JIdiuLyyHE5c6JeRWUy7wVyUmmZh+NbGKOa8RylhegplPWZDp+mho1i2/ix:OYKryHEtWW3wVyUmiwGKM8PDPYt6E8Vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659980, "uuid": "d6079213-b575-4cfa-9eed-36b661591b21", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659980, "uuid": "32dbb47f-20db-481c-8573-18e0b165c529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659980, "uuid": "fd656b8b-cda5-4d6a-9004-68e0e4a91266", "value": "024006d3227ebcad88d38b577560b35332f7c9f9f5aeab15d3816fc6f7646727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e45dac0-0cca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630682438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682438, "uuid": "9d814072-a784-402c-a287-31eed5c706cd", "comment": "Malware payload (Formbook)", "value": "48ce0951776a55fb15d244ee149e8527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682438, "uuid": "7853428c-e40d-48be-b1fb-10a7cbdfae85", "comment": "Malware payload (Formbook)", "value": "02432e5b4ff12486d2a8c69255c583812eed57d8df13b01d249d21098a6807fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682438, "uuid": "62e64936-f430-4ae9-878f-5afbffb53381", "comment": "Malware payload (Formbook)", "value": "e9fc0d18efb48d1cf8e762d58280b7bf25683e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682438, "uuid": "7ad31878-21b6-4140-ada9-263ff15faa07", "comment": "Malware payload (Formbook)", "value": "fed1f537d795928c138820add88e571a3554993bb6b3980769b7cbdc2691950b6bdcae6f24bc84d5d25aa2f3332b3484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682438, "uuid": "72aac5b7-47d9-459b-af47-bbb6ba189d80", "value": "T183A4CF9C365076EFC967C876CD682C20EAA1A477930BD203A05716ADDE4E69BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682438, "uuid": "6249fbbf-3940-434e-b7a5-b78b55ca5966", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682438, "uuid": "70205037-dc15-423a-ba33-5f22249ec6e1", "value": "12288:pWLZ5cHrAnucAXtiZHjeEDnCUXOcZwAbOCD7OfAYVC:pZcu1X0njwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630682438, "uuid": "5c76391b-b742-4ca0-90b3-dd15a05ddadb", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630682438, "uuid": "8f681346-8006-4e1c-9bde-0982ae955e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682438, "uuid": "c249633a-5576-408d-96a8-56d3d0f0e1d9", "value": "QUOTATION TABULATION REQUEST FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dc5139-0cbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630675798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675798, "uuid": "be1a3260-b8b3-435d-a38a-23a128be6355", "comment": "Malware payload (Vjw0rm)", "value": "f001e1070c9c455fc200a56466a82b49", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675798, "uuid": "ebbd7f50-4eed-427f-bc3a-cb248f21f39d", "comment": "Malware payload (Vjw0rm)", "value": "034666a3eecfe683ff4f1942e353a413701b08a412c479c8eb6a82af0d7be52c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675798, "uuid": "c7bf8e35-2bc4-4bdf-b300-410665cde788", "comment": "Malware payload (Vjw0rm)", "value": "1dee5748281b89e2ce4bffac4096cdf0105129dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675798, "uuid": "7bb1c766-785d-42cf-949e-db309d5a642f", "comment": "Malware payload (Vjw0rm)", "value": "926e3289d6189697d02c8b6cb10f50a427b3ccdae923b5b4272c75ffa5b75b1a03e6e6c51a74eab7fd420ec0700d023a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675798, "uuid": "ed7d17c0-4335-45a9-81c5-851e3999ad00", "value": "T111C3D6FCF1051F22D292605C89EA092C73B3D361F5E9DF05666C7A09C1EE92B1789EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675798, "uuid": "f438c2c2-0294-4262-8d98-51d90f95ecd2", "value": "192:n0u40xWWHrW9WHxq0i1dhwhw9AFX9xFMM9cfR8BCO92spMU5f4sv1Ml8zDktfMEQ:t9WWHFTLL2RyCDlGTWW5qKLaMiOf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630675798, "uuid": "22b7463f-2a55-4ed8-a984-f4c23ce46994", "value": 119028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630675798, "uuid": "796f4f49-c084-4591-bc00-2e7a0be22358", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675798, "uuid": "5c5de4cb-ae98-4e33-94db-f01f36236315", "value": "ORDER-21902.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe633c6d-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659889, "uuid": "23797924-92a2-4010-894c-668d088b5d8b", "comment": "Malware payload (Stop)", "value": "c006392076dc27fd22fec69e608cb1b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659889, "uuid": "1c19abdb-4c0c-4d8d-9ef1-cb0de4cce8d8", "comment": "Malware payload (Stop)", "value": "034ac24e98112abd85c9d1a80bea01778a756b97784005951deb3a42605881a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659889, "uuid": "f068f28e-002f-43f3-9b81-1494f5dcbc70", "comment": "Malware payload (Stop)", "value": "ef7dd19ab972a3c4e045bcc8b6af366cc5a9e5d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659889, "uuid": "3a123115-ad48-4ef6-b2b6-b28d64d8142e", "comment": "Malware payload (Stop)", "value": "395ed788fa8b6edfea885fb462af9b868d31064308a1bb8d132a3c8ce8ce4e1db22628d4799a5e7646ab87ddeab4b6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659889, "uuid": "ea92081a-95e8-4fae-abfe-180c2fb2c596", "value": "T1FC0512517680C873C4818434542BCB62D7B5BC6026BB098BF2DA3FAF7F236C25AE551B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659889, "uuid": "2c725635-ad1d-4ff5-aa50-fa7b253a8da9", "value": "56277425cc4e9198f16e54164d30a11e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659889, "uuid": "8b92b44c-6c75-4a61-a5e8-842cd18e4e04", "value": "12288:9isiI4K5XYlPEHgshE17epQ30rTpxDNV0RaisoIRLX+YTkKU:9ihIoKTceyErTp9oRaiQRLLTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659889, "uuid": "abadc0d5-88f4-46cf-b395-af81945d5070", "value": 832000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659889, "uuid": "1d8f521b-e1c2-4ad3-a370-dcf400fac11b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659889, "uuid": "ef4add47-dd63-4cc9-ac55-23c06ddcdb0c", "value": "034ac24e98112abd85c9d1a80bea01778a756b97784005951deb3a42605881a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4152d3b7-0cdb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630689637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689637, "uuid": "5d682d2b-0483-443f-a4d9-e3657c65157f", "comment": "Malware payload (RemcosRAT)", "value": "2eb56c8ce36c7548607668e84bb56878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689637, "uuid": "66982bd5-f9e9-4795-a1f6-c5e8f523d2a9", "comment": "Malware payload (RemcosRAT)", "value": "04f483018f53c35976cfd9c4b5191279761a351b3e135a70ae9c5c2b53be154b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689637, "uuid": "83624a89-75ba-4d28-92a0-287dcf43c433", "comment": "Malware payload (RemcosRAT)", "value": "9aa6f705e4f45a4f282367d8bf51a116db70e660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689637, "uuid": "4a30796b-e906-4169-924f-f78da676fcd5", "comment": "Malware payload (RemcosRAT)", "value": "338822b55618ea77255286b8b2a942f5f0ca9b6211614d39c02d51c1dbc380e7addd93e3ba2f843d0fbd49c794874107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689637, "uuid": "fdc1b5e4-5806-4ac3-a6f7-803e49904cc6", "value": "T1BDF48E167BA2443BF51B4535AE87F3FA9D24AD28190DC0BB1BD71C0FEF3A5863126621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689637, "uuid": "c6d44c35-c0bb-4ad9-ba24-855998fbd9ef", "value": "683e36fe1155994747e39b9f335ec7e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689637, "uuid": "ba6cdfa5-6033-4e07-a8b8-5dcb712cc596", "value": "12288:KAQ4TXPbFLYhC0MPsgGsXxItI0X/m/zOOMH9L9T5kLvRJ:KZaZUhJOskXOtNvmb6kLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630689637, "uuid": "a8ec88da-0046-462d-b595-cf5984cea53a", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630689637, "uuid": "f34f77f1-872f-4ff9-9239-7db49caf4c3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689637, "uuid": "26526e23-a2a5-466e-903c-1440d22e2d13", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108c62c7-0c4a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630627278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627278, "uuid": "adc9d00f-ee58-4aee-9581-493f4acc7277", "comment": "Malware payload (RaccoonStealer)", "value": "cf6f22bc7f95e56ffd773384bcea3255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627278, "uuid": "81c09293-a549-49aa-bbf1-3ec0590b7bc7", "comment": "Malware payload (RaccoonStealer)", "value": "05bcca251522d1eef374463b048fd81ff6460d178966c211cf1cb311b945ef47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627278, "uuid": "8b829d99-701a-407f-afcc-70c4abdad233", "comment": "Malware payload (RaccoonStealer)", "value": "b81921cbf02f968ec437b423ef5fe11b8becc3c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627278, "uuid": "035875cc-9cfb-47bb-8090-bcf721c9682c", "comment": "Malware payload (RaccoonStealer)", "value": "68ecc7b4566bd2c976d7ff640beb30ca65368621318c3936e7e71311c614f9167842fb0f604a2a6cf9fa3edd4d92a511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627278, "uuid": "8557c9e3-a682-4fce-9259-d6b731c5f359", "value": "T18F26122322643C55D0E0CD38853BBED472FE9F27BE81E47A65E675CA25369DAE203503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627278, "uuid": "843ec76a-672b-475a-9c8a-df788730bd8b", "value": "79c49253e02d83ce6b29ff9fcb20759b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627278, "uuid": "26672745-54c1-4dd7-83e1-95251a3aa8cf", "value": "98304:rJIHFnZyPfcoblOeE2TyqfndW+l2G8YNtWnxEs6wu9q5rLD:tW1ZW5lOeESR/M+l28Anxb15vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630627278, "uuid": "aed60324-7eca-47f3-a57b-72b981bad7a5", "value": 4564704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630627278, "uuid": "e1da34bd-1934-44e6-ae7d-87496019c849", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627278, "uuid": "d092180a-5b6f-4885-a72e-f99eb86ccd87", "value": "cf6f22bc7f95e56ffd773384bcea3255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed935d29-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630660291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660291, "uuid": "6fd96220-b3f8-455d-a3a8-8b482f23b9b8", "comment": "Malware payload (QuasarRAT)", "value": "f6e823b524475856389186a96e73c5f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660291, "uuid": "49f08875-1587-4298-a1c8-21ced9b31745", "comment": "Malware payload (QuasarRAT)", "value": "06b8611aa629c1420172d4d6450c25f8f2def28fcf0aed3ca60a19ecde12d5ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660291, "uuid": "a1f62d17-fc21-4b6c-8421-d065131db9ee", "comment": "Malware payload (QuasarRAT)", "value": "34317dc8fce6b791a651d93291cc3c3c1b30be46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660291, "uuid": "3bf01f0f-af17-469f-92f6-256b33161f79", "comment": "Malware payload (QuasarRAT)", "value": "774ec2806fea1078b1e6956cf72b97625c0641947347f66f80f1ab236ffaf11319fc7023915937f1fb4e142f46da4826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660291, "uuid": "7843615e-afce-41d4-808a-e9c71ba9aeae", "value": "T1E3B47C4023F8852BE97E5779E870942157F9F817B2A7FB8F4540A1E92C6B7029E407B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660291, "uuid": "d1394c78-6cf9-4134-8332-593162aa2eff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660291, "uuid": "e5c154e5-fa95-41d1-9f0d-e0c6c6e62c41", "value": "6144:tTEgdc0YpXAGbgiIN2RSBuOCKuaLhT9d1cEatb8F9BcsofcTR3O:tTEgdfYlbgyOVd1KSjVAcdO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660291, "uuid": "4aa046f7-8196-489a-a943-3a1c655bee6a", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660291, "uuid": "e69ebb4c-333f-4d32-b31f-2e845d37ccbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660291, "uuid": "0622025b-14d4-452f-b849-1fecc9151612", "value": "06b8611aa629c1420172d4d6450c25f8f2def28fcf0aed3ca60a19ecde12d5ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9214b349-0c83-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630651977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651977, "uuid": "001d1f4f-523c-46cb-b7f2-506abbe5ed69", "comment": "Malware payload (AsyncRAT)", "value": "a8d46f6bfee221cd95bc9198cc650f2e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651977, "uuid": "864a7d57-0367-4092-9cca-f8db2a6345cf", "comment": "Malware payload (AsyncRAT)", "value": "078cc05bb6e3eee4897789ed7451ee4da5966959943e254c9e7681444caa2520", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651977, "uuid": "de6f31b1-5810-4756-b2ee-983118fef2a3", "comment": "Malware payload (AsyncRAT)", "value": "d826d35515b39f86e2df68b0e8662988b96a1536", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651977, "uuid": "10d8d9dd-478f-4c48-a49a-7a1e0e784fa2", "comment": "Malware payload (AsyncRAT)", "value": "5643767326d200ff995d98aafb302dce1ec430771fdf2c50f6e40f72922db515c440cf59f912bb4a2a89e666aa47d307", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651977, "uuid": "b3f1a9ec-fa78-40cf-b791-37d79c57b93b", "value": "T1F86329403FF58626F2FE4B7496F322014976F4277A02EB0E5CC464AA1532BC59E51AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651977, "uuid": "f6315c13-6e04-4003-97e4-d85014695818", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651977, "uuid": "8dc7d6e8-4da1-4757-bcad-d79da22c05fd", "value": "768:Ob18G5Pla9zTRWMlnAeOKLmSNGHukG9/qFn2DPoo2zBiox4a//vVfyj0EKUcVLS1:85Na9JLrGHuD9y0Uo25//vVfyr6/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651977, "uuid": "a6e71774-4966-4ad2-bf07-f572be1f489d", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651977, "uuid": "37172cc5-2abd-4a0d-8ee1-daef08c726c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651977, "uuid": "1a44296a-a822-43e9-bd73-e071ada1b038", "value": "dump3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ac6a04-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630660418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660418, "uuid": "219c5d1f-8513-4ac5-839a-455a5ea68c7e", "comment": "Malware payload (AgentTesla)", "value": "d299d10bece5b2110dc06c6d084d83a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660418, "uuid": "6bf5f15e-2690-490b-90a3-1aa378571457", "comment": "Malware payload (AgentTesla)", "value": "0a9166199e5aaa068d19857dc1af1efe497af5f846dcd363fee028f8c1d7cb0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660418, "uuid": "0a6b4c96-9ab7-41f8-92b2-8b47ad39dd66", "comment": "Malware payload (AgentTesla)", "value": "65e4ab34375cbeb9e530866a69be813837ab550f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660418, "uuid": "d4ed477d-9962-404e-9366-1baa79f1ddf7", "comment": "Malware payload (AgentTesla)", "value": "6b488434527af11fcf1f87b709576c35a60dcb79c10e67813ffa2f40d68c82675a696d3792925bcdeb145f0ceb4714d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660418, "uuid": "b4c6c701-969d-4e53-b6af-3352fe7f2b4a", "value": "T180D423642D41574122D9C23494F706D779089AEDAE0AE033440A89E5BA37FFF4B7A1BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660418, "uuid": "d935dbc1-b6dd-4748-b62f-b175f40421e0", "value": "12288:Efr3iyjYGyQ9QoBkQ/fGqg00JkNih9gaz5BuFSorgoJSBztTPv:2fjY7Qhfg0Mgaz7FqgTBB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660418, "uuid": "a4da38cf-2dcf-4669-abb3-f2c0189df18f", "value": 634529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660418, "uuid": "089c4570-2193-4fee-9612-34246a538be1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660418, "uuid": "9a339485-2d61-4d8e-9ecf-bccdfc09c80e", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005304cc-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1630660322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660322, "uuid": "4c7c8f5e-ba5c-4dea-89e0-0bacbb44d12f", "comment": "Malware payload (Tinba)", "value": "2a4587b0a6a13f02172aca7bfcf597c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660322, "uuid": "049d4d4e-089e-4aff-8e16-ff3ac2e28488", "comment": "Malware payload (Tinba)", "value": "0afa59785e40dc850fdc42bf1ee2a070ab99210b94966b650e410cea4d2729f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660322, "uuid": "a7ba7ac4-726c-4bc9-8317-3e2affeb2281", "comment": "Malware payload (Tinba)", "value": "0b862fe2a6994a5da3100f223d39864db9ad5305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660322, "uuid": "074834c9-3604-4b47-86ea-a9cf72a6f2f6", "comment": "Malware payload (Tinba)", "value": "93a2a1e7d103ddaad4229b60dbec8070b0eecd414062e9456581a47911f7cb587ea7d721bdda8c162496b343c073c588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660322, "uuid": "5914a796-00cd-4df1-a542-febd861e5773", "value": "T1D984F827A589A2B6F4F34CB2174FA2B2A1719B301714D643B60C5F6AA7703D1E5283DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660322, "uuid": "94be3619-db80-4f35-b625-8774436c8ca1", "value": "d0faf1f829379ff4f83833223a663610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660322, "uuid": "f0211d28-526b-400c-8b9a-5fe8d0244167", "value": "6144:MCE6/mUXJ531nIUliViSZbLhaZfvMlLXICgc:M6TOUMBQf0ljWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660322, "uuid": "c591131f-db43-4b05-b400-496952fff983", "value": 379858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660322, "uuid": "d60dd585-d0d1-4e52-8bb7-92143d641bb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660322, "uuid": "248aaebf-7bc2-4a4c-b70d-025f16ddfa78", "value": "0afa59785e40dc850fdc42bf1ee2a070ab99210b94966b650e410cea4d2729f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a273e-0cd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630685637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685637, "uuid": "4ac6817e-91e3-404e-a904-7a81973a54b9", "comment": "Malware payload (RedLineStealer)", "value": "915fff94ba8a7588af46c1090b7cd6d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685637, "uuid": "55f778d6-820f-44e2-a713-622c25b615d3", "comment": "Malware payload (RedLineStealer)", "value": "0c52d391c1e0f67d000858639a9acf00dcd5cdc639c5c6dd430fe34d42501c17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685637, "uuid": "92c03d4b-db78-4c30-aea5-7bb4b6f76f75", "comment": "Malware payload (RedLineStealer)", "value": "78632053c3db18d2eb1b13bfbcb8d7a3b9356619", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685637, "uuid": "8d3809b4-ab59-455b-b683-ff8d8e078262", "comment": "Malware payload (RedLineStealer)", "value": "88fde7ead1fd2deadea69dfe1e93133d4bc608f5853618351d59c7f94a60bd36c2033be82c45071eb0bcfa3968fc361e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685637, "uuid": "11e4164c-02a4-4ecf-b32d-3a7991c1f8bd", "value": "T159D3BE77261544A5C2480731E8A21F4F367CEE711D84B694B05AB7BECC3D68D9AF13B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685637, "uuid": "2984032b-6c32-4c1c-acf5-dd455d48da82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685637, "uuid": "cfa04937-1f65-4bf1-bc5a-f746c22ccbe0", "value": "3072:6fSfa2qqGrUcuSVegWlMspIvMgXtBBsbzZn5sY6:QQaFnneglvMak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630685637, "uuid": "56f73578-98ea-4c0c-b0cf-b28fe566a345", "value": 138240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630685637, "uuid": "6e0e019d-ed2b-4b45-9a3b-ca9df150aaff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685637, "uuid": "9d708679-0d35-4860-9f46-3cc239162e7a", "value": "915fff94ba8a7588af46c1090b7cd6d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd09272-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659966, "uuid": "060b0d34-8cf5-4c9e-9a7f-0f07e28e99ea", "comment": "Malware payload (Stop)", "value": "d7d04b4888127d6f6c00a6782b2814ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659966, "uuid": "c60e0daa-50b1-4c87-89d8-267d77389a3d", "comment": "Malware payload (Stop)", "value": "0d4704002980d141dc8ca282a4cb6ec338a6bbe0d95316cfad6a47b940b4e664", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659966, "uuid": "34e2a657-3e4a-4332-a5d9-8c96aaf0bb56", "comment": "Malware payload (Stop)", "value": "682d50644ccfcc0f1c4ba9d6b5efd33e363d786d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659966, "uuid": "9233552e-108e-42c4-b35c-053cfcbaa038", "comment": "Malware payload (Stop)", "value": "7b7db7effb2f5253efffc07db958b563b9caf8322041170acfd7c6d00e3d59765e7b857d5a60cc493846dc60cefd101d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659966, "uuid": "d04d36fa-5414-4cef-bda9-f7c0d4553d67", "value": "T18EF40120B6E0C036F5B712F469BA93B8652A79B15B3040CFA3D51AFA0634BE5DD31793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659966, "uuid": "4a488067-11b3-4caa-825f-03deb2cd94e9", "value": "d447818e27b033d337efcc8531718bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659966, "uuid": "c68d805c-6b5c-45a7-9809-5f68b58631ac", "value": "12288:gXPpcoax1Ob3gb1XHrnB6+mIU/FIVrWoO/+Jn2ANbsJ/PPb5XkdXPGoZEdT703Ga:EBLDTaNl6+mIUyVCN+J2A9atXbME170B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659966, "uuid": "d38d42ab-fb87-4816-8945-afc04c730e8f", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659966, "uuid": "e849f02e-f6e4-49e7-832f-20d3810c8253", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659966, "uuid": "01f1156e-9354-4730-a10c-7e18659fa042", "value": "0d4704002980d141dc8ca282a4cb6ec338a6bbe0d95316cfad6a47b940b4e664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2424662-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630660299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660299, "uuid": "d14519b4-677c-4ba3-8311-2b7f00aa29a3", "comment": "Malware payload (Formbook)", "value": "3321374fd22f070bd4280d8d8dda787e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660299, "uuid": "d4514f93-d429-43c8-ae44-f3ef6bf818c3", "comment": "Malware payload (Formbook)", "value": "0dbc727b9b089ce71ec32623629e0b3ceae94285d1588ac4580c9d987b1c4e09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660299, "uuid": "d2a15243-ded5-48eb-b7f7-f9f679026699", "comment": "Malware payload (Formbook)", "value": "c4b5197e49c85882b95eadf8a076e2e39b65e9ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660299, "uuid": "ee93927e-b145-45ae-9eaf-cb52ee4ad71c", "comment": "Malware payload (Formbook)", "value": "4fa91b3d4494b24091eaadaa68bd5764916ff798069ac7aa3b364890048ab36a896c0d6088f93f54e2bd286e62211ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660299, "uuid": "9f8a5e20-8dff-4067-8351-c4cf54fd910a", "value": "T14874E00627DA03B8D5BC9BB16778A1A403F4F22B9631F7AE2D4452E6CF51F098642773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660299, "uuid": "728848d9-f068-4de6-b0c9-cfcf86d701e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660299, "uuid": "e9763be3-bb48-4d98-9598-cc9271d279ad", "value": "6144:u6mw8sOboroe9oWpo3VVERiDgCAEAJynendhjQf+TtvB:IwSkP93po34VTQne/UmTtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660299, "uuid": "95c180f0-2c47-4b38-b3aa-558c2316487a", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660299, "uuid": "0de88d9e-794b-46b4-9daf-429cf9c201f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660299, "uuid": "6e1c8e85-c2e8-4311-a632-be231e239b17", "value": "3321374fd22f070bd4280d8d8dda787e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243cf7c7-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630673267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673267, "uuid": "ef872aab-6375-43f7-96f0-3676921764bc", "comment": "Malware payload (ArkeiStealer)", "value": "ad26d40543bc2a74e90727a271751847", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673267, "uuid": "1ae6c056-fdb0-4e88-86be-ede4b00fab88", "comment": "Malware payload (ArkeiStealer)", "value": "0dd88d1680c01b1c9ab3fea4ab104518f2f0bb2b844da7937fd6af5e9e507b28", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673267, "uuid": "7fb0d715-ceda-41db-a77d-2cf12aab8fdb", "comment": "Malware payload (ArkeiStealer)", "value": "fac983649457edbd559ccb73e711bb03257519a1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673267, "uuid": "ed67ccb7-9922-4a3f-ba02-9c39c982c8ef", "comment": "Malware payload (ArkeiStealer)", "value": "d9be53fa0a4e864dcdeb5230d1781aea7296361139a83638f01f0a1ba4979fcb5bcaf6e387231f941fc339568d656077", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673267, "uuid": "c4e7794d-02a8-4050-93ed-1164e034cde3", "value": "T17EE401207248D437D1A7C5B0052FCED17A3EBE21AD785D47B6216B6F1E32EB01662A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673267, "uuid": "2ecc37ce-f9b9-4228-ac92-d29e46ddaf7e", "value": "c4966332d8b4d65c8c07803cb5fb54a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673267, "uuid": "e311e81a-a57a-4c8d-8177-b52148054670", "value": "12288:Ggn6NqYYQ2shBlhyPi5VhW1/Cd9j8pqnd/9IePmvN7jkCT0loq2h7THlS:VWdYQ2shBTw1qd90qnl9pPheJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673267, "uuid": "fedbcf63-91de-47ab-b6ae-53267d518a1d", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673267, "uuid": "c74c2d33-3c80-4612-b39b-d99c8a340102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673267, "uuid": "ace84857-6331-4664-a496-7d9bd9b02ba7", "value": "ad26d40543bc2a74e90727a271751847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773d02ce-0c6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630641194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641194, "uuid": "958727d5-848d-4ecb-b735-35ac6f942ba9", "comment": "Malware payload (Mirai)", "value": "25729f4db814e54c184dbf93cfec9664", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641194, "uuid": "2893a61f-d3fe-4faf-8a1a-25aaaa731883", "comment": "Malware payload (Mirai)", "value": "0e329b2f72f0e4019f54a40a2bca8246398dfe9e5a8be9fab6c271ced60b6430", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641194, "uuid": "0a1f1ce3-6b65-4444-905e-c59f1f60e5af", "comment": "Malware payload (Mirai)", "value": "e017233cb3833737ea4039572299d4778d938d93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641194, "uuid": "7c297698-c011-49a7-81d8-b798b529f2f6", "comment": "Malware payload (Mirai)", "value": "49aeccf3d86e496c8c0b9dff9ca069cada0090cebc087cd0fa4778a381244ac1fee0668f69b6af242de34f4e3732e95d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641194, "uuid": "b9b2b02a-e455-4357-bd6b-b76c549e3c52", "value": "T16E93074AF8815B11D8D926BEFE0E1189335357BCE3EE7212DD205B2137CAA6B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641194, "uuid": "e405dd42-44d3-4dfb-b36a-1275ca1f8912", "value": "1536:mvnC0YQxKFK3UKsRKOKwAlxtGljRQVQ0+fkbRat+6BnD/1/algdiAFOaKwoQrIY5:aYQxKFKkKsRKOKw22lVQVQtcbRat+6BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630641194, "uuid": "0136e1d6-a3d6-4ed4-aa40-424646e599ba", "value": 96016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630641194, "uuid": "0e8dc701-3719-4f9a-b852-b55ccc6b2d10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641194, "uuid": "be67faf4-94e6-4464-b82c-b68b392b730c", "value": "25729f4db814e54c184dbf93cfec9664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a454d80f-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MyDoom)", "timestamp": 1630674771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674771, "uuid": "efca3fe6-daa7-4566-b239-3b89a758c3f4", "comment": "Malware payload (MyDoom)", "value": "f0a4e1b9f16bedb637748b0ae2d38b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674771, "uuid": "0a40ffd6-6be6-4c23-8b66-641498e3ca30", "comment": "Malware payload (MyDoom)", "value": "0ead89a60b4d19bfca4a7d25391acf27e21a2e921eeb45327e1e23737f89a806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674771, "uuid": "a97ce422-5648-4475-aa5d-d4f2496609d8", "comment": "Malware payload (MyDoom)", "value": "36a61581ee833366a2f75c900cba601a3b317105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674771, "uuid": "8f729425-09f6-4104-ae23-58dfced74056", "comment": "Malware payload (MyDoom)", "value": "883ae1104a1f3179c3afcb34712f7fd9d991e34d119e41e9a10782faf66c57e93a555a6c1c3ae477975fed0218564870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674771, "uuid": "0b280fa1-a522-4592-ba61-0a1b8b71efcf", "value": "T12813E1567E4AD4C6C048863D94A3FDE03872BD396D7E90A63F51B73FA97AA543900036", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674771, "uuid": "dd50325a-9f53-4a85-9908-d41a452c84f7", "value": "5d02f6de12eb07fb22fe87e05e50d6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674771, "uuid": "4c1e3448-5bef-45ec-9a80-67fe9620b4d4", "value": "768:SCIqdH/k1ZVcT194jp4yEP5w+814Rz6C3+SOGw8crAmvGFpUqMt:SNqaLV8a6yEPe+8KX3JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674771, "uuid": "76f6ab4d-f1d4-450e-89ee-17163f2c2ab5", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674771, "uuid": "f80674f4-411a-48c0-ad9e-e83543bc3be4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674771, "uuid": "b84e825f-f48d-4533-a208-4b174e10f503", "value": "letter.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9117934-0c8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630655076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655076, "uuid": "eb4a28db-659c-43b4-9c5b-45c00bddb33c", "comment": "Malware payload (RemcosRAT)", "value": "8639cfa929cd990f8a357ee7c1c23b0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655076, "uuid": "4bc21cf1-e179-4fa5-86b4-53d206b8f22c", "comment": "Malware payload (RemcosRAT)", "value": "0f69049e40ac6ad1a5df12b7e661ba9c1e120951c3f6b8489cf44c0273f5d533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655076, "uuid": "756831be-5de9-42a5-a998-5fc7082f3a9a", "comment": "Malware payload (RemcosRAT)", "value": "ccbab1a80beeef02d93a3cd2d46b89a57b419f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655076, "uuid": "02ba05f2-9fe5-4c3e-8d95-2a9c20bc6ee0", "comment": "Malware payload (RemcosRAT)", "value": "eb037d5c8fffd3dc7ef4b7d4fa436956ebef2806aca9442b0778f828bda316229f451c5f63b496c33eceb78286b1f65f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655076, "uuid": "bce27a24-5959-49c4-b5ef-85041d0c50b3", "value": "T11315913E58FE23279176C7D5CBE48923F6C098AF3233A96567D747264306A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655076, "uuid": "76674528-af74-4502-8423-9ca452340126", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655076, "uuid": "200da378-fb63-48a7-8c16-bbb2e42243a5", "value": "12288:NfMHgFQ71tdZeq2je7WXs+R1GlnHOUy6GU5jKqBThMs:JOgFQBtdCe7W8CIQWG4mqF2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655076, "uuid": "bc07d7f2-f819-4287-af71-b44319460909", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655076, "uuid": "ca81ac66-b68a-4dc6-9334-dc4f12db83ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655076, "uuid": "e386c0cd-2769-40e4-aabf-86c3a1cc43f3", "value": "8639cfa929cd990f8a357ee7c1c23b0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca705b43-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630686431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686431, "uuid": "cee12ba4-6a24-4664-939f-0fab602527c2", "comment": "Malware payload", "value": "9deb8fec62787f6a330618dfcb84d818", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686431, "uuid": "3d8dc285-15dc-4118-bedc-10fb26a60b8a", "comment": "Malware payload", "value": "0f83f86907255eadae1caec99da48bd60689e359e40938f12453dcb3093851ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686431, "uuid": "f829a2be-b607-454f-8084-200a1031e3ef", "comment": "Malware payload", "value": "6327123dadc8dea8daa373f6b2c2ab63a12bf861", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686431, "uuid": "478b7f1f-73b4-418c-8127-d77c646c88d7", "comment": "Malware payload", "value": "7ecf974f5bdbb25bc8f0ecaeeb11b717acf556df470506070c1a892b30006af2b2b8be510f6527ecc1fde793cb0cdd2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686431, "uuid": "3d12a729-89e8-46fb-9d29-2f77884f9465", "value": "T116E43D3E58FE23279176C7D6CBE48827F6C098AF3233A96467D747254316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686431, "uuid": "ffcbfa66-77da-47b5-9bcc-84f0f408e527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686431, "uuid": "1c4376ad-ad21-4641-91a9-3dd00f26b701", "value": "12288:xWy1znGHA93TYwejOuXlnT43C4jZ26nS:lGg93Wyu1sS4jZ26S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686431, "uuid": "8dd2a88b-e06e-4041-adad-5b832aad9664", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686431, "uuid": "963594a7-45fd-448e-b902-ed3b602d6424", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686431, "uuid": "b899724a-d1d7-41af-8d5a-9450a57b5e1c", "value": "9deb8fec62787f6a330618dfcb84d818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ecbfe1-0c55-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630632280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630632280, "uuid": "2cab79f9-4854-4272-9024-5258b088fbf8", "comment": "Malware payload (Formbook)", "value": "cfc8796e013b871d88888537ae7727e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630632280, "uuid": "3425ad4c-e871-46e9-8732-1badc5771f8a", "comment": "Malware payload (Formbook)", "value": "10a050d7cb20feeb5842b78ddc183f34ee0aa3e0769b6929f963201dd8b7d4ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630632280, "uuid": "c1e75ae8-803f-4883-b6a6-8fab98701af3", "comment": "Malware payload (Formbook)", "value": "817604d9862ec3821e88f9ea562fb7bb379e072f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630632280, "uuid": "4f3feec4-65c5-41d6-aeb2-6aa02ce47705", "comment": "Malware payload (Formbook)", "value": "601a125bf32bd114e726ef0220bce544fd0369353086c73392a7eba4464775e920f923967409ded6eaab18c9c0c7f423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630632280, "uuid": "7c2c4b8e-6a1c-4ec5-a7cc-4f30681fcac6", "value": "T1EDE45A9C3660B1DFC95BC9768D581C64FA6078BA530FD203A05326EDAA0DA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630632280, "uuid": "6b15042b-fee5-495c-b57c-e55421cc7f27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630632280, "uuid": "390a9312-3087-4459-ad67-ff86a1e221a3", "value": "12288:n9fC7nYNpqx9kgEJQshVIFJeRpSiyRZnY9pLDmc6n9KctpGi629c0FLl69pTMbk0:967nYri9kQFGSXRZnCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630632280, "uuid": "b5dd6e7a-c12f-4cdd-98cd-80421effc95e", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630632280, "uuid": "fcfa2286-f686-4a94-8cb0-f06b87f1ad2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630632280, "uuid": "b0b111ac-0317-4940-8f99-9ea8cc8b13bd", "value": "KOC-RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07caf21b-0cc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Alien)", "timestamp": 1630679233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679233, "uuid": "fcc264be-5dc3-4132-b0e5-36793e4f5a72", "comment": "Malware payload (Alien)", "value": "cf326fbe332f899b85f210dbee70dbca", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679233, "uuid": "5dba4214-d2c8-4711-99b7-c7a4558bac16", "comment": "Malware payload (Alien)", "value": "1122a8215822a30c43ad684be7a2c8e4e4733d12b7e5a3aea4b570dc807ce8f1", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679233, "uuid": "e4e16978-e038-4898-96a1-ed500c21ad87", "comment": "Malware payload (Alien)", "value": "835ff482e4c037e8f5aa66bcf6dc4ac83abea6a0", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679233, "uuid": "71ce3801-70fd-4ed9-a85c-4d34afab56eb", "comment": "Malware payload (Alien)", "value": "fd54142baf7ab1c4ec0d6f33e1b386f17759ce877ee9017db2173901635d430119838b5d69013778a2591ffe2fa728be", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679233, "uuid": "0f72a9ed-c919-4f35-abfb-121eea9943a5", "value": "T1A7F533EB9682DC1DD6B31471945272EB349C554C53AAFAFE583A008A1FCB9C0CB2DDB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679233, "uuid": "f65f6882-a2ad-4394-bcb9-97787d4d8a57", "value": "98304:c+RoZL1TRC1xLRffffTeipEXg/B0aLkjyn05Bv0azfkj:c+RoF1TRWlT2Xg/LYyn05Bsifw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630679233, "uuid": "61141531-5859-4f43-84f5-be2b62cfd31b", "value": 3545719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630679233, "uuid": "25fe24b2-7aa7-473f-819c-296c75da6f8f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679233, "uuid": "a8aa806f-d695-44f7-a2d4-5d2f11859ce4", "value": "indirilen_uygulama.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1918eeb1-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630650056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650056, "uuid": "039890a3-4382-419c-a8d9-66ff7ab0ac10", "comment": "Malware payload (RaccoonStealer)", "value": "c45324f48edc91cc3627ba18205e252f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650056, "uuid": "bd0b8163-2b57-481c-8886-f2fd7c6b7a80", "comment": "Malware payload (RaccoonStealer)", "value": "124d47e038ccb87dc5077167f25806d9ed749c1a2d2803f1d679a18206cd9da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650056, "uuid": "acb471fe-07a0-4915-a5a8-d05e1feacc14", "comment": "Malware payload (RaccoonStealer)", "value": "f42a978235834f62c88e6afffbe397c14d5ac226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650056, "uuid": "f6302a2c-fba8-48a9-a060-b37439491340", "comment": "Malware payload (RaccoonStealer)", "value": "59777f31eda6fdcd7e3bf795f8383e4d2fec5dda73d5da63040ea9b98a9d36dc4c6b11413b0d267b98947a56c0420212", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650056, "uuid": "852fc753-b0b6-4c1c-a9b1-04cb0559e0c2", "value": "T1F4A40131B680CC73D196C6744876DEA1163EBD615864814BBAB83F5F1EB338096E932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650056, "uuid": "75f5dcac-e0c7-4790-be7f-14939d631eb0", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650056, "uuid": "bf077767-2e0d-45e3-be92-4c1e743e3617", "value": "6144:mVSLRetsPxG8McWrj6BwVTUUbuOH9p/ecg7fXqFzilQ7CKWrvmayo1x0NWPPMGd9:mVSQyFM7meVJ/YfauQ07mayo1OYT7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650056, "uuid": "7c994aa2-caf0-4c34-b032-72857568fe14", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650056, "uuid": "f190ccdd-95ca-4fd3-899e-5e4c9ce00df7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650056, "uuid": "35fad5ce-676d-4781-be12-b55bf6b3730b", "value": "124d47e038ccb87dc5077167f25806d9ed749c1a2d280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068fdc30-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630659903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659903, "uuid": "81824192-3f52-409b-ba56-8f4ecd16a9f9", "comment": "Malware payload (RemcosRAT)", "value": "dc3e618b6e3673a46e174bc0f0ae2cc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659903, "uuid": "0234ec8c-d0ed-4a1d-859a-db12ab757ad2", "comment": "Malware payload (RemcosRAT)", "value": "13e6341cacb27fdd36b2ce19395dbb02947f0c917b6fd10447f1d6381d51b7d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659903, "uuid": "5be35619-dffe-4a13-9400-453067c39ce5", "comment": "Malware payload (RemcosRAT)", "value": "3a3d80f81043c5547f97c506891b7ce73cd462f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659903, "uuid": "4e488750-fb4b-419f-9500-ad5dc7fd888d", "comment": "Malware payload (RemcosRAT)", "value": "851ce9ffdb5f829055c2acc76f6c25860fa9c6ffcb6ac656c864954f23275dd8b554b434266ab642708e41524988a3ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659903, "uuid": "60917b56-3199-4e6f-82df-0ddb6f83491b", "value": "T1CD05E010B881A072C63238354739C2B56D2D6C303D60BB8F979D3A766F74A82D53A76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659903, "uuid": "38f1e8fc-dd46-4d0f-86e4-ff43da72d2ea", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659903, "uuid": "2c15d780-c550-4ca4-9ee8-546636d7853d", "value": "24576:tEiz1mXg4Pz6cvDEWzRQe31tqMrwdkW3H9S:oXg4Pz6IDEyD3z9PWX9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659903, "uuid": "1108bbc5-4341-4876-816f-9953cc13789e", "value": 814443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659903, "uuid": "cd0912c7-6f23-4b3b-b676-9736af629787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659903, "uuid": "09865ca7-baae-4571-b56f-863d9e10f789", "value": "13e6341cacb27fdd36b2ce19395dbb02947f0c917b6fd10447f1d6381d51b7d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db997450-0cbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630676152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676152, "uuid": "7661d9cd-246a-41f1-9193-943659748f88", "comment": "Malware payload (AgentTesla)", "value": "02c38765e78b0a2ebf927fc2cb9fe6a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676152, "uuid": "943b7853-b79b-4e8f-8994-a7fa49c7efa9", "comment": "Malware payload (AgentTesla)", "value": "145c2aa0e4eb2745aefa1af075ebf8c98dae5c1242824d00439c497f88c306c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676152, "uuid": "181a074b-27a6-4786-9bd9-4e4882f800e5", "comment": "Malware payload (AgentTesla)", "value": "2a6d63e49f4b4249e9d4c01dfba3b3159686a78a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676152, "uuid": "b9932481-2ac7-4410-b05b-0aa18bc6bec2", "comment": "Malware payload (AgentTesla)", "value": "3d9b40afb863fdcb4d6709ece1119ef9cecabb5b524e6d7dfd37c3c638b0f886426b6176d0b4dffd529daf28ec6c42c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676152, "uuid": "50211973-38a5-442b-8795-2e6abc434064", "value": "T11445E013E38144BBD47A073105AB5B207FBAA8315BB6870B9B64593DAE763407E34FE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676152, "uuid": "db1cb148-8464-4fab-985d-3657c78f6403", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676152, "uuid": "f8b48f9f-6322-4ea7-bf31-2de6aeeff922", "value": "24576:rAOcZAhzqk3NNHVvSjMObpaXxf/QSfhNQXNmrKm0:t8k3VSw5QDIrKm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630676152, "uuid": "f24f4e03-dbd7-454c-8382-45ca06155f9c", "value": 1235197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630676152, "uuid": "c989d658-ea0e-460e-8818-e746ae776e09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676152, "uuid": "139890b8-8338-4cb7-a601-7749b093b337", "value": "Consignment Document_z.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b9030d-0c7d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630649465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649465, "uuid": "d6ba27ce-b4bd-4ff8-9737-8d5b6b0e425b", "comment": "Malware payload (RaccoonStealer)", "value": "07b53c78a2e3f9133fbce0d1ee7c6376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649465, "uuid": "54c82e41-53a4-4a64-8ea1-10fc7daf2edb", "comment": "Malware payload (RaccoonStealer)", "value": "173f5bc0bdb61d4dfcb99400b4620b6cb9ad0838836e21b249b09c9ae06c1a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649465, "uuid": "d5b1ff71-b7ff-4e6a-964c-5aa3a7cb1948", "comment": "Malware payload (RaccoonStealer)", "value": "835a1882475952e8e6fc5d4f29fa85101ace0c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649465, "uuid": "03882a73-8e1f-4b86-9720-3da8d983fbd2", "comment": "Malware payload (RaccoonStealer)", "value": "c1ba84c05e5756f0abc9fa3aeba896dab2692661ef6dc0b18313e79cc032acceb3d87e8cf6d37c713bbef057fdc839e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649465, "uuid": "a1880509-0cd6-4e34-b77d-012be8444118", "value": "T10E149CB17690C533CDA2CA705936CFA1262EFC721864854BB6B42F1B1E717D2962336F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649465, "uuid": "c1d9e37d-8a49-470e-b497-9218669e7426", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649465, "uuid": "f342b6b7-be73-469d-b307-b53b24c5bdae", "value": "3072:zTh9pLc/FmBCd9PfYjorHpXFrMJg5tySK9PL9ENPGdwDYTuKJIX:vhfLmFqCworHHrM0NYLMGd7TuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630649465, "uuid": "d56359c6-5f96-4fe4-be89-a79922f9f88b", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630649465, "uuid": "b2d26aeb-b16e-4302-9a18-0e451a9dc441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649465, "uuid": "953b86b3-2d6b-4980-aa1e-7871e4b5d2fa", "value": "173f5bc0bdb61d4dfcb99400b4620b6cb9ad0838836e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464003f3-0cb6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630673754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673754, "uuid": "f4fa106f-2161-4645-aa10-18b79620fdf1", "comment": "Malware payload (Loki)", "value": "9812201de84571b7a86dc5b0a4ef2e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673754, "uuid": "348d6b5e-3ab7-40a7-8820-5063f3fe4556", "comment": "Malware payload (Loki)", "value": "18167be6b99aefbe9432ccfa01f2adc573b89f501dd45d25e27051b45701af85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673754, "uuid": "c0bdfa6e-049e-4e03-b077-5ba5d887079d", "comment": "Malware payload (Loki)", "value": "f699f9ea3d89b768ddc79c9fb9524adaeeb3b949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673754, "uuid": "1d0cc46a-b86e-4cc9-afda-65cef8d1762c", "comment": "Malware payload (Loki)", "value": "10abd11dcd3fecf603c0d887a9c65fbeb6b2883e4fb33946f8032cc0b6f06a747412aafeb32143a723483be7d2266597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673754, "uuid": "3c28fa72-052d-4e0b-8fac-4fe21c6c97dc", "value": "T135A48C9C3660B5DFC95BC976CD581C20AA61B07B430FE343A49326AD9E4E69BCF051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673754, "uuid": "dd31bc29-18cd-4de4-b813-00e68a827dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673754, "uuid": "363a23be-d75b-4600-af9c-efaf1c61dac4", "value": "12288:rS0eASaxn2vUybeFNSmQms6kIHFi33cJn6UqIkQ+N7E:2WqUybeF9XkIHFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673754, "uuid": "3e1da011-c08c-4283-a3b3-0b7678fa91a0", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673754, "uuid": "5ccfb5f6-12c3-4ae6-9d99-29646f7ffb15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673754, "uuid": "25daf107-32ec-4d2a-a949-5c46367b1c6b", "value": "Escanear copia001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6c9b71-0cc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630679405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679405, "uuid": "7be07727-22bf-4b01-b2b5-3ff00de47867", "comment": "Malware payload", "value": "0d66c7098e2b23378e4401ebda708449", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679405, "uuid": "ae8c8feb-6814-4986-b241-891801ca114a", "comment": "Malware payload", "value": "18f7f03a949cbb3c455d0b99397f75a5fb90482a3c611aff07f8a3c36ac2840d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679405, "uuid": "251e99d6-960d-46b7-a799-9eafec26d106", "comment": "Malware payload", "value": "b3c2a34addd448a5a3a173a9acee340cc080ae0e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679405, "uuid": "78a8ad28-a666-40a1-a3e5-2cb2c72108bd", "comment": "Malware payload", "value": "9dd1b8113c028456dd8fcb0f95a15237dc2f33b1285394d769d689c18ce733619ae19350851e3764ac5d1926382d7efd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679405, "uuid": "3f8be258-bad6-4dbf-9f5e-c46925f046ea", "value": "T163A50143F364E862D537C23656751236605ACD188E0BEB873906B7BC6DFFD988E85AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679405, "uuid": "5a34161c-79fe-4e29-8b7c-77dac48e57e5", "value": "49152:qeqV3Zeenig2Nvf6mr3qKyGOpLv4tmc4q:qekYenig2NvfFrns8tMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630679405, "uuid": "b1dd4d3c-7993-4a1d-9675-8a3b9163ee35", "value": 2112031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630679405, "uuid": "b61b6dc1-7a48-4946-8209-2bec100dc597", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679405, "uuid": "6acf892e-b4a4-4878-95cc-fc520a7dcb93", "value": "Download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cd56ec-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CyberGate)", "timestamp": 1630660305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660305, "uuid": "3b3be42f-3b5f-4098-80c2-f77c0ade19f0", "comment": "Malware payload (CyberGate)", "value": "53b1782100bada856564810543d7753c", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660305, "uuid": "8b7ae88a-ca04-448c-b913-e7ea3812376c", "comment": "Malware payload (CyberGate)", "value": "19e71e510a71ff531afb1790500259dd4439fc56ea402c8d4baf205a03b56edc", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660305, "uuid": "da5d7739-542c-45cd-97c1-256e18dd8cf8", "comment": "Malware payload (CyberGate)", "value": "e0da37dfb9b2ebd5f1f1e1d165a6fe46f1ff499f", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660305, "uuid": "f2b47cd6-8a88-4663-919b-b5143b30b670", "comment": "Malware payload (CyberGate)", "value": "9c96c144d1b34801bd3d65259612d9ea12c3dd5d2bf5c8b588028238f655dff2a251f8d2256e7263a29b4d4be9ef3a7b", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660305, "uuid": "b933b65f-8065-48b6-b2d2-812a419aea49", "value": "T17B941252621585EAE6B471F16077DAB404833C1E7CB1311EA8F7FB93A4B0293CD6B98D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660305, "uuid": "2f27b433-983e-4859-b39a-62ed004c68ee", "value": "cc48ea5e322fd984a24025c41607a4b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660305, "uuid": "dfbf2713-952e-4a0b-8d68-b7995916f1e9", "value": "6144:L5SPrxdCD2pyso8BIF6jjkD54Zj77Mn5Ln2sSCMs7rJG1F5:L5SDxdC0Bo8uF6Xm23Q2sSCLJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660305, "uuid": "32d5a90d-83d6-4a7d-b156-a729f5b9d066", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660305, "uuid": "81138ade-ebfa-4692-be20-5313a0546af1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660305, "uuid": "3a7c1ab6-42c2-4f03-a895-f48e73f8e9bd", "value": "19e71e510a71ff531afb1790500259dd4439fc56ea402c8d4baf205a03b56edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44588fc0-0d0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630711546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711546, "uuid": "cb6c9e69-ead6-40af-851f-f838379b047f", "comment": "Malware payload", "value": "1758d67f3078a70ce4e7868971c9016e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711546, "uuid": "97a961ce-cbc0-41ef-bfcb-6f9a56645ae7", "comment": "Malware payload", "value": "19f3e0af305c3308540272f28e6cb0bb382ee809df0091fbf9a5f5221cfc4475", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711546, "uuid": "04f6e59a-a1a9-4d36-80e7-22c8b8a1d2f9", "comment": "Malware payload", "value": "298c6c2f6eeda1c383648000383b1332d479265e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711546, "uuid": "f6f359a6-85f4-4070-90ac-ac27be022230", "comment": "Malware payload", "value": "ea3e1192c4d1a3ded8ad3fc76615062193497a99670fc57343e16562c7e19fad400b2f14c5d2dd15c97b8b90f1ab466a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711546, "uuid": "02a8080a-4b34-48f5-9785-379842b5da1b", "value": "T13F226D6DD251FC0BE126047DF05683F0F32A5062A912BD6F2245B39D0BA26D357CF9EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711546, "uuid": "4688bc70-9070-4353-b53d-ea0a86a41e66", "value": "192:ScIMmtPi95kG/bGv7m7sO55f0krFnuTE39z5b:SPXIBGv7jO5dlrFnuIHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630711546, "uuid": "f40b2a6d-ab57-496e-a6b0-03b98f964f39", "value": 10335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630711546, "uuid": "57c47379-41d7-4a4a-a604-61c3161b3cd5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711546, "uuid": "2f7a4de5-0341-4259-be70-223f7d538e75", "value": "Swipt Copy.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba180471-0ca1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630664929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664929, "uuid": "2f97e6ec-3ffe-4494-b620-f9907295297f", "comment": "Malware payload (AgentTesla)", "value": "006bc7b701f8b38d5672b1eb0eac5653", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664929, "uuid": "455ad23c-c93d-4d4d-b9d6-ae932c051772", "comment": "Malware payload (AgentTesla)", "value": "1a335b8ec4b88187d1971d4d70767f13ee81e261aa0a57cb4fe11a3afaf507ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664929, "uuid": "862dd5e5-f65e-49b9-bd19-402d842e7379", "comment": "Malware payload (AgentTesla)", "value": "f02629c6d99cc840ceaaf0ed46a463dfa83bafee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664929, "uuid": "b444bc09-8310-485a-8f48-77b61920c482", "comment": "Malware payload (AgentTesla)", "value": "aef8b757d6a78bd16c2765450a55d30561ce25670429c8fbc32c9b1562a7446aaade70dbc408276b85a7f7ac6396ec3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664929, "uuid": "f69880c8-d3f2-4dba-88a0-acbcd5aa2614", "value": "T170B4BF59765432DFC957C972CDA81D60AA206C7B130FD203A86335ADD92DAEECF110FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664929, "uuid": "d0d58b4f-7ddf-4974-bd02-3a40f426ea55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664929, "uuid": "c2c38eb6-42d5-4c10-8bb1-98537b745c12", "value": "12288:V0ZfF0QrMgEsA0xbGpaANNbCE9eICbVsea1bEFsXMRHGDr:VSF0Q7EshbFAq4eICxi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630664929, "uuid": "c2e21cd8-ba95-4531-8089-48f750059d4a", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630664929, "uuid": "533edbe1-2822-4ee2-8fe3-05c8b683241c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664929, "uuid": "741e1dfd-01fc-4ff9-986e-d68db1dd57e9", "value": "12300012685_20210901_13294674_HesapOzeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1d2eb3-0c6f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630643159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630643159, "uuid": "5e4aadd1-987e-452e-912d-f39c3776a1de", "comment": "Malware payload (RaccoonStealer)", "value": "f1aa28fcf0cd2cb6cd5dbc4908ca8590", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630643159, "uuid": "d28c0e79-d526-4fb4-bea7-b2284aca66c3", "comment": "Malware payload (RaccoonStealer)", "value": "1b80ff02d64c454a3965d1c7ba536c5eca9e3c289301da557496f938c2a24a95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630643159, "uuid": "979f9c0b-58ec-4165-8eb9-e52b74247bf2", "comment": "Malware payload (RaccoonStealer)", "value": "bbbc7c2ae78c2d9ac3578417ee6ad7554bdb0c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630643159, "uuid": "82b78a81-399f-40be-a04e-9f1e8b03253f", "comment": "Malware payload (RaccoonStealer)", "value": "de9626bdde49a2863be72ae68529d80fea4b691fbd0c96965af8d53e29ea49708623738c25a8a80ede52e09befbd09b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630643159, "uuid": "03779060-029c-487e-a419-fce4a6d3aadc", "value": "T1C765F02C73E6B4E7E096957F2216B36D5CBBF34B6103866829300D89BCD45E95808BFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630643159, "uuid": "b15874d2-1187-4deb-90b1-bf4a03f3469e", "value": "67260fb2ac11e8fa504fec7af97d8fe1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630643159, "uuid": "67a571fa-9aba-4cb4-837a-7ae6fcd74461", "value": "24576:Q3oTCAVKjg0w9lrGzYwvpNIj/lj+0OFmvN+C95gi04KU6tpuFAD:Q3cCrD0Qcwvpq/HOFWNfNKU6tpIAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630643159, "uuid": "12b35d7f-227c-4869-b8a1-5e402231e4b0", "value": 1513984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630643159, "uuid": "c4bacc47-86ed-4492-8f8b-3a2fea6b212c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630643159, "uuid": "2269d253-8e3d-4396-939c-ff99c2f04c3b", "value": "F1AA28FCF0CD2CB6CD5DBC4908CA8590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85029c52-0c79-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630647660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647660, "uuid": "79eed649-c5d2-4845-83b2-df11e1572128", "comment": "Malware payload (AgentTesla)", "value": "7cd0576420c2ac5eaa7ed7f9008cbf44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647660, "uuid": "50dfc770-884b-43d9-9a36-34ccd6a2f833", "comment": "Malware payload (AgentTesla)", "value": "1bd9c9207cf166778bb703ed450a77078f56feaa3da7c32545ec006ee304f418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647660, "uuid": "041372ac-dca8-4548-9b53-8ba91dd3e719", "comment": "Malware payload (AgentTesla)", "value": "7e90b4e2d1042bfc56043c27cd51fc0988b026b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647660, "uuid": "89a17d41-d02c-46e7-ab3a-ace3cf51950e", "comment": "Malware payload (AgentTesla)", "value": "7cd2264179998c727f609498844b3b778db1a650b0553ccf33640c2c3d4f7225dac82d75c2c7b95ff51ff921cab24cbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647660, "uuid": "c9f424bf-63e3-4525-a463-728c28ea35ac", "value": "T1F1D423068287732018470E696FDFD1CB1B228E927DED94F174791AD1EACAF908D1D1EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647660, "uuid": "5d89b49b-c652-4b5a-bdea-1298fd6acee1", "value": "12288:P7f+1ABNUvo8X4yHG7ifFg2rBz+zQceWs3VpWBouHl7u2sCDk:+AMvLX4yfrBzlcRJP9hsik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630647660, "uuid": "a35b885a-1245-44d7-a60b-eac680164549", "value": 598888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630647660, "uuid": "c8188f05-6240-419d-9988-79892fad0c03", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647660, "uuid": "b62662be-64bf-4cb5-954e-45faeb028800", "value": "bank slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234832a8-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630653938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653938, "uuid": "fe5efb25-ffc0-4dc4-95d6-7a5d80309ce9", "comment": "Malware payload", "value": "d1ed0c5fd02b5bba4f05c7d427fd3953", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653938, "uuid": "f62cb7b2-58b0-4958-8726-1f135cd9b1b1", "comment": "Malware payload", "value": "1cc070b2d90f3180882196a63b5b4c98f748ef6aed834832df0f23da50184954", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653938, "uuid": "7292014d-6ae4-4146-8f83-cf65a6cede37", "comment": "Malware payload", "value": "a48f2873e679b685031c958056d7c183a36f476b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653938, "uuid": "1782cc02-158b-4e35-bae8-4305cdd57543", "comment": "Malware payload", "value": "01b05300e64c1bbf48029091f213b3cafd49cd857704bc4f6f0e6055809c3d7bbd18881151739a69d22a700f36a385ee", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653938, "uuid": "ef60fa4c-35c6-41d5-83cc-3be07337df59", "value": "T1BBD4F108B1D75D23EE8B6E37181E0E7569A55E5F0B4245DACF803B9988F29251F30E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653938, "uuid": "4611ea47-24ab-4a60-b1a5-3e1379bde868", "value": "12288:v/bnq+ou9T+RcAh1DtwBBRiM66u/8lRtRm2Oh9FKIAEZ1oQkJ:vTnZTGh1Dto3du/6HsNKIAsoQkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653938, "uuid": "23a8cef3-e74c-4853-afbb-e4beae7f230e", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653938, "uuid": "6f54982f-b979-4d39-a1a4-f6eebb5eec11", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653938, "uuid": "fa4dba5b-2760-4a62-b753-e3caa4cc39dd", "value": "(2nd)_Dt. 2.09.2021-revised.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1621ecd7-0cbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630675821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675821, "uuid": "035eb8bb-fc46-44ff-82c7-8e8b6352c1f0", "comment": "Malware payload (AsyncRAT)", "value": "6e4351b0e6632264c05dd58c9e53d607", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675821, "uuid": "05b62e53-2014-4f9a-8b38-faa7f565080f", "comment": "Malware payload (AsyncRAT)", "value": "1d4a1bc1cf53be8e18789b4c6c351c6f0ee88e14cf4fbde0adc55e0b39010bdc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675821, "uuid": "7ae1d227-36a2-4cef-85f0-626dcc55a4a9", "comment": "Malware payload (AsyncRAT)", "value": "2c45d7c3a5c61fca6ee20a129d5cb9b80cdc1f0d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675821, "uuid": "3f377f8c-780b-468f-adb7-38ca1bf66112", "comment": "Malware payload (AsyncRAT)", "value": "107c240a52535e38cdf3b4756e95fbc037227ab0b35f3432935cf236fe592acb459b83ca7778b0236a7e8a9e3ee4b972", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675821, "uuid": "44753ecd-96ba-482a-a1dc-1f97a31148f0", "value": "T1AD148AA8438DAB8AF30B27493C8316B79C86924FF6F72341A5BA1F0A5306D45775BD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675821, "uuid": "454e7011-20f8-47df-903d-7311ef9e6dfe", "value": "96:KgIyV4VILfLnL1LXL9LwLVlwDaw4qslPW:utILfLnL1LXL9LwLVKWw4qUPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630675821, "uuid": "fe98b132-1c9c-4959-8e7d-64fa965c18bb", "value": 203912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630675821, "uuid": "e54f63d2-7e16-4c16-89e0-0d50457c9d85", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675821, "uuid": "8628872c-6fd0-4616-8170-0a493dcdee37", "value": "7PAX _Trip Itinerary Details.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145a1fd1-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630660356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "d2e4470e-9e88-448f-927c-77e74354bc11", "comment": "Malware payload (njrat)", "value": "036e2584148eb5111b7e78835dfb22b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "3d232746-3ab3-4059-b4b9-c667523e1fdc", "comment": "Malware payload (njrat)", "value": "2032f4f31c54a376ba843d105bcc38e057ce52da9f2274d42c6391d308718366", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "bec2392c-8d4e-4fc8-9816-5c3bf579234e", "comment": "Malware payload (njrat)", "value": "a434806f0660f1526600b166291a114496a93f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "8512b495-35f0-4351-862a-81edfaacc170", "comment": "Malware payload (njrat)", "value": "b1c941db5deca8795ea4eb0549440ee508e25965e617cf2c2b11cae4dea70358c4b2dc98f97c73e4011cba581538fa5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "55a84918-7757-4dbc-ba5e-af71b56e6646", "value": "T1D02417C62B784426C85A4631EC7D824302649BCF4C315B6B9C91FC9D7CFEB8A371BA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "141a4554-14f4-4da1-a900-ccca65d7f084", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "e88dc988-f008-4f00-8c96-6e7afd71828f", "value": "1536:I589ZvRWugMwhFL01OYdWMtKpi/8PH1IhX46dcv7KfTZXCDFhjH8sVHh/9ne7ZRm:G8950tudWMoLPiyucv7YZXCD9Pne7fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660356, "uuid": "7211e433-9fd6-486e-aa63-7897eb4478b2", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660356, "uuid": "eb189be9-a022-47be-a55b-986378e0dde1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "ed30b0b2-62dc-4e60-98d3-d1cc8a076760", "value": "2032f4f31c54a376ba843d105bcc38e057ce52da9f2274d42c6391d308718366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d745fd08-0ceb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630696761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696761, "uuid": "dd4eb749-084a-4be3-a689-03530cb86e99", "comment": "Malware payload (RemcosRAT)", "value": "71de1e4e9693bd5e37eca72de6f42cde", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696761, "uuid": "0aebbea7-6078-4dcf-be77-4131084be246", "comment": "Malware payload (RemcosRAT)", "value": "204806f363e25b8caab19fade1152cbdef6d19a2ee0f122ce2a2aa3949154f1d", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696761, "uuid": "b524edca-4954-484e-9d16-66d20badcd63", "comment": "Malware payload (RemcosRAT)", "value": "79197c202c6b9b5444e54b676c71daa170f66b3d", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696761, "uuid": "3292ee58-d1fe-45b2-b458-59217cf7587e", "comment": "Malware payload (RemcosRAT)", "value": "db9f2b10f513c812568e62c46db8dd2e343ff910470f6202a112c6274ee56382e0282cb1a0eebe746ed33ff80598db5c", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696761, "uuid": "cd95f687-7883-4266-b22d-4ef669dae089", "value": "T1DC34D032B780D855DA9F83B88AE6D69A2712FD929AC74647339DF70E1F30FC05D02646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696761, "uuid": "e5983673-3196-4e8e-b35d-e668e9ff7c62", "value": "6144:tk3hOdsylKlgxopeiBNhZF+E+W2kdACkgAPvAqW5261qS1MmM1c92+CgmivgJh5Q:4eZKcUgcigmivrqFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630696761, "uuid": "1b685bde-a5ae-4f09-9cfd-2c4aedee986b", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630696761, "uuid": "592aa84a-d85f-4796-80bc-3a4e6bae73be", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696761, "uuid": "601e006b-be6c-406a-a863-01659edb3c97", "value": "Electronic Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76f0c20-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655959, "uuid": "990c90eb-2c65-4813-a435-89ab4a20dd20", "comment": "Malware payload (Mirai)", "value": "ace9a76a41b165b2e529eb5d8d12e237", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655959, "uuid": "9a13b1f6-7576-49c9-86da-aacc2c0b59d1", "comment": "Malware payload (Mirai)", "value": "21c0e0b603a591ae1b1b9878e9d739ad4c20bdbba5db31c41d13fa881712968d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655959, "uuid": "09054a71-072c-4db6-b6fe-0b56d35ed0cd", "comment": "Malware payload (Mirai)", "value": "762ab1c5dc242f89e89a9bfc191da14ac0dc1a6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655959, "uuid": "986f5d74-267e-499c-886b-b0d52c6aaafb", "comment": "Malware payload (Mirai)", "value": "a7830bfd153efffe484ae9122789aa212d835fcc145dcd4173f070eff907fe228cbed2048ca74ce653a303957728f15b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655959, "uuid": "ceae0804-9483-4444-8f69-33b168483275", "value": "T108A3D815BF210FB7D89BCD3719B92B05198C654B22E97B367A34C918F64B21F29E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655959, "uuid": "6423d6f2-b78b-4af9-ae9a-9810853cccf3", "value": "1536:4T+h2EiDWyS8gKoKWemUHOtZ/Qh2R/S8ZR+lZ0gApeH3u:4T+h2EiDWyaMWnaOrMER+lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655959, "uuid": "ece50999-fdbd-457f-89e3-4511c815b550", "value": 101688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655959, "uuid": "72da3bc1-1d92-4987-a5ae-f46bfa9de6fb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655959, "uuid": "36f4f135-f931-42f6-ac42-28f8884c8a2a", "value": "ace9a76a41b165b2e529eb5d8d12e237", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1f5bfa-0c63-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630638058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638058, "uuid": "d2d06b8c-f45e-4f40-b882-4ac275ffbcbc", "comment": "Malware payload (Vjw0rm)", "value": "0bc390a3151f3d4524d81c4f039d2685", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638058, "uuid": "77b7bb2e-4f09-4fe8-b852-1f456abcbb9f", "comment": "Malware payload (Vjw0rm)", "value": "21c1f33b0a6d1b5ecaf03b167e8701a9e9fa4ecf8935e9437ad01cc8f944349c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638058, "uuid": "8512a899-f6db-49ef-8032-daba5dfe51ef", "comment": "Malware payload (Vjw0rm)", "value": "89d78b77ddbfbeb17d4d1a589d93f886bdc76e80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638058, "uuid": "2e120878-9f85-4bdb-9ee5-686275511daa", "comment": "Malware payload (Vjw0rm)", "value": "3092e3512e868ff9952de4757860985276d204bd5e45d24f329a990e76dd4e975c5d249b864d7d40f4d6ea1bcbd4abca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638058, "uuid": "f6b86a45-e859-456c-b0c2-e0b2a80c704b", "value": "T141E2B1DCAD45F588C525E678796A6CD8ABF8630FE44983CE381DB2809F35244D2DDA2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638058, "uuid": "a1967a2b-8596-41fa-9391-82b000c58847", "value": "768:gHI5/eQBQq1L6ljJ3ySn/oxQ60pA3n69AQcKspQWB:MIR1mldig/oKu3n6xWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630638058, "uuid": "69af2279-9e4d-4dd0-80bc-17a3a6407abd", "value": 32082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630638058, "uuid": "963e7f23-82f3-47a0-8859-37c7f9120703", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638058, "uuid": "7f6a5193-f386-435e-a789-309368be4aa8", "value": "DHL September Pickup Form for E-Shipment Retu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6d0287-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630650038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650038, "uuid": "3cdbbc4e-b991-4bba-a9ca-b8a9250bb01d", "comment": "Malware payload (AgentTesla)", "value": "be470f01457cfffec146d7a08f67281c", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650038, "uuid": "5991a7ba-b470-4902-a42b-45de20628d40", "comment": "Malware payload (AgentTesla)", "value": "235c151d36b38a1d79c1564149ab9014ffcc7607bc66c7f9a93f11c8cb1983a7", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650038, "uuid": "17bf014a-650b-4413-a857-b3d9b6a7851e", "comment": "Malware payload (AgentTesla)", "value": "3dd08da636d5692e7e910cf0d0c97769fc4845f2", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650038, "uuid": "a18ee6d5-16a1-43ec-a06e-9576bfb5741d", "comment": "Malware payload (AgentTesla)", "value": "92f833ada27a9404c8e447463f44020dfd891790d59e220125b1c053bbdedb40b28a558f8824da1e755322ce797b4c19", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650038, "uuid": "2d21cd06-5f4a-4853-9b95-19ec3f87a585", "value": "T1D7E423CC37278CFED43BE9A132594308107457347C65AC6D06FBBE2A59BF12AD48AA71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650038, "uuid": "d497a080-15d8-4332-806e-161c1442fa49", "value": "12288:7t0Jnzwt/fFcDfXlx5zGa4EazPkznz5nkb/3Dd4ic1ZVrKWXf/YAZOSu:78nctMf1zh49cznz5n+3DmiCXfhISu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650038, "uuid": "d66587a8-7119-434d-a28e-34e6a3b57d92", "value": 678588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650038, "uuid": "d04f6262-52a5-48e8-843c-7a00f461e599", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650038, "uuid": "c6679ed1-f651-4229-b70a-a9f088517b78", "value": "TNT EXPRESS CONSIGNMENT.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0142716-0d03-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630707030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707030, "uuid": "192fa1e7-8a34-46ed-8f88-1f12e40ffe34", "comment": "Malware payload", "value": "eb5471a2d366817aaae34d6906893a19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707030, "uuid": "9f990c30-eaeb-448f-8e14-8ff72103c620", "comment": "Malware payload", "value": "2374688ef4bb51c7a7477bd3cac94db24f00f3707094e569aa4e4681d06a5176", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707030, "uuid": "f78593a9-1e19-4c27-8550-5b1800f3ee94", "comment": "Malware payload", "value": "7bf7f5175760a81c909666cae926211c7806c5e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707030, "uuid": "94e60b24-d8c8-4242-ac85-ebb75be266e9", "comment": "Malware payload", "value": "dc4f6b00eeb5d6432d901956b644b55f6b529dba71ed4704f890a0a918eb293dc843d95f6bf54a46e663dd7bddd43b2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707030, "uuid": "df72ff15-86c4-4b4d-8bb1-4abd4f5f970b", "value": "T1B92633622540C937F5E2E9346038CE85D73E66501E5881A36E383E7F39703A947ADB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707030, "uuid": "481b55f9-dc1c-495e-b651-b0a76017c041", "value": "06fbc87344400a3722a88a2791d1fe43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707030, "uuid": "e8b4ac5b-ab13-4154-a2ad-84034926e040", "value": "98304:PccuZ976e6PtbkO6q2NuNA2Jb7j0guwCmKrKTONHCO3+KJlmcU:kcuZ97YKq2yR0gRnQCOu51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630707030, "uuid": "23d6e16f-1708-47b0-87ba-4373aee416f6", "value": 4623912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630707030, "uuid": "6a6b89da-3dfd-429a-a8de-17136df2f092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707030, "uuid": "5a9f8514-74f2-42d4-9f4e-a86c2698a0d1", "value": "eb5471a2d366817aaae34d6906893a19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f02b32-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659961, "uuid": "5e2649f8-ff6b-4c23-bd1c-cf2c275dd190", "comment": "Malware payload (Stop)", "value": "76a6f7677b7223c5271ff44d85c01c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659961, "uuid": "9a2bbce9-2a07-4e43-8ca8-f55c7093ba74", "comment": "Malware payload (Stop)", "value": "23dc60233f270ba130c16c2a9918166205735e6b5408750523e9542b9e0ea70a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659961, "uuid": "0b3f3fd8-1054-4c48-bbe4-a061a47caf7e", "comment": "Malware payload (Stop)", "value": "2811f08c31fcb6f3dfc75cf80c101c41b4e90a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659961, "uuid": "853c2117-7333-4149-af54-9648d3b64014", "comment": "Malware payload (Stop)", "value": "286f11e3e2846e3721bfc35e7000a42c896d0a6b12c8f7107ff7158ea143db3f0926a835c11096e3f6d0c96d7a89cf18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659961, "uuid": "c96ccefa-2735-4148-8b27-0ac590e8c1ba", "value": "T1D2F412E9B271C972F8CA52300595C6A1C25B7D25F8A051A71B87738FAE3BE80531D7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659961, "uuid": "150b64a0-ff12-47de-ae6f-95e6b68f1d51", "value": "afec05664b511fad431e988e2a228505", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659961, "uuid": "c3c5cb32-f639-4f3d-b6b5-2169d6ac20f3", "value": "12288:khO83A+DWWDIJbslmj5ps/GOJuWcMyZA7taRkQK7X+kpHEveDv1Hc9c6:WFA+qeIOMns/GOJuGCKDxHEGDvZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659961, "uuid": "a61b2b83-21ce-49f5-983d-1d5c5b0fd05e", "value": 775552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659961, "uuid": "74e261d6-d377-4e8a-a4e1-d4c66107a271", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659961, "uuid": "e163723f-24de-44c6-932e-f54d11fc475f", "value": "23dc60233f270ba130c16c2a9918166205735e6b5408750523e9542b9e0ea70a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808233ed-0cb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630671704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671704, "uuid": "3b6cb4fd-5796-4445-97eb-5cb6ee65370f", "comment": "Malware payload (RaccoonStealer)", "value": "17154ce0df2477a9caa57a2fc9ade12f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671704, "uuid": "9edd920c-4edc-4c09-ab82-43e134705e4a", "comment": "Malware payload (RaccoonStealer)", "value": "23e90f7107a6965ebfaf5fcf719feb3fff0b41747a8fd46713ac7cbef4535dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671704, "uuid": "51c71d74-ed97-44e9-a7f8-9618e3a42343", "comment": "Malware payload (RaccoonStealer)", "value": "1c5d885911a82eef7bca53dd4f2b90b6af410c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671704, "uuid": "8c36c6fe-b515-4abf-b07c-84b3c9649c25", "comment": "Malware payload (RaccoonStealer)", "value": "6c00b634b882aaebab474ad7dfd2ed39ca12384c269170413209ace6521cbd034062a4071020d25f71ae012d5ec86d82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671704, "uuid": "21c695f0-49be-4f0e-a817-4f5846cbe1f1", "value": "T1EBB4F1A1395CE433C29BD6305A2ACE847A7EBE2159585647FA302B2F1D30FE0563365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671704, "uuid": "79e53751-0460-4c6d-84e1-9a82ee0ecacf", "value": "ada85a27d4871af00cb9537ea487168a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671704, "uuid": "d0a4c6a9-77d6-4917-a058-437f5d72ded5", "value": "12288:BJp/mfF6y1EVZRY1M8Srfoy/9iTd7wTJe97THlS:vGFzaR8ScyAJc1WJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671704, "uuid": "3aad8713-ec7c-49cb-b90f-f99b58cf09c5", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671704, "uuid": "85535565-eba1-4031-8daa-56ad8f16bd97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671704, "uuid": "dd885ebe-255a-489d-addc-290b3a076cd2", "value": "17154ce0df2477a9caa57a2fc9ade12f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d4b2a7-0cfe-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630704939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704939, "uuid": "ceff6142-5dfc-4251-a2f3-f43e57b7e911", "comment": "Malware payload", "value": "34d8bda29d961c5757f3a8a0ef971205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704939, "uuid": "b4ba5ded-12cb-4dfc-81e0-2b69ed322968", "comment": "Malware payload", "value": "2409a78ac9ab93406bc5d9a812061af68e263f7ebeccadb95b1603b1ff128034", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704939, "uuid": "3429288e-6fba-4a97-b120-05468b03a19a", "comment": "Malware payload", "value": "ab8fcc775f6be016bd98fb64716489c2821f21f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704939, "uuid": "30993d1a-2b95-450f-86bc-3d7b7ae67b50", "comment": "Malware payload", "value": "97efad53ca80f62489fb4cf79380a4a7d5ea9998932a9a7bc8d9fb836446a0d1e4e3fef7a591a11ec104a02d0aa0c318", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704939, "uuid": "c2455f09-d41f-49a1-8a73-e67257f8fdd0", "value": "T1D3E40230A5ADDA32D1EBC130543ADFA05A3FFF6069684047AB642B1B0E31F745726A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704939, "uuid": "32e6e3d3-64b6-4ec7-8e89-c9ab94d99ef2", "value": "db8792b8bee3a608cb91125b46190a07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704939, "uuid": "aa7629a9-6f13-434c-8430-e1253fc65cbf", "value": "12288:xmjRpnqeNQY5yaIMRMdARLIFGdpXEaToAJi2C+v4t8GcvhC4vMP7THlSZ:Ya2QY54eJIUdp55DvcCvg4vMjJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630704939, "uuid": "1af79455-6937-4280-b538-37e407f96573", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630704939, "uuid": "26125177-5f08-4524-8d73-e7b6829f35e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704939, "uuid": "f31c6d9b-e704-434d-86b6-78bd1d5f394e", "value": "34d8bda29d961c5757f3a8a0ef971205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1610c04f-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630659929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659929, "uuid": "a5962e77-88c7-4882-81e6-e986b479396a", "comment": "Malware payload (ArkeiStealer)", "value": "187ba3b4281e48ada5a7c8e6beba06a0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659929, "uuid": "10d3ffde-3afc-412f-ac64-40d16bdc4fdf", "comment": "Malware payload (ArkeiStealer)", "value": "240da2ce69194d4816e25503e3c096a05725cf2bfc79a7a4d565c46d07589ebd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659929, "uuid": "5be3211c-1bdc-4cba-8dcb-ac3c72c54504", "comment": "Malware payload (ArkeiStealer)", "value": "2d4de494da4ef85669c26cf356b1fd629466e959", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659929, "uuid": "810ae46c-96c4-461f-840a-79fbdd76450a", "comment": "Malware payload (ArkeiStealer)", "value": "63612d7e70e2d52c2fd7b0363734b33b03052eff8bad6677c29064ddb62f5f6acb32f6acb570a57fc92c7f3b6ad80f93", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659929, "uuid": "b0a28c33-728b-42c2-bdc8-88b41b4d58da", "value": "T10205022076B1C139E5F742F4596DA39DA82D3C716B2050CBA2D326EE52372E4DE3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659929, "uuid": "e7352d4f-f4d1-43c1-a36c-29e831dd4b43", "value": "87931c028561c299d538d462f4889ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659929, "uuid": "e3811c33-b46b-4700-962b-6bcb2a77d796", "value": "12288:J/HZ7H/2d9FbCr027p2jjS6yGW7U7RoGOr1L6no7OSynbp0+otLyRHCVvUtd1ee:DH+dhJjOti7OJGo7OSyERvUtd19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659929, "uuid": "530a8f8a-1244-4bd2-aafb-9586f0b67f8e", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659929, "uuid": "109bb17c-caea-46fb-9e47-0b76359a79c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659929, "uuid": "f6e6e966-c080-46c3-8223-64632b2528c4", "value": "240da2ce69194d4816e25503e3c096a05725cf2bfc79a7a4d565c46d07589ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5b5e29-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630655809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655809, "uuid": "ba007359-2128-4876-b23d-e6146bcc3df7", "comment": "Malware payload (RaccoonStealer)", "value": "f3e45f00b14b27a28c0ac04b5475a4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655809, "uuid": "df5373fc-b514-40c1-89e7-ade14a03b3d7", "comment": "Malware payload (RaccoonStealer)", "value": "2457694ff7a2d4ec5881b14863764a2aea6f16e41daec0998ca45c53f435d8b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655809, "uuid": "68665fc5-0edb-4e66-886e-fdae5c555ec8", "comment": "Malware payload (RaccoonStealer)", "value": "e32d9e41ca35311d8593475ee005c3ceecfd3bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655809, "uuid": "defd4e8a-181a-41f8-bce7-5150f2969b82", "comment": "Malware payload (RaccoonStealer)", "value": "b904350a46ef4409fd51e52889052d0d5ed07579d7cc861cb499a8fcb5cd4ec0fe4f2b58b9dde0aa78fcf2057dd108d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655809, "uuid": "1ff1ca2c-1ed3-417e-a52b-8aef5dc37a8b", "value": "T14BA40174BA81C433C5A2E5705A2BDE9CD23EBC22D9A48447BB783F5B1D71391492236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655809, "uuid": "9f6b91cf-1b8e-4419-9d84-b1054d5025fa", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655809, "uuid": "be464c76-4779-4f1d-be94-a9a97c5bc4a6", "value": "6144:WVCLRdtlV/6gpDylvxV9Oscokw70Ab/tqwkTw7t31/+010b40k3GZ5dWOmtMGd7B:WVCbd/6227vPcor7dMTuiG5lCxa7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655809, "uuid": "fd78e1ad-8361-4952-aad0-36a1a24b8afe", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655809, "uuid": "a76a750e-3ddd-43ed-a017-2058170d3de1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655809, "uuid": "0d461bcd-a980-4356-9c53-9a9b0755ff65", "value": "f3e45f00b14b27a28c0ac04b5475a4a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553838cd-0c4f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630629541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630629541, "uuid": "556e0da8-a3ce-45d9-865d-f2540b8abf53", "comment": "Malware payload (Cerberus)", "value": "502960cbb9ab3052ec1e2ecb4407c637", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630629541, "uuid": "cae1bc05-b0cc-405c-864e-59d3398a7736", "comment": "Malware payload (Cerberus)", "value": "24b7332215cea0e4ea9d61b672543ea99354a108c12b922108db23e4715c3470", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630629541, "uuid": "1a65c2a8-63ac-4d59-9f42-c529b87c4b0a", "comment": "Malware payload (Cerberus)", "value": "17865d9f4860dc3c5251281c2e567042ada746c8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630629541, "uuid": "ed9b8593-6606-446a-8bc0-e724cb1f9296", "comment": "Malware payload (Cerberus)", "value": "af7a6ac3c8fb08c783e523bfe21717b961ce0d00ee44060a9aceec0bf84aebc87af077fe0aa48a98eed2ee067c89a8cc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630629541, "uuid": "2e1f3ea9-aa2c-41a7-8d81-c582d13e40e8", "value": "T1A5E302928BA3206AE27BEC70D4F3135DB75642B142F2E7DE13190414ECA67C54F76EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630629541, "uuid": "2b862932-9690-43de-a597-ce9ab8ac700f", "value": "3072:DgcsWZ+EIDeyT+8VVRfq25b+Q8ppg5Ds8P0ZL3:sbWsHDyCVRfbiQ8numL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630629541, "uuid": "e3fd149f-b7be-4ebf-9296-cac2864f3df4", "value": 148208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630629541, "uuid": "e0db1b7a-1127-4454-8c8f-a9311a016918", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630629541, "uuid": "29a00916-e2f3-4685-9227-e1024fe018c3", "value": "wqeqwe build.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4733f264-0d0f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630711981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711981, "uuid": "abfae795-61a0-461f-9916-154fc39db858", "comment": "Malware payload", "value": "6e6a892ee7ebeddd6e077f3628781281", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711981, "uuid": "a6049c2e-6b40-4066-8982-cb7b23ebb221", "comment": "Malware payload", "value": "24dfad5f70b5527928281e1f80998ea8424c1770865ff917f4d2879697bacd64", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711981, "uuid": "dc1cea0f-ca2f-4421-aa0a-885c19cd3738", "comment": "Malware payload", "value": "d8142954b769e4146ad7ff2ad65dffa1668f27bf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711981, "uuid": "89ee5470-90c8-4aa9-8bfc-cb829926995d", "comment": "Malware payload", "value": "706291256c89fcb2ddcaa849478a1b65d4880bcfb4ffe206388ddf0cb12a9867dbf4bbbeffbc6a0697d91be337b2b1de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711981, "uuid": "8ef50e88-3303-422f-8d29-059576c7d529", "value": "T1C354231C3F901DBFCDA8E5626551C0B9209E9AB44934E60D52EE776712CAC3C1A78ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711981, "uuid": "6c5d6f5a-079c-4cb9-86eb-36fba9afeb1f", "value": "6144:r8dbCd1h08v9rOkP2ZMZD2pUOuwGXw8RY3lHpnQ7Zq7ZH1AwZl:cbS0grxOA2FuVA8C3lHpQdQZHRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630711981, "uuid": "2c5c749a-7071-4117-b258-3114004cc502", "value": 283077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630711981, "uuid": "7840e296-1f1e-47c4-8ee6-2fa20fbdf68c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711981, "uuid": "07b04b16-a3e9-4e03-b933-17ce7cd6136d", "value": "4980.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b52335f-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630654086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654086, "uuid": "94c84dfe-3d8a-4b55-8d36-7cae4d3c4f27", "comment": "Malware payload (Formbook)", "value": "79d02002f7841dceae1bc53186c94b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654086, "uuid": "324afc6e-e0d5-4c77-8360-86d544510243", "comment": "Malware payload (Formbook)", "value": "251a226acb74675f4650739fd13adb1c1b468e53936ccc6385dbbdacb5220ade", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654086, "uuid": "ffefc034-dac1-43e8-9d52-d85ee2149a08", "comment": "Malware payload (Formbook)", "value": "3bf5dc0017d1239d962a80d48236c785b56cb78a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654086, "uuid": "5d271fb4-1d2b-4b96-bf09-9f24b711edb8", "comment": "Malware payload (Formbook)", "value": "6dcf2ee0e62b7029f10564215cfd2189bf51e4416d710de302e8c7ebb4fa3bc1e3fdf8852a9cda72e018f7f7cbc19447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654086, "uuid": "d40204d9-f188-4fca-a800-8d27f2358630", "value": "T10FF38E32D641C030E2B242F5F2A91B7B893D0D353254A0A6E7E52AE16EF16E5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654086, "uuid": "52eaff6a-3a28-4f01-9677-c2e70b51c40f", "value": "3072:gB3/tvOj9kXHjBYCoZ0ZbWRkY0SOLdryJAG3aIGyxUOw0Xa:wdFjoZwqSYZOLdryuGq+6h0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654086, "uuid": "67a590e0-a7b1-4b03-801b-92c68dac218a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654086, "uuid": "631c49dc-b10b-4366-b9f0-b5a9f1d0d75e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654086, "uuid": "5f01105d-d7e7-4180-929d-28007c30e344", "value": "04_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d02ef1-0c98-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630660954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660954, "uuid": "e76f3bd6-e628-4707-8ade-3bf6facf4eb9", "comment": "Malware payload", "value": "79e8bf71b00870053d1423008e694753", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660954, "uuid": "bb086532-6558-43b2-b946-46a862f837ea", "comment": "Malware payload", "value": "25ab7bebc9f9ca8bd5f6da34b0f065649209f42eb20de0b229ff2f37f14e41de", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660954, "uuid": "4738da66-cba0-4775-bedf-0e9cb81487b3", "comment": "Malware payload", "value": "91076ee8ec1a8c03536296fa821127e7ee569fde", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660954, "uuid": "320e3fc9-19dc-459b-8923-edc751b7f926", "comment": "Malware payload", "value": "ab4d0294f63f14c161de27edcceccf6c7bd1bf5dd74da8e14cffe01eaf1537540b8b48fa80a9ba7a58fb5ce04096c247", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660954, "uuid": "e8134305-d536-4262-aa43-50ef6f83bfb8", "value": "T14AF113892CAB14D07552711A0FAF51171A7C8B173469FE30FB2CF7115F298246BA86BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660954, "uuid": "df35ff61-6705-416b-95ae-c50dbd23bd7f", "value": "192:aFDiYYuRd1+ywCjh97/2b77XiSoyirUfJluz8yVOOb/MYyLh4VT2B3:+VVjhZefzweOU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660954, "uuid": "276b21e4-f2be-4efd-9e4b-57f618902760", "value": 8065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660954, "uuid": "990e4638-b5b5-4b86-bff6-6a48e256ef48", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660954, "uuid": "66926ab2-e9de-40b1-ba83-d61caa9e408f", "value": "bypassociation_com.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c0167a-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654365, "uuid": "dc0372af-5825-416d-8734-49ab3c9f2426", "comment": "Malware payload (FIN7)", "value": "72149bbd364326618df00dc6b0e0b4c4", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654365, "uuid": "4db09070-09f1-4f42-ba1d-0d45d6fcd250", "comment": "Malware payload (FIN7)", "value": "262f38e1d3bb10021c1b23ea48fcd77010b0bdddbbd5b8df64f570f16ffb2caa", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654365, "uuid": "77fb4e5f-4f2f-4fc0-80bf-6d64b5252e6a", "comment": "Malware payload (FIN7)", "value": "ef878e44108b4b9103a32ecf7aae95e3e580e309", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654365, "uuid": "367f5124-cca1-4c27-ad83-c3aebaaac63f", "comment": "Malware payload (FIN7)", "value": "1e2852ddb09cb7b768ec2bce085301ca96d8aec96f1266ce9a8349b3593c0f0fd96aa64ee2f9d26f15792e1994097f3e", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654365, "uuid": "02a0b4ac-a84a-4a58-a511-739252494889", "value": "T13741EF190A471B31D5F589B199F6520BD7B5BD45FF892F5F00D543E04825701B8A2F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654365, "uuid": "bf50f525-23bf-48c5-8efc-e2d649806e03", "value": "48:8nXUGiSxNidabNPKpwRXUGiSxNidabNPKp:8YosQQwyosQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654365, "uuid": "d0ee22e0-55ec-49eb-a88f-4b9f55dbc7b4", "value": 2242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654365, "uuid": "0c99e47c-b0f6-477b-b0f5-e7b798f60a53", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654365, "uuid": "bc04d6bf-54cd-4e9b-890a-1f0e3ddc1f77", "value": "Users-Progress-072021-1_LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c9a63c-0c80-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630650862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650862, "uuid": "99237585-1cb7-4c77-a8f2-d9cc01643fe8", "comment": "Malware payload (AgentTesla)", "value": "577c36771175a8aa3289486d656fcd41", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650862, "uuid": "638b3e82-7332-4bee-bece-b0b8a470ac75", "comment": "Malware payload (AgentTesla)", "value": "26a4ed68519b03c103390a187565d985d5fd9d50b67aee6389da32ce9b0bbd9f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650862, "uuid": "e70f5e61-259d-4f0e-b899-808e5823bd73", "comment": "Malware payload (AgentTesla)", "value": "04fff000a9320fdcc5619f188ad8d2727a6dcc41", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650862, "uuid": "f4f06b34-0309-4585-8fd5-34fbd7933b79", "comment": "Malware payload (AgentTesla)", "value": "ea5293423ece602ddbaa1faa50b3bbe3e7da43882367bec61f5f90855be5819b9000fdc1d2a623216dd61f9bbc1295b5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650862, "uuid": "195db95b-9585-43f5-a83e-63003e3e45f6", "value": "T185731213FEED05E20128E765D4268EA4DB6661E397614C94F9272BD28F49AF3321F483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650862, "uuid": "3510ea16-f3a1-4a48-a910-2ac0fe8850f5", "value": "1536:3cdAulVS+EPFWLFQWCnGQHyU/NDdGmUGcR6oFyqNGEc2W:3cdAQVS+EPF2X+HyU/KacvrwkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650862, "uuid": "fb1807ee-a957-4889-8423-697b8298433b", "value": 78572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650862, "uuid": "4223c774-5192-4745-a8cc-1db53a3f1723", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650862, "uuid": "eb9374a8-5589-45ed-ac6c-f42f4895a3df", "value": "FT0821.PDF.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4669cbf5-0ca2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630665164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665164, "uuid": "6914826b-ba75-47cb-9d8f-0e905e9f03a3", "comment": "Malware payload (Formbook)", "value": "04a7c4b1f45d77d82a64a3678cf191a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665164, "uuid": "1aa830ba-e9c6-4f69-a596-575336565327", "comment": "Malware payload (Formbook)", "value": "295fb6ff93058f10663cd878f81f8aaca2ad3e5c9d90b97712e112023707ed37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665164, "uuid": "da2997cc-033b-4856-865e-69e4f2f677cc", "comment": "Malware payload (Formbook)", "value": "5d01744663376da131a9b08f0b25dfa22e0e2f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665164, "uuid": "3a7f9a5b-79db-42ab-8891-d710f220a6ac", "comment": "Malware payload (Formbook)", "value": "0f3cb40a357d5d3daca068031db1ee0a0f6362759dc7434dda1a355e70181c4201d7e5047c1687672cbcceb1cc51aa07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665164, "uuid": "2d9509b8-8e0c-44a3-87c9-ae05938d43fe", "value": "T1C3B4DF9C725071EFC85BC976DE682C64E661B476530FD207A45312ACAE0EADBCF160F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665164, "uuid": "3cc36b1b-a4c6-448f-b468-980853855063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665164, "uuid": "d4589005-074a-4823-821a-6deb8cbe694f", "value": "12288:BqvUG1BlXx7ijMhPFRbn2OBgXFBtpXwkKHutdB2LdC:4vUG1BmjMxfnnC1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630665164, "uuid": "bb268b4c-bab4-4132-b7bc-5a83226b4e2b", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630665164, "uuid": "11a7ff3e-62a0-4f97-a34f-5bb7dcac29c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665164, "uuid": "510b07c9-12ac-4486-9ba2-342f9f613dfb", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304902a7-0c79-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630647518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647518, "uuid": "13be3857-adbe-41f6-a157-a1cc42aebd60", "comment": "Malware payload (NanoCore)", "value": "a2c2192e9aa372ba9efd93469ba145eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647518, "uuid": "284551de-8721-455e-8723-fdab9efd058d", "comment": "Malware payload (NanoCore)", "value": "29e766686ce65f56a755083d459e1239f769cdea913f2e223140572dc2cbbee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647518, "uuid": "25502e55-7a0e-4db6-ac8d-c3b66a1fb5a1", "comment": "Malware payload (NanoCore)", "value": "a0d0b3241610aaea2ece9705f5a77ee1eb1881a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647518, "uuid": "15148672-ac0d-468e-85d0-0b65a9d5d8b8", "comment": "Malware payload (NanoCore)", "value": "dbbd9ef396c5280c60dfbfb8cf047277a2d11eb3988642e4ad92b91b9adab2c1a1ef0ab9bbb8299739fa69a5a2dd7681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647518, "uuid": "32ef1ebb-56c0-4a6b-ab46-95de478a9e77", "value": "T19A25EE3DAD2626336FA9B17CD4D6194EE79414EB23714DE9D1E2B38C200B917B2DA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647518, "uuid": "f265906a-83df-492b-bb8f-55c41701da39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647518, "uuid": "92842889-2e86-4bcd-9bfb-7afa122689b7", "value": "12288:8d/F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Mei0f:oKnGlVf4lcz0TjwE29kOPf8PV4HIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630647518, "uuid": "436ebd79-4617-4dab-8cd5-de58e0345eaa", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630647518, "uuid": "65fa287a-f2a5-4118-a9ab-cee197ccfd3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647518, "uuid": "f3df9c8e-0e75-4ebb-8446-a4c5b2cf64cf", "value": "Expo Grup - 1122002092021 Sept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55fe3a9-0c94-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630659445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659445, "uuid": "9f5c6fd3-c5fa-4db0-80d2-8805c4ce43cc", "comment": "Malware payload (Formbook)", "value": "c13976b4653ada57f5b39e16a793e99f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659445, "uuid": "137b5df6-931a-4a8c-8179-b4a0a56ba2da", "comment": "Malware payload (Formbook)", "value": "2ad430df48ef7060c1fa6c6c89698c95724291b314155288d5c13b5735d3837d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659445, "uuid": "71f7ebe4-3f2c-4c68-a3ea-e30b9541a4ed", "comment": "Malware payload (Formbook)", "value": "15b82b5c7d6f94b443fa64e29d5102b16efb0844", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659445, "uuid": "9632b47a-cf4a-4d97-a6ea-055284ee4c3b", "comment": "Malware payload (Formbook)", "value": "a88f08b5f8bb67d946a40915a239b99fa57cce9bb8b241c23f06abd012667a94107a2d2ccb6431dc8cb95dfd2ac72da3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659445, "uuid": "a0eeb09c-7479-41da-b6eb-a7a8cf5a00f8", "value": "T1A7D40A3E58FE23279176C7D5CBE58823F6C498AF3233A96467D747264306A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659445, "uuid": "f5fb8a68-64f3-4b53-a9a2-1ceb602e32ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659445, "uuid": "7f39ce41-9b9c-4f78-b62f-0d8ccb187b6a", "value": "6144:IFJLgGtFoJU8/X/e6BBzVbGH/IEz0gGUN/BGuiseR5dq+VuSzRCw9muHdkaob:ZX/3GH/bvr8VH0BwdkHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659445, "uuid": "2a005cf7-c8e5-4ec3-be8e-700d1b6f8cad", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659445, "uuid": "28ee25b7-60b1-4c75-958f-e9719798ea20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659445, "uuid": "4de2113f-64c3-47b1-961c-d9fc8a217a71", "value": "c13976b4653ada57f5b39e16a793e99f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34469781-0caa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FluBot)", "timestamp": 1630668570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630668570, "uuid": "bd871a27-2f1b-401f-95a2-231d605c1240", "comment": "Malware payload (FluBot)", "value": "ac773cd2c075d4ad82659d9eaa369155", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630668570, "uuid": "7701b08b-a6f8-474d-8cb9-888be69702e8", "comment": "Malware payload (FluBot)", "value": "2b26c52922e8d4f07e948f13970025d62c0d96bd0fe6802d0567fd2c73b94392", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630668570, "uuid": "abf44cea-b231-47cb-812a-15bf00fb58fb", "comment": "Malware payload (FluBot)", "value": "6bc377e4a3e6e95ca74928837e3cced108cb625e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630668570, "uuid": "0985d2fa-3657-433e-b482-dfb1435d678c", "comment": "Malware payload (FluBot)", "value": "17e8442cd231a4e635d8b17fd81497304312a0210508dc517dfe52836e6423fe1e4ddf0e2bea7075ddfbeab1fcac2e10", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630668570, "uuid": "7b124fb2-b8e5-4a0c-8f79-c04d991c32e6", "value": "T1CFF52216FFFEE516D007E134D6649897840844484A0AFE1B7A2A925CCFFAD44AB43FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630668570, "uuid": "2db94de8-1888-48aa-acb5-56df83ed82ce", "value": "98304:utQGt3ZuI7y690JAD/oD4Itdl6/LTdCHwY:uCGfuI7y2oDRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630668570, "uuid": "1a8d2800-3bbe-417a-8491-ca53fe0de666", "value": 3457984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630668570, "uuid": "f6aa6b17-bc7f-4c1e-a1b4-fff74403ac34", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630668570, "uuid": "31651abe-f110-4e3c-981c-dd293f81aab9", "value": "2b26c52922e8d4f07e948f13970025d62c0d96bd0fe6802d0567fd2c73b94392.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9af881-0c7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630649095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649095, "uuid": "aa6e33cd-1cc1-4f18-9b99-888b77db0e49", "comment": "Malware payload", "value": "ba637e245e7cd75933d061b860853719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649095, "uuid": "a22e2382-40d9-4ab3-bfe8-26c061155283", "comment": "Malware payload", "value": "2b6f9d534ca5ab5bfe6a9328b3b7a267b8e94a348f9789a7ef2c07127e58ea86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649095, "uuid": "d29d6cb5-40f3-41d6-9404-87405486348b", "comment": "Malware payload", "value": "5659924346a470a68bb5610d6d73020b1a191dc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649095, "uuid": "dba2215a-16ca-44ae-abf8-f4b74bfab2db", "comment": "Malware payload", "value": "1f6011038582d7bdc507c573ce27b770ad14848652de057bbe61ad2d218b731cccf6cfa18f794b0dff5ca257a7d335d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649095, "uuid": "d8251b0b-352e-4fe3-8bf6-ceeb78370eba", "value": "T115F2F133908989A1FAEFA4FD0994AFC903D107E19E624F529325565CCCA86D3E42FCC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649095, "uuid": "5a7605f7-7974-4a19-b731-f9fdacf51da9", "value": "768:KOOz8lPPpQDMIfsvpmhA4SHr6tB56GSwBr8n74CIdUXb4uVcqgw02TWXq:FOaZcIRmmFHeL9rw74M4u+qgw0cWXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630649095, "uuid": "6107706a-7ffb-4bcb-9d42-198a26ad43ab", "value": 35184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630649095, "uuid": "1a737e2f-f639-4e06-992d-43d67a65ea56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649095, "uuid": "e4d9cbea-af35-4522-b591-67ab07b032ea", "value": "ba637e245e7cd75933d061b860853719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d761dd-0cbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MyDoom)", "timestamp": 1630676914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676914, "uuid": "57b5956d-a749-4291-8a43-5c3dbd6c839d", "comment": "Malware payload (MyDoom)", "value": "6e3eb7a689f74c1be3cc36e17b5b40b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676914, "uuid": "5bc96c66-1139-402a-97ab-382d5f615bec", "comment": "Malware payload (MyDoom)", "value": "2b7e797179a4c286386e147c85ad5dd117ec5279470588387cb68ee8252bfd87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676914, "uuid": "1230574c-48ae-4111-9b65-173c73abd940", "comment": "Malware payload (MyDoom)", "value": "368a7fa00deeaf424eb120e33584aa0e26c77467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676914, "uuid": "bb588b38-3c70-4a90-b41f-ed528d7e6dd9", "comment": "Malware payload (MyDoom)", "value": "a00414af65818051b74f322aff77c9d8c88205e2bfd4fd700aa85cdc41b899a3a34c6925f6cf513d321dc0c870d35e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676914, "uuid": "38308ccc-d3a1-4697-b6b9-6c954ed06a2a", "value": "T1E973C003F9689433F48242751959B7632EF69DBC06265283F6A41E0DEDB4BDBBA3CC11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676914, "uuid": "41d02e3f-048a-432d-95ee-68997f7e0f37", "value": "6786ed16c434f43e76d0897f96e17f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676914, "uuid": "8450567d-dd29-49d7-9d7b-c30ce275ad4e", "value": "1536:n87wc1aGNC0klI7CPpIFa62p+g/1DrkoNrs/bZM1vxKf0:87wc1aOCo7CxIM+g/1Drko69Wx40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630676914, "uuid": "341bcd60-64a3-4ae0-8e05-8fb015d91924", "value": 77452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630676914, "uuid": "0522be78-b138-4948-a0fb-c0ae1cda535b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676914, "uuid": "7b5b2878-a577-49e3-9293-18a1812b2d72", "value": "document.htm .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac3c372-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630653951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653951, "uuid": "b0fa4372-f43f-44f7-a915-52c85ac03d0a", "comment": "Malware payload (Formbook)", "value": "5e5503af0a5c67e9214d4d27018d3bf1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653951, "uuid": "6274ce96-8509-490e-b22e-7a08b5009f25", "comment": "Malware payload (Formbook)", "value": "2cd8b7a55f9fffc01686bd058a68c7e645cdeaf51b617100639ee6b43db26ed8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653951, "uuid": "699a1a07-1154-4919-a6c9-81cbafad4b42", "comment": "Malware payload (Formbook)", "value": "03d80094e445d198be6bdb870d572ee6a4a01398", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653951, "uuid": "9361d3fa-f4b9-496f-8188-01c44c0d48cd", "comment": "Malware payload (Formbook)", "value": "4ab959ad5b5c611fad5910f61b9beb58774dfd8eb01f86ea83de9615b80ef4ce959b3da4fc8bdc1f27a46f460fb21109", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653951, "uuid": "502a4562-7d8d-48cc-b718-c22422697550", "value": "T1AAD402295C6BD127EE30873F6DC3B214E380AF6A071CDAB630467EDF3535915A36A944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653951, "uuid": "b65977bb-cc39-4204-b913-6786d4cf5139", "value": "12288:Ol0fSxPmlth5B7zx0XNncZeGzX+EpnTJ07DjfF2ZH:ePmF6dcZvNpnd07vFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653951, "uuid": "3578c5f1-6744-42f9-8e6f-734a272dbd11", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653951, "uuid": "18de737c-cad0-4412-9bc2-3585c0468089", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653951, "uuid": "04a4692d-10a4-40f7-9349-4fee299d3364", "value": "MV NORDSPRING.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda91f5d-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655942, "uuid": "0ce60428-38f3-4ba3-b9f9-ffbb296a8489", "comment": "Malware payload (Mirai)", "value": "2c1583295955c13a9f62040d5e996b37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655942, "uuid": "d2a60cf2-e57d-40fb-aa45-ed17609b97f1", "comment": "Malware payload (Mirai)", "value": "2d41b76b42a8ed124b922085d8684d72715e7312601f04f37db4f0b566561786", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655942, "uuid": "1797b0f8-ccf8-44ee-836a-dce2e3f55441", "comment": "Malware payload (Mirai)", "value": "2b86c75ed4e63a9a6ea2b97c3bd71c871f3b61d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655942, "uuid": "461bd1c0-2eb8-47f7-a37f-e0b62d3c91a2", "comment": "Malware payload (Mirai)", "value": "9768057d8d026bac1674ada2f2543e7aa1b5cf70a04599c6d2978c3f946a1d2eff6e61d9e7448e944d1529bf5723a92c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655942, "uuid": "e4156a75-7370-401d-87ff-10b879833f5a", "value": "T11123F128D9A88817D36FB9709EDBBDF497A21B073C75E0D2A06F29300137551EA01FDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655942, "uuid": "38464c7b-1b3a-42e8-bf45-52d287bab280", "value": "768:5G/yUIWvas4MuBB7j7kB9KelSpHUjm7rq09meFD26PBia2NijFqmQIIb4uVcqgwu:5G/yUIWvasBu3j7krKySBpq09meljPBr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655942, "uuid": "8a50be8a-67b6-447c-83bc-1f045e87e7c9", "value": 46600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655942, "uuid": "881e9f38-c202-4d1f-9c36-c1e5f936801d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655942, "uuid": "8e73c187-b694-4979-b2e6-a17fe7c56b5d", "value": "2c1583295955c13a9f62040d5e996b37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8872a05-0c7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630649088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649088, "uuid": "13fd01d7-f3dd-4545-9bf8-ab46395263fe", "comment": "Malware payload", "value": "213321a99d466659ec61785784055037", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649088, "uuid": "dc6283b7-a4df-4489-a1a6-88af9c61ceea", "comment": "Malware payload", "value": "2d88455eb06424a1084d0c94367a4515e46c7affa3d89d51f711517890e36c60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649088, "uuid": "33ce4791-2489-4f43-af57-27cea133d7eb", "comment": "Malware payload", "value": "8fe49d1450f585329037ed86b063fa1386cf0b53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649088, "uuid": "102c9a65-665f-4730-a7c5-d4002afa8e7c", "comment": "Malware payload", "value": "61869a11707b1b9d70ef431888da8d45897cef09a4092788607b9860a834ae94aa188752dd80537c3ad67c726824ff1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649088, "uuid": "53d48a1f-91ca-46bb-803f-291a2e3c8428", "value": "T1F403E19FE8583CC8D75D4E7AC99C21B9BC58B482825ED25867F60C8ED98FC03B94D40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649088, "uuid": "4734890d-edc4-4293-91b4-5a1336d1c748", "value": "768:Edi2CrRvrGAH5rvSePYhWxmQ8q+ZiJhJEdt4nXilCi96YXzquRYiF1WRhb:ui2QxGAH57TuM1FiUe6GzqBikb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630649088, "uuid": "1821d423-432a-48ce-ba8c-21639119f14d", "value": 38036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630649088, "uuid": "c15fb22f-9490-49ee-aac6-83988e250f14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649088, "uuid": "0a48615c-a6a7-45df-8972-67a80a8bb1e2", "value": "213321a99d466659ec61785784055037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09c3214-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659866, "uuid": "c20e3ad1-a1cb-4c03-bb7b-f00567831da9", "comment": "Malware payload (Stop)", "value": "ce1fd503790179e50bd9709eaa0ed05a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659866, "uuid": "57d31c3c-70cb-47f5-9a0a-7aa3a65bf0e1", "comment": "Malware payload (Stop)", "value": "2db346799c65a4fc59e3063f0c749ac70e160ddcd4f719e897463d6de53621c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659866, "uuid": "66b2ae43-bc74-47b1-8d2b-ce738d0e7260", "comment": "Malware payload (Stop)", "value": "2653abac1201b6a60dff1a8e90f04c6a4e26abc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659866, "uuid": "06aae980-e0a4-4551-8874-948667c806a6", "comment": "Malware payload (Stop)", "value": "56cb05016f773682c9e90a2735d87ee8278d3c2f4404be4e647e792eb975888c21e84050109ea75cadb2432ad155301c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659866, "uuid": "a7066450-8fa2-4047-b27e-ed1cf92619b9", "value": "T18905F120B690C031F1B311F899BAE2AC65297DF15B64D0CFA6D13AEE26B41E49D30777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659866, "uuid": "8406c79a-3b56-4987-934b-0c3fd13137c4", "value": "c228cb90f452afcd70a9949027727f58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659866, "uuid": "6091727e-ded5-42d6-a911-cc09f9b94cb7", "value": "12288:xnGkNScSjD/Nq8JqSSOAmXwO+fek/bCGAGGo1ixrU9PxUgNH1cLRR+QzrCY5iA:5GkNSJ9c/ea+FBkiOLN2R++rCY5iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659866, "uuid": "aad18506-acd1-4469-b1be-66d3e81615bb", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659866, "uuid": "083cc96b-0ae0-4af9-aa66-1cad1322afd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659866, "uuid": "c2ea9f7e-decd-4934-83b0-2cafad216d0d", "value": "2db346799c65a4fc59e3063f0c749ac70e160ddcd4f719e897463d6de53621c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17dff2e-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630659841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659841, "uuid": "421a5d57-68f1-4c9a-8867-b914dea411a9", "comment": "Malware payload (AveMariaRAT)", "value": "e58b965b8341b661d4546ba242251b1e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659841, "uuid": "b7879fa4-81a6-452f-9d4f-68c4139a1a6a", "comment": "Malware payload (AveMariaRAT)", "value": "2e4256a1d7bc9f40528cded530aaf91410b3b55eff762908d7bd61cb5962e51e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659841, "uuid": "611bfe5c-ed9a-47c9-8214-b0f93ba67cd3", "comment": "Malware payload (AveMariaRAT)", "value": "7995af24dbfd531034378f08bdb9c58032baed8e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659841, "uuid": "c5ea24e7-395b-4aeb-a83e-e867ce0bfee2", "comment": "Malware payload (AveMariaRAT)", "value": "f1cda2e87cfc95b3629c88bba41059a10b92cfdf885a43fe9194775423adf5f1a41b516e485783374cbadd69fbaaca44", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659841, "uuid": "1b89a557-6765-45bb-bf8b-adea8912abc6", "value": "T1C315466A26B99116F16FC3B58BD34613F0138F5E3D105B10E6C27F157A3297AA0B32AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659841, "uuid": "dfb6d767-f132-4aa1-abfe-f687a05b6d2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659841, "uuid": "663b15b7-33ba-41de-9988-d527f42137f3", "value": "12288:8nQOm0PM/RvYD2yVVkLjk9v+mFHuvqPc:a9bPovYD2/LEiqPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659841, "uuid": "d0375c9c-9418-4d04-bc3c-eaaeb1443d36", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659841, "uuid": "550a2d1d-3d18-4dfb-9c6a-df63401589ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659841, "uuid": "fac71901-a2d5-443a-950d-466237259cad", "value": "2e4256a1d7bc9f40528cded530aaf91410b3b55eff762908d7bd61cb5962e51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22970524-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630673265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673265, "uuid": "0928a15d-2d5d-4bc5-be3a-0c3d2cde6275", "comment": "Malware payload (RemcosRAT)", "value": "cc6ca7aa77b2ceda2ca930993fd4357e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673265, "uuid": "4cea043b-7ea2-4360-aa04-54bdf063977a", "comment": "Malware payload (RemcosRAT)", "value": "2eb44403d1de2a792569f63907f746809e3d4e35fccf689c2e637f77df79254c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673265, "uuid": "6a95f739-4e81-48a6-85b5-0e661c1663a7", "comment": "Malware payload (RemcosRAT)", "value": "79648f3c579be053a030ccdb791122f95497cf09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673265, "uuid": "1b01e29c-838d-49e1-ac92-ca8229bc0eb7", "comment": "Malware payload (RemcosRAT)", "value": "7408b05eef63fd8ae6b3b358b5528ab85bdf2121eddca10fd29a23c04404b3e025f931475c6628ff0759dd2f4c78b4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673265, "uuid": "e5bbfab3-45d1-4073-82c9-a1942b1a63b5", "value": "T18F24E526F7C1F42EE082447DB919EFA550643A3069A8C453F7C1AF1B38715EADA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673265, "uuid": "e3fbf6d4-e4d5-4514-8372-8f554268ce40", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673265, "uuid": "2690d1ba-c6c4-4d46-9281-f945fd84e6ac", "value": "6144:7QEfD/i1lkemVTtuASZNaEz25TdgVhWCX:BmetufNsgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673265, "uuid": "ebc12b6a-85e6-4064-bf8e-f0a95f525007", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673265, "uuid": "b09d19af-9c3e-4f86-8735-ab90ac01390c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673265, "uuid": "9fc40d88-53be-480c-9f02-4a88017f91ac", "value": "cc6ca7aa77b2ceda2ca930993fd4357e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa26a8de-0cb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630673062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673062, "uuid": "7d6a38c2-c80f-4559-9410-296a87b63341", "comment": "Malware payload (AgentTesla)", "value": "d2b93ce83bb0827428fc319219a2b783", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673062, "uuid": "dd2419ff-8095-4405-b4b2-4274e737992f", "comment": "Malware payload (AgentTesla)", "value": "2eb6441b3eb1304c9433e0cf36259e5fa6a75ea645534a7f2873c7ab67e37d61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673062, "uuid": "dab2a7ad-2e7d-4400-8c95-d373a4157efa", "comment": "Malware payload (AgentTesla)", "value": "be44fdc720c230406c7f3b6644be7d447bb3e3c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673062, "uuid": "37efbc6c-fa71-4407-81a1-c1f3301e1477", "comment": "Malware payload (AgentTesla)", "value": "682136498fbf81d69ff7d6c8949ee83039e3991c3586c5835ae1f489f40c5596b6b6a32ca8458edc9eba2df1ade4471b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673062, "uuid": "0786d722-3fd4-4874-93f7-2234e380a12f", "value": "T17B7412123A81C7A3F4AB86BB592101220C1CEE47BB53631946147058D9F6B47FE9FFAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673062, "uuid": "0881d6e5-9051-4756-8856-e47f8c86320e", "value": "6144:TI1afXX7WSCrW08Ay/h+JiWvvFrr5pnkZZiSHhlBaEAxpiqaKxGAL9k75Grh206S:TTWSCrW0gCiWvvjpnkZZTv5AxlNLO7I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673062, "uuid": "f90b2c9d-4704-4512-aeb6-7cdf29836475", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673062, "uuid": "3af4a45b-d523-45e8-b62a-a294696f1530", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673062, "uuid": "f4e9781e-cf4f-4dd8-b6b5-d8cbc4cdecf3", "value": "Order-2021-PO # 0834.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2bd6c1-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630650329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650329, "uuid": "40a4ecce-a1dc-4d97-91d5-b3f41059b42a", "comment": "Malware payload", "value": "e4f025032565c72b09cff645406225f9", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650329, "uuid": "a5f742d7-d20e-41b5-a2c8-d78c070d1de4", "comment": "Malware payload", "value": "2ed4a1645f87d4d68f68eeadc6920130064fc2945512041a0d4b136f92034740", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650329, "uuid": "6de83591-d9e8-4849-b3c1-35108209f3a7", "comment": "Malware payload", "value": "c9a4b53a169059584ab9bc97bce258d06b9f130d", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650329, "uuid": "568f09a1-d31e-44f8-ad40-33a6fecc4dc8", "comment": "Malware payload", "value": "deffe0707d868a8e2fabfe2851f60e3d09cfed9dece9398a2b3bcd2de314891a166cfc09bc8125ba7d95367303dc8f1c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650329, "uuid": "e1a9f2ca-cd03-4c5c-b18a-05644aba8b4b", "value": "T16B0412A7819AEB15F3430D7890E8AC36AAC950A5F239C3C9CF9408E1E55FB523D6770D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650329, "uuid": "51bc5914-ea9a-49ed-ad8a-cd3af1d80ed7", "value": "3072:mB0pAd24imrzVPzxzxtH7j1UhHaSTWUjH56aHCfful0k1D4Hwbk7sIAzDZijk2yU:mMAd28lFzxR7jChHndCnvwbBI2DZOkVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650329, "uuid": "68c28a82-467f-45a1-8867-3be2dcb10a13", "value": 174906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650329, "uuid": "33e8bd77-bffc-40a0-a3ff-870814a742f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650329, "uuid": "0f039ff9-2f30-4ca3-9f0d-f542d04e4a95", "value": "Factura vencida.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdabb4f-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BillGates)", "timestamp": 1630684152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684152, "uuid": "4214ec26-36db-4139-a679-a440332debd7", "comment": "Malware payload (BillGates)", "value": "52ee1db0410a334aaacb401316f45046", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684152, "uuid": "f4e54060-adf3-490b-9406-566789e8769e", "comment": "Malware payload (BillGates)", "value": "2f4163b6a30d738f619513cdcc8ee40056eeef9244455225d629a0fc2c58638a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684152, "uuid": "11d8882f-21a6-4fd4-b92c-7622a44a75c4", "comment": "Malware payload (BillGates)", "value": "132de5ace5e4be71d66fcbb8ee60153e919679e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684152, "uuid": "cd760729-e595-4fef-bf43-2299f5e7241b", "comment": "Malware payload (BillGates)", "value": "d16a103fda37c72aa53a5a41fffe09de927617447b872b00d1b912c3826ac5310fd3b43963d7211581c7f73e56404ba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684152, "uuid": "9b0d7947-8d1a-4108-a881-87f936f72e56", "value": "T1CA456B12FBD0CCB1D84616B5100FDA35D5229677A01BCA4FEB5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684152, "uuid": "017297bb-1a39-4927-8610-fb4298379bd8", "value": "24576:e845rGHu6gVJKG75oFpA0VWIX4e2y1q2rJp0:745vRVJKGtSA0VWIodu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684152, "uuid": "7f0574fb-7825-4ff5-963e-59ee0638ebff", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684152, "uuid": "08a09049-bc1b-4397-bf19-c8d4f7375575", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684152, "uuid": "8318856e-ea0e-41d5-b1db-86f702652d2b", "value": "52ee1db0410a334aaacb401316f45046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da7168f-0c8f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630657016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657016, "uuid": "f816475b-a697-466d-82fa-909f1ed69e86", "comment": "Malware payload (DiamondFox)", "value": "f50136c9ca26451e33d5b1d09890dad5", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657016, "uuid": "f61cd3b3-0cd5-4fe8-856e-36c90a99ad0b", "comment": "Malware payload (DiamondFox)", "value": "2ff77816fa6b9e2fdbc630e06a003b09228f39887f8dfea7f8020d9346bd2324", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657016, "uuid": "58e12feb-cf79-48da-ac53-47101607ce9a", "comment": "Malware payload (DiamondFox)", "value": "1827fabd646f12bef405fef65f5078c4c8809f68", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657016, "uuid": "e4355fd7-c7e8-4d72-afd5-1b1b4c1e1781", "comment": "Malware payload (DiamondFox)", "value": "c7aa5d9a71649969c75869e186ee8458da8f39f1561b2d470e9e12ac5316406c461775195f4110aa961a6e4c9720b5dc", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657016, "uuid": "32e52327-a0c0-4e16-a8e8-08e613bed00e", "value": "T10AD47D15B344769ACC7215308951D0E5152BBE39662197B3B7E47F3EEE3E4C38A30AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657016, "uuid": "07b0cf1b-e4ee-4061-8bb1-1915b11270bc", "value": "1b90ad0d3d7218730afbb0fdc6bdf7ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657016, "uuid": "24d41762-dd0c-4154-bc91-577cceb76972", "value": "12288:45FsvCOXAATyffl8gBuDPj6dKw6VafLxVFFDTSVvkVixVVtY7+MSC1ml3dojnGRq:4bs6OwCifdKw6VafLxVFFDTSVvkVixV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630657016, "uuid": "a2350412-065c-4b33-95a0-d426e7eb8e19", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630657016, "uuid": "e8eee68c-c4fe-4660-89c8-c6557e06ac07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657016, "uuid": "25fcdf70-3c2d-41c8-8dca-e6267788108e", "value": "F50136C9CA26451E33D5B1D09890DAD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e80aa5-0cbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630675881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675881, "uuid": "20287819-915d-4fc4-b3b9-fd9de4ce2f1b", "comment": "Malware payload", "value": "d64c988b34093fe0b709405642b1da42", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675881, "uuid": "89deddca-1dc7-4bc3-aa76-ad248f7b076e", "comment": "Malware payload", "value": "303168849ee5ea08f110d50af7556d2d4f4eeca9542580579a3b0856ff53535d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675881, "uuid": "acc6e33e-c9e5-4cdb-81f6-ad3462ec968f", "comment": "Malware payload", "value": "cd4a6d40b6bc7ebae8243df8422fafffa82a1369", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675881, "uuid": "b5df138c-3a90-4b84-874e-baaecc01661a", "comment": "Malware payload", "value": "ec800b93103e0c9bf0448cdef6c9410881e8027eb136ed4c2ad6f3c8a0c240f43df27f4f8284d5f609f5d23bc322af3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675881, "uuid": "970253dc-d516-4e26-ba11-0e2e88f58584", "value": "T14AD023E564071505272CE3469782FE5D9941451CD045D930F0A043CD26CD305C4F19CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675881, "uuid": "8a67d0d2-be9a-4c77-892c-24710d82ab8f", "value": "6:4Q0kJQQ8a0NNEXW0Yfcvj3VTfCQ9MfGLwNAeo7acuj:4Q0AQQYf2j3VTr9ezqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630675881, "uuid": "a9562c56-06d0-4005-a2d1-81ae984d2f90", "value": 214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630675881, "uuid": "3ede4c37-72c7-4d95-abff-d3619d74ab98", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675881, "uuid": "de4ab81b-cc76-430c-b889-44ff8f3f1e3e", "value": "Blocked_mtcn_pdf.mht", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e2b03f-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SakulaRAT)", "timestamp": 1630660285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660285, "uuid": "61eb434b-5510-4f91-830b-850bd2506ab8", "comment": "Malware payload (SakulaRAT)", "value": "186bf9e2a330ac118f84a51ab0952c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660285, "uuid": "0c4e76e9-df7a-46ba-b725-debbccce3880", "comment": "Malware payload (SakulaRAT)", "value": "30ced2a8276b3bc0e75491f928b766e7bbb065b7e2a6639d4098c99328b170a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660285, "uuid": "a9bfdcb2-0a86-49fc-8cb8-d1a220c251c7", "comment": "Malware payload (SakulaRAT)", "value": "9a0af61e8de6e94001c5958edf21b0a5e97b1ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660285, "uuid": "aeec4e09-ebb6-4d19-96c8-234872516609", "comment": "Malware payload (SakulaRAT)", "value": "25b73502fce316282590b38591c135ee19ddf503a775f061b4988efa2ab89a6051440a833f2fe7a027a28cbe4846c213", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660285, "uuid": "5b8a954d-4756-4b71-a94e-30c4838ba8f6", "value": "T1A7B439246ACEC4F2D347707268B2B3E125F2BC289E1AF51FA6887F3CD473D906559906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660285, "uuid": "d9c9745a-bac7-465a-aff5-2e7e8f466df8", "value": "4511896d043677e4ab4578dc5bcab5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660285, "uuid": "8a5391bd-69a6-4d5f-8fed-a4162c95cc60", "value": "12288:0RfQn+w8EYiBlMkn5f9J105ko8T6csVeR:g4+wlYBsb3zNsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660285, "uuid": "b3a58eaf-9174-431b-a350-d6604484bd0f", "value": 529746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660285, "uuid": "cd70e123-19f5-43d9-bb14-ca9ccddcd375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660285, "uuid": "90379013-7f19-40ba-9249-e2fb3020d79d", "value": "30ced2a8276b3bc0e75491f928b766e7bbb065b7e2a6639d4098c99328b170a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a83138-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630673583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673583, "uuid": "4bb31f81-5dca-4aa6-bce2-afd19e883ccc", "comment": "Malware payload (AgentTesla)", "value": "cf29ee70e9695b375369ad0917b5bbad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673583, "uuid": "14ac9126-4da4-4bc1-9ef7-f554107af671", "comment": "Malware payload (AgentTesla)", "value": "30fca372f5c3fc61ab7e9677f1c93cf518e488b91cf2572d88578093d32f4e17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673583, "uuid": "97cdd86c-ef8c-424f-b005-9a306b185a8d", "comment": "Malware payload (AgentTesla)", "value": "d00e2a3547accea3a60d12035f4cd77cc4f6016b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673583, "uuid": "6b81966e-496d-4ee9-beb2-e1cfcb03194b", "comment": "Malware payload (AgentTesla)", "value": "09b97d7b3f25f39f68c5d37ebf72f4b2b39eb35215bff3daa84ffc659e634bd31276a18be21face198d34bd8fcecf7d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673583, "uuid": "0d6c124a-5c14-4642-ae03-809cffb0738c", "value": "T14315E0147B90EA0EC17F4F7A48911810ABF8F656530BF7C77CC662ED19CB3A94A17226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673583, "uuid": "c09f3ce0-5502-48b1-9a2b-bf49f8b1ff71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673583, "uuid": "377f17e7-b402-4baf-b3e5-af64a4914d21", "value": "24576:MNxX1jVrWU7I+t0etn3YLZef2AzX8VEI1Xito8:aBS+Z+Ef3zsC0St7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673583, "uuid": "52025416-bf05-4e8c-96d5-8ba8db4af6f1", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673583, "uuid": "223e0630-edd2-4200-abd2-5a79717b4ec3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673583, "uuid": "048ab44c-452e-43ac-a5c4-5f55dc9fa9b0", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cf36bd-0c54-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630631818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631818, "uuid": "97178551-00d8-42a1-86ea-16fab4e2c86b", "comment": "Malware payload (Formbook)", "value": "a9b75fd18c81d49a39b6689377bf8db7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631818, "uuid": "706fa55b-f139-47d0-8c99-9f8b4e00c315", "comment": "Malware payload (Formbook)", "value": "31a34d40d07e19268aaf8abeeae2716655969ebe2aaabfdc1b122318507c2e4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631818, "uuid": "38ba6823-6e75-462e-b67f-6ec9922f35d5", "comment": "Malware payload (Formbook)", "value": "c5ed0e9d43e85ad1d9744cb85a6fd024c8ff0489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631818, "uuid": "229aa559-a4ea-4a18-b2b8-e38278344b8a", "comment": "Malware payload (Formbook)", "value": "a304c9e0c441bfc51e5e258bfbb4077bc16ead78763967930c379b0f524cf91e6f8e718911cbb80a49af160d5cbc746e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631818, "uuid": "bdf92e56-1ac5-4421-9c77-9a9bae0509bf", "value": "T19624F636B781F42EE482447DB919EFA55424393069A8C443F7C2AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631818, "uuid": "407cee3b-4729-4810-8805-cee0a36c16ac", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631818, "uuid": "41f7011b-ff05-4d41-baff-eab60dfc13a6", "value": "6144:7wEfD/i1lkemVTtOASZNaEz2tEWu3FilTX:hmetOfNlWzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630631818, "uuid": "628204a1-6557-47d0-98fb-9cabb4022fc9", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630631818, "uuid": "122598ac-2bfa-4e94-8bbb-4a54cbea4729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631818, "uuid": "7521a0d5-f3f9-4439-a2f3-d6f9281321f5", "value": "Unpaid Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d7ad6f-0c5a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630634540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634540, "uuid": "64d5dee6-43cb-4859-aed5-700cf6c62705", "comment": "Malware payload (RemcosRAT)", "value": "7c8efbe367f82fb25ec6c42479a64a25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634540, "uuid": "1f837df7-1f58-4bb5-bb24-c4831dbaa99e", "comment": "Malware payload (RemcosRAT)", "value": "31d59daddd21ce0c7d8af7d24a16d54e3c5bd4b3b3adbd772de05177b7812059", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634540, "uuid": "f71497fd-bd5c-4ce1-86b3-c9fd7ec20f73", "comment": "Malware payload (RemcosRAT)", "value": "5ce4b90447bc5d2b8d86ffa8dea21ea8e5858202", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634540, "uuid": "b974bd49-0013-43ac-8615-e73557811972", "comment": "Malware payload (RemcosRAT)", "value": "ac99925767b7c4801eb33bad332c3853ce701b2381e431712829f4875b9308b9a820f6de68fa74a96813ada78b852a66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634540, "uuid": "b94133be-eac2-468f-b0d5-4d99f50e5c55", "value": "T139F45BA5F7A08C3EF4710AFCD80E99C4A418FC693D29CCC636B56D8517B158CB43A5AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634540, "uuid": "72d77258-a5a4-460f-866f-59a10d1da80d", "value": "4469230dadf10434edb28a90c2a5b8fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634540, "uuid": "ed985052-3c9d-4e24-9018-85b4fd5cfffb", "value": "12288:wyL+XIUEkt8A+CSspygap6vXD85pzM4ecXgin8IXY:jS4Tkt7gsHamDqpzMlcQi8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630634540, "uuid": "4ee3b70c-4c2c-40a7-965b-33bc0feb1456", "value": 750080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630634540, "uuid": "83fde8d6-276c-42aa-bc95-f8005aaf3b45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634540, "uuid": "da7500f9-1e4f-4563-be07-8f11e92bf8f7", "value": "7c8efbe367f82fb25ec6c42479a64a25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1c2eb3-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630686493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686493, "uuid": "e85b30b3-c8da-4393-8bc6-9d669a48df0d", "comment": "Malware payload (CobaltStrike)", "value": "1409aa381ef05eb83dc0ac152c3f3f70", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686493, "uuid": "176e226f-4af5-4c96-8669-257a9a62908a", "comment": "Malware payload (CobaltStrike)", "value": "32d46b7131714c02c8668a1b821b4b12cd37f6597a56eb01430c22e315c34638", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686493, "uuid": "2a242e74-9e94-47c8-9400-e5b8cf2fe359", "comment": "Malware payload (CobaltStrike)", "value": "63d17c386979ca67668896d41cfdff08374eb74d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686493, "uuid": "4e0028d4-ab1a-4ac4-a3dc-fe9dacb1be37", "comment": "Malware payload (CobaltStrike)", "value": "03712b2c4b91f5b9714a03f1bf84efe6d71e906afeb954c5c4563ccb4a3fcb3747171b73831d35aed7f7c281fdb19980", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686493, "uuid": "147666d5-0cf0-41dd-85c6-f79b1a08eaf0", "value": "T18B24E035B886F9C0F8098AB55CDB58799EB3D51716E2298AB0EEBC6D1C465C3D0E0333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686493, "uuid": "90af6d94-1807-4c3b-8734-7b02380e86a7", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686493, "uuid": "889a0104-544b-42fc-b447-1aa66320bb16", "value": "3072:IlCCM6Oe0pqQlHWWfFZZvR34OIuYm4S4Q6NKDgKxOmy7EsGXL/UC6prBbOLko:IlCCM60qQFWiZZ3FsPIAQDS9Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686493, "uuid": "204eb38f-afa5-423a-bc7c-96d2aead2aab", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686493, "uuid": "fa57369e-d947-475d-980e-e6b4074be67a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686493, "uuid": "3d2b0aaa-cb2c-4d03-9967-53f8672bdd60", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb11f5a5-0c66-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630639617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639617, "uuid": "8ae654fe-a98a-4494-b890-06cffb3fc4a4", "comment": "Malware payload (SnakeKeylogger)", "value": "819ea2b0bb3c35295fda0c896a52f5f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639617, "uuid": "865bf08a-d7c7-4710-90b7-d78141980b30", "comment": "Malware payload (SnakeKeylogger)", "value": "333af0cc16651387457b2288b318bde05ddd2d872bd2f2c8e7494bfdf5fae26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639617, "uuid": "22c66134-7a5b-4ea1-bfdc-0e59054cfa82", "comment": "Malware payload (SnakeKeylogger)", "value": "3770ae955fa57a7b18ed1001ada3ee4a17eac6f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639617, "uuid": "66e910e5-5f0f-434c-bd72-e4a5c2ff51e2", "comment": "Malware payload (SnakeKeylogger)", "value": "b10ca6c081c4c07b02956ec82b562171a237e298b9cca909b1be63bc79d1b7843c1a459785e92c8f30b68dd8a15c7eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639617, "uuid": "88fb2827-2f66-4f18-9210-2d1e93a28dfc", "value": "T1C5C4D83E58FE23279176C7D5CBE58823F6C098AF3233A96467D747264306A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639617, "uuid": "1771f36e-cab3-4c6e-8719-249106ee0a25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639617, "uuid": "b343da61-cf95-4524-b747-9a4929df0467", "value": "6144:/FJLgGEFpTU7I3gjALpK1d3mIfrnu7TCZi1V1zNGdLc5NAD68/lUj:IDKuEru7TNVOdLcQ7/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639617, "uuid": "410f7819-6e4c-46e8-827e-8699c10862d4", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639617, "uuid": "87088cd8-758b-4e4a-9e34-7cd5c357d7fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639617, "uuid": "12cac3b1-67da-4351-bac5-b71e18eb07a3", "value": "Sales Quotation 309020032012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42ab4e3-0c53-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630631445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631445, "uuid": "606e07ad-f830-4bbb-afbc-da26b8f3ca04", "comment": "Malware payload (ArkeiStealer)", "value": "58ca56c9936d17e672582daefe10b423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631445, "uuid": "7dd55fa3-57ba-4abb-a66b-71a27ea3dcae", "comment": "Malware payload (ArkeiStealer)", "value": "341970fa08050ae3de11bf7d13c9f76f818298c1f8af73e285fc56a0bb12b77b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631445, "uuid": "a9b8126e-ab44-4a08-8656-ecff83eed76f", "comment": "Malware payload (ArkeiStealer)", "value": "6f2cd66bec3b6e41de34a33d42fdde22ef12ca78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631445, "uuid": "ea02d452-de08-4ffe-984e-160db5581907", "comment": "Malware payload (ArkeiStealer)", "value": "969b8daa415f787b4ad612be6179f3e6c8695212432ce612162308bd4ff8581bc4a7f47ac28c618a0a15cd24b390524e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631445, "uuid": "e54bcf37-9f30-4829-a1db-6e9dda8500a8", "value": "T1B214BE217690C433D6E2CD709965CEE5A63FFCB15864848776742F2B2E323C2A92235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631445, "uuid": "6cbe9c55-ee65-4586-b30f-3913ca164337", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631445, "uuid": "b7527417-1d45-456c-9b09-e5e44a1d53e8", "value": "3072:5jxcoLwFPfEk5J5PAIDRGzL5ZXtjSwrv9ENPG8kuKJIX:5jxLLwFDLSntVvMG8BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630631445, "uuid": "aa00927a-75f8-4b8d-b918-d09e31e9e022", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630631445, "uuid": "2b0fa208-0615-496d-a907-e7a99163469a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631445, "uuid": "f8140f0b-4ffe-4ed7-98da-3125fb4c9ce9", "value": "58ca56c9936d17e672582daefe10b423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d1e22c-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659880, "uuid": "e66b80ba-dda0-4cc8-b9ac-4b66ee203834", "comment": "Malware payload (Stop)", "value": "363a845dd25c24ae4c9a4b2a5b847933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659880, "uuid": "1232507a-3eae-4a5a-b9ce-e02694c4db97", "comment": "Malware payload (Stop)", "value": "341adff3ec7c3cf9ec58b939d8c1104d8e6d228653055d6656348d421852d368", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659880, "uuid": "f4223d4a-e646-4e71-a232-32d4308a96f8", "comment": "Malware payload (Stop)", "value": "b68bc13233d059efefc0241ad6e6144da73a73fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659880, "uuid": "bcebacba-1334-4f92-baa9-30ab225bd1ed", "comment": "Malware payload (Stop)", "value": "4b7e7b5901afc1eef5cfe20ac320c1a38fd516e5b80c48590cc2cb07b1933c09975996ec2eb23a9d28791b149c40c93b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659880, "uuid": "c23f036d-44de-4dc1-a202-0dafdc3a984d", "value": "T1E8050130A691C032E7B6B1F446B682BCB5287DF19B6450CF62C63AEF5A306E49D31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659880, "uuid": "94198d5d-9910-46b1-8770-46c193b82349", "value": "c228cb90f452afcd70a9949027727f58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659880, "uuid": "6a41b635-c00d-40b6-9408-89b742724c93", "value": "24576:F2qAcLP7vzLgeZDiiA4XFYpIgAVuWk6dY+LTr:qQvDZe1QKpIHkEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659880, "uuid": "6bda748e-74c3-4b79-bf96-12d60a04e619", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659880, "uuid": "d401a096-1f00-4d6e-8819-21c45a6d425b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659880, "uuid": "1a124d0a-22c8-43c8-859b-e32c29bbbebd", "value": "341adff3ec7c3cf9ec58b939d8c1104d8e6d228653055d6656348d421852d368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5287ed-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SakulaRAT)", "timestamp": 1630660369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660369, "uuid": "81b032b6-18b8-4c75-a10d-dec48158536a", "comment": "Malware payload (SakulaRAT)", "value": "e199dde65336bcea995980226e504e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660369, "uuid": "0424d1e2-04ef-42e7-9e1e-54ee3e518a12", "comment": "Malware payload (SakulaRAT)", "value": "34210eafb10d0d1d8fe62a2b1ef5568dc05f6dba4ae557ef3cfdd01e5eb8c6b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660369, "uuid": "bb0c1400-9d45-4165-af3f-1fa7c0d9d603", "comment": "Malware payload (SakulaRAT)", "value": "7c6a72ab9665abf2be27a020a9178fc633b70f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660369, "uuid": "fb3aa066-f3eb-4879-82bb-5c640d87d872", "comment": "Malware payload (SakulaRAT)", "value": "26df707e0a4452aad628f3b78d21d4ff511c0e7c83e49ecd624ba96fdeff451b666151b614f602fc7446751fb3f2e294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SakulaRAT", "colour": "#EADB5C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660369, "uuid": "827de872-6f9e-4f0e-8082-68405b1822ef", "value": "T159248C18B84DC071E84C0434681697B24AB77C3D1F2DCE2BAB44AF7D69373D4AA9A54F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660369, "uuid": "dc5e2654-93a3-4152-a15e-4cafafdcbbb7", "value": "4511896d043677e4ab4578dc5bcab5a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660369, "uuid": "88819f44-6c81-4c60-a6ca-4ed8cdf23185", "value": "3072:M29DkEGRQixVSjLwes5G30Bg7uZwOuz/xS3iGpZMhDEXzkOSUUKeF8aP:M29qRfVSndj30B3wBxE1+ijm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660369, "uuid": "6fff7c71-edb5-4034-bfba-cbd5bfa86fcf", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660369, "uuid": "26e8d2d4-535b-4381-a7ad-eae2a9ba6ca7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660369, "uuid": "8a03a4cf-43f6-4d73-ba40-ed7a10c9ca7c", "value": "34210eafb10d0d1d8fe62a2b1ef5568dc05f6dba4ae557ef3cfdd01e5eb8c6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29716e36-0c87-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1630653519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653519, "uuid": "fc0670e6-6ecc-41d4-8315-c3bdda01d122", "comment": "Malware payload (TrickBot)", "value": "f0b1d40c2f19222e6023cded6349f26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot142", "colour": "#7B7077", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653519, "uuid": "35a4aac0-2eb7-4da7-8d2e-4d8fb2d68a2f", "comment": "Malware payload (TrickBot)", "value": "342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot142", "colour": "#7B7077", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653519, "uuid": "9d252f71-51ec-4c8c-9f2c-16a7e04f990f", "comment": "Malware payload (TrickBot)", "value": "28520050ca43b81c6a7bf26cbe357219f026ee01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot142", "colour": "#7B7077", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653519, "uuid": "5ad8cf81-818f-4c56-acfd-02b4181a7db5", "comment": "Malware payload (TrickBot)", "value": "7ef164601c752fb7e33a48a204485a6c47f723ea5f0ca50f556747b9cc896ef14e1239f86b5efd775b4074ac99d4b388", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tot142", "colour": "#7B7077", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653519, "uuid": "6fad9a39-d9c3-4aef-aa76-95154e257319", "value": "T11394D03036E0C072D157247486F9C7B15A7EF8602B61A9CFBFD90A7A6F25AD1873530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653519, "uuid": "2b503d03-2d21-40e5-8cba-c412c4fa9335", "value": "f65017d8831ffbffdcc0a43ba69f6901", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653519, "uuid": "e4a36c77-be1c-4910-9f48-f9f0f7cf362d", "value": "12288:mkRf7Sd2ji/ZE0Ym16ejbeWzrTKjex+wb/m4R:TRfmG0YgKwrTKjext", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653519, "uuid": "3b32dc1a-60de-4ac3-bcec-44fe72de401a", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653519, "uuid": "8da38fa1-b776-401d-91f5-1a7471d27369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653519, "uuid": "e2a9cc0b-8e6a-4838-8146-b95b47f0d2dd", "value": "f0b1d40c2f19222e6023cded6349f26c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee96043-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630660373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660373, "uuid": "2ed28d70-b681-46df-b22b-3effbfe0b21c", "comment": "Malware payload (NanoCore)", "value": "7d7b6947ab2947cd9626f88dc2596402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660373, "uuid": "cd209b4f-f862-4302-b85c-ac9017eba626", "comment": "Malware payload (NanoCore)", "value": "34319d13f02fbb49f4c442196e7334c5cfffeea44777246fc75acbc373d84c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660373, "uuid": "8e3ce70b-9090-437c-a694-6b5145538a2c", "comment": "Malware payload (NanoCore)", "value": "cab8b90b97ee621d907155b8f0117ae6fe8aab18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660373, "uuid": "84e006d6-603f-4c3c-aa9e-1c7e2149ba85", "comment": "Malware payload (NanoCore)", "value": "fb2e591ea984056116cbca5bb04074fae0e409f6eec67b7098a61966b716125e9611ae774be1a368e2efcf90789b109d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660373, "uuid": "70ca331b-3f7f-4ff4-94e5-aac0813d69eb", "value": "T15914BF663BA98A2EE2DF86BD711205038779C2E399D3F3DE18D855B34B167E44A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660373, "uuid": "712f244b-ca4b-4807-a217-42adea11bf5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660373, "uuid": "af9a1ccd-c7cc-4700-a69e-b861cc19bb1b", "value": "3072:4zEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIw3csD6RA5E3bKKiCf3e0kYrOa:4LV6Bta6dtJmakIM5dcs8A5ELiUfoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660373, "uuid": "bfcc10ef-f69d-457e-a0e4-d3e18312bd17", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660373, "uuid": "3228cac5-7db9-4a03-941a-ebc96bd675e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660373, "uuid": "a084faf1-c7a2-4867-84a7-7b4d6bc953d3", "value": "34319d13f02fbb49f4c442196e7334c5cfffeea44777246fc75acbc373d84c2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d401b49-0cdb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630689657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689657, "uuid": "7ead877f-443d-4ff5-80c9-0a3cb3f4122c", "comment": "Malware payload", "value": "c4b159909c1d7f4e71394492daf2b28c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689657, "uuid": "82166e41-5307-448d-a434-4de6e2a573d6", "comment": "Malware payload", "value": "34902083a2be05a3e749cbea6fab3e8b174b89e2294a543a570c4b47695bef99", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689657, "uuid": "678b26c4-d326-4c4f-afe3-0385842fab73", "comment": "Malware payload", "value": "fb09d25db8bb574175e293f5d1b0c6e81c091465", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689657, "uuid": "6a9f8d03-4167-4cf3-8fed-a198ab3c6094", "comment": "Malware payload", "value": "d778441443011dfb594675761bb382615a3dcff5b0c2ecd5c97709606de5c32a9e83b782f39bf355254cdb349bb3db28", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689657, "uuid": "2176afa9-475a-4141-9d4e-6c283e1b26cd", "value": "T1D6063303B3830631F5154539E8ABC044BF2BBA7806E154B72DFDD64E2A79392CCF9966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689657, "uuid": "238db35c-ada9-4dd2-8d03-6576df77996a", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689657, "uuid": "f886a4bf-65ec-4ad3-864d-fb34e8d491ac", "value": "98304:cuiJO6ZK03RneDLOCLtHnFjAPogfQ8K5xE70IGpl:cPJRZB96TxHSfQ8K5OX6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630689657, "uuid": "c0436126-516f-46f4-bc80-5e69fb73af0e", "value": 3997809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630689657, "uuid": "cf608630-00ab-4830-8559-15cd91f66ecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689657, "uuid": "c0e7cf43-62fc-455f-9290-153501bbfb94", "value": "vimeworld_393043162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd8be15-0c76-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630646225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646225, "uuid": "981fb79a-4e7e-41ae-9a92-9532a008e256", "comment": "Malware payload (AgentTesla)", "value": "0dca8a85ac1755e9d905a554356bad73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646225, "uuid": "25065e99-c448-49ea-9122-7c0ab9e68b3e", "comment": "Malware payload (AgentTesla)", "value": "3686959402c512154fc465117581958b97fa7c74657eb9909f31a6befb878e95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646225, "uuid": "03216cd7-5543-4823-8224-8adc44335105", "comment": "Malware payload (AgentTesla)", "value": "4eee0ed657660920106a11d86c6bcc2d22886267", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646225, "uuid": "d3be8200-542f-401a-8be3-01b98b45b4f7", "comment": "Malware payload (AgentTesla)", "value": "62232508f9ca481ea8f59a183940fbb69d1169ad59a35858a6e87c3c4476a5f17b224d1d86c672d4bb246f5dd71781a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646225, "uuid": "cd4d518d-7e12-45f2-a78f-09dfcf15dd01", "value": "T17EE42D3E18FE23279176C7D5CBE58923F6C498AF3233A96567D747264306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646225, "uuid": "20415fc5-28e5-423b-ada4-b8771c7615c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646225, "uuid": "b22ccf8d-14b5-4528-a606-4ffd56fc1db2", "value": "6144:9jFJLgGKF4VkbexHNqh5+S0lCQtrkCVAoIvVc271dwMB0/KVByOfk6GX1:9NS9P+JAQ1kdo2z7/vBz86G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646225, "uuid": "243ff40f-a75d-4e68-a59e-7bef358b7b66", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646225, "uuid": "c94cd065-8207-4bd2-abec-7a596535865f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646225, "uuid": "acb054da-12ed-4d2a-a1e2-3f20e8140582", "value": "Halkbank_Ekstre_20210309_080203_744632.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e705fe59-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630660280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660280, "uuid": "5aaab25b-d49b-48b2-bd12-6e5ec1bdd7d8", "comment": "Malware payload (njrat)", "value": "ed626d27f0f2ebd254a3356a4ae35dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660280, "uuid": "7f6d5674-d17d-4a00-80da-c2a1bc033568", "comment": "Malware payload (njrat)", "value": "3828adb58a4b478ffa4fadbab6d2b56c4fc7e561c4e45b0129329595fb0ffbfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660280, "uuid": "445decb5-0866-4a8b-890e-7ec4384f5f1a", "comment": "Malware payload (njrat)", "value": "a23f51923766148e877fd460532256ec742401dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660280, "uuid": "128b5ece-d76d-49a3-a1a9-c75cdd002eba", "comment": "Malware payload (njrat)", "value": "280b13310746bb338b3fcdbb0aa93efbcf3b4e05fad76bdb372e93f7618115eeb541481001273ca1d050eeb4d6991130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660280, "uuid": "791bab2a-ef46-4b1b-958a-02b9e005034a", "value": "T100B42214D364816EC225D23C88C76B204549EF926588B74B4ECBBF537EB3B691FC8639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660280, "uuid": "0bba6434-ba09-4ef1-bbc8-10c9a4d96fcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660280, "uuid": "9509b804-12f6-4352-811d-a590d8623747", "value": "12288:txk8zmNxGo4IO4tAYKzIGFVl1KtQThIUuzKPCu:B60vjzlVl1fNIjcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660280, "uuid": "9baf80ec-5f43-45ee-8417-ec6ea636ae4f", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660280, "uuid": "a0452af9-61ca-4ee9-81aa-65a9cb540d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660280, "uuid": "91da7cbf-aec5-45a1-9aa7-73a72b834a65", "value": "3828adb58a4b478ffa4fadbab6d2b56c4fc7e561c4e45b0129329595fb0ffbfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fe59cf-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630654540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654540, "uuid": "defd6fe8-87f6-4e92-a4af-82f4b2d59b85", "comment": "Malware payload (Formbook)", "value": "3daaa20ac455b9586113cba234ae3153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654540, "uuid": "2e46c71e-97b3-4cb2-a40b-8b8b5d2d03ac", "comment": "Malware payload (Formbook)", "value": "3864b3a157ece572eabb6d56e50d577d0993fc7150bb5046e26e4fdc6bdf3c76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654540, "uuid": "1cbce3ed-6bf3-4128-9e68-d5d1152b10db", "comment": "Malware payload (Formbook)", "value": "d2972fb3c632473eb22f353755e0f31f999532b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654540, "uuid": "a4fcb3e1-4faf-45b0-8da8-7a1a6b7022d3", "comment": "Malware payload (Formbook)", "value": "eda8e8cd85da40c84dcd3b41c63a78c8137186d630320c5818815a99558543826955d13725cc30cf51770dbf9625637b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654540, "uuid": "7a05a293-7188-45b6-9bcd-1e6fe22f23c5", "value": "T113E42C3E58FE23279176C7D5CBE18923F6C498AF3233A96467D747264306A4635C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654540, "uuid": "21df7808-ec04-4340-a4a1-97486c9734bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654540, "uuid": "bdf6749e-c737-4423-b610-914ca0f4ca74", "value": "6144:HBYFJLgGVFjvC+w7Mp5zmeEyK1mlfu7oVMGMLQwNFRKs0ZnnsCJaIUSSLyFpVI:6vVBpnAIutGMnNFR90DaIkepI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654540, "uuid": "77507d30-c0a7-4e45-a132-892d63a64fc6", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654540, "uuid": "057c88e6-b022-43e6-8ede-3aa5e8574299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654540, "uuid": "16c15f0a-8243-477b-a309-2aa874a8043f", "value": "3daaa20ac455b9586113cba234ae3153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d72a24-0c83-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630651876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651876, "uuid": "d64e4a0d-eb7e-44d4-bb81-815ee215c8bc", "comment": "Malware payload (RaccoonStealer)", "value": "a9dedbf35d7bd0a057cba1e8eaecbbe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651876, "uuid": "3ef8d2a3-7192-4a4c-abb8-462ebe162ac5", "comment": "Malware payload (RaccoonStealer)", "value": "38a1d1189d24606ff02ab44bb3e960c11f0d3eee0784e00aeda1fb17fbb3338f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651876, "uuid": "d8f5c0fb-60b5-42c4-babf-95fb6b5e96e9", "comment": "Malware payload (RaccoonStealer)", "value": "1acbccf6f4b493c46d233c2f6f166ba963c793c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651876, "uuid": "4d33e70c-7192-40cb-8551-aa5261198db2", "comment": "Malware payload (RaccoonStealer)", "value": "716f136f92443241b7c5f171c929b18ed740408c9935e763cf1f92cfdf2e00e1c7e939adeb9456f3fceabfe90162e133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651876, "uuid": "22058e75-8dce-495d-b6d2-aa79ac422a51", "value": "T1F8A401A2BA80C033D4B6C9716A79CEA1153EBCA16920750779B13F1B1DB1781BE1736F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651876, "uuid": "b38298fd-5e55-4b27-8dae-3d1644565baa", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651876, "uuid": "4d15693a-9ad4-4e01-8085-b644f11594a0", "value": "12288:cVSQlkxpOJtFsTIcDJdfCkM8puaLoDqs7T:i9xF9cjhFFqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651876, "uuid": "8359d1ba-5d9c-4016-ab14-2430be5e9a9e", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651876, "uuid": "d3a6e704-de08-4fc1-9498-baacbfdbe824", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651876, "uuid": "2ccf1137-a195-4dff-a96c-c22253b97d63", "value": "38a1d1189d24606ff02ab44bb3e960c11f0d3eee0784e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7b0c74-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659970, "uuid": "8f871dee-eefe-41d3-98d6-af2abec87cb4", "comment": "Malware payload (Stop)", "value": "8995e4a9e58ccb8766838bae9943d0a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659970, "uuid": "7cf26190-5f17-4ea6-bbba-c0403dc4bc98", "comment": "Malware payload (Stop)", "value": "393c93549cadfdb9263350b0029184345927d0c67006ae9f258426ed5dc901c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659970, "uuid": "9dd0d1dd-7f2f-484c-a958-43db86a5927b", "comment": "Malware payload (Stop)", "value": "4db19a06d02b3152e70cbfd643200b774d1df625", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659970, "uuid": "d8a06f98-b964-4891-ad8b-a0d906ee04e0", "comment": "Malware payload (Stop)", "value": "b0a248a56ed48826814d83471ec257177fcd62b2b7825e7c1073b76cfb454c611b9fd774fc79d0981ddf8bed43e8662f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659970, "uuid": "4cbd0fcd-3626-4b9c-b315-fecfecaa91b0", "value": "T1E2F40220B6A0D035F1B722F849BAD3AC793D7EB0576450CBA2D51BEA5634AE4ED30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659970, "uuid": "c3a9e2ce-6f5e-4e6b-8990-7af64120ccdd", "value": "e1eb14d2b9b63299ef24644e625b9baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659970, "uuid": "7c82299c-ab8f-4f50-ae7f-5fe36263ea4d", "value": "12288:QZ7AQ2r6JCCLy3Yg86o/Y4bGt9CN1kLRdbH590WnGaEzH3yijEVITiZLjCJGbU1D:+V21ogEdbPNSLLzG7Xy3tZPCJGQ1nD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659970, "uuid": "24cb6a58-df6e-4ac9-b767-82c411cfb657", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659970, "uuid": "ab8ec96a-53b3-4e41-a2a8-ccb84fade071", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659970, "uuid": "ba0537a2-f91c-43e5-88c1-abeed17f5b00", "value": "393c93549cadfdb9263350b0029184345927d0c67006ae9f258426ed5dc901c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6a0ef8-0c8d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630656074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656074, "uuid": "cd563b83-05e6-4ac3-8827-977d343c080b", "comment": "Malware payload (Loki)", "value": "513f040bb406148b34c9fff34f0bb54c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656074, "uuid": "22a6378c-381e-4671-85fa-a2f79df13b8d", "comment": "Malware payload (Loki)", "value": "3a27b565034a5fadc76d214a3ae967342a572badd6c499434870d3aba8541244", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656074, "uuid": "32874fb0-000e-4320-87b5-cafa4c69128a", "comment": "Malware payload (Loki)", "value": "09c3c0b96771933c7a509fac60242b99fd659c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656074, "uuid": "0539e556-d8f2-4393-9cb3-8c634925fa1e", "comment": "Malware payload (Loki)", "value": "59ffca24b739ec4e89ad2153e332d7e8ebf49884d43382c9bfc56d67f9a8ed3f31c825487436ce8a9f659db16918a56d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656074, "uuid": "7f8b9340-e368-49b3-a24c-d08f9be59e2c", "value": "T1D1A46C9D766076DFC85BC876CEA82C64EA60787B570FD203A05312ADAD0D99BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656074, "uuid": "9bc5b19c-0314-4104-b85b-133a5044f9f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656074, "uuid": "8d02635b-78aa-43d8-bd70-b2fdb6813646", "value": "12288:PT0t/GLTXz8wFCMlGN9Z9lx1YTysWvnzarv/u3w21chLrFs:70tmztr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630656074, "uuid": "eed05ba1-d81c-478f-a310-b821e3730ddb", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630656074, "uuid": "b58b250c-225e-4a13-aa7b-7258186c7bb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656074, "uuid": "dfd01edf-a61e-4684-a371-bad2a62b4745", "value": "???(??) ???? ??????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfbbd12-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630659916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659916, "uuid": "d4db5761-c627-41aa-b45a-143428bf54a8", "comment": "Malware payload (ArkeiStealer)", "value": "00326b533abf1a5ad4fa70b4962ab98f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659916, "uuid": "f9af18aa-704c-499e-a877-7725d4472263", "comment": "Malware payload (ArkeiStealer)", "value": "3a3c73c139d12addf585756334a51fb8ca6381a27531c67ba306923a08fbb05e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659916, "uuid": "900407d8-8a01-4166-9e2a-56d9a002c67e", "comment": "Malware payload (ArkeiStealer)", "value": "ee14ff58decbdd7d9d9908a93de009556dd0840a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659916, "uuid": "987a12d0-7840-4f59-b492-67b36dd98b08", "comment": "Malware payload (ArkeiStealer)", "value": "4da3d2727453e9f88ecbbdd348a1de3951ef26a07554ddd3e8e6c515ad7557ecad073f29bd727d659460c438fde5b2f6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659916, "uuid": "9da1a629-9794-4182-a00f-39dc754ab4a6", "value": "T18405F1207681C075E0A713F558A592A8AB2CBDB05B2451EF62DA37FE37386D4DC3137A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659916, "uuid": "9405486e-37c1-44b9-b3be-2d7387090ebc", "value": "62fa754aafe9b531ba4be35dd30caae7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659916, "uuid": "6bfada87-804f-429a-bb48-f667209c60a1", "value": "12288:ub4sQdFbb3z0hBMwN+zfMboyHaMDHS9lPTnsLUvlmG6Ua4NabG0+Y7G3esu0cH6G:u4sQ7Mkt4aiyvPTnnvlQ4NGGes8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659916, "uuid": "05a3d313-6c65-436d-a76f-c69db8839fa9", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659916, "uuid": "e92e396c-e8bb-462f-95c7-5dcb2d5d9f29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659916, "uuid": "fc25dfd1-a724-4f39-ba45-44f998c87264", "value": "3a3c73c139d12addf585756334a51fb8ca6381a27531c67ba306923a08fbb05e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b93060-0cbc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630676360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676360, "uuid": "dc41b4ac-823c-4c8e-bb45-a589c4524af8", "comment": "Malware payload (RemcosRAT)", "value": "4630921fcfec88f083ca7676cb29f1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676360, "uuid": "816e99f9-82da-4100-9418-037d71cda68c", "comment": "Malware payload (RemcosRAT)", "value": "3a99da1ba4f3bf68c67531a317a272017881d45d406012c14dd3cb8f456f85fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676360, "uuid": "d219fc75-6074-4042-a215-aca22fc42e96", "comment": "Malware payload (RemcosRAT)", "value": "db342b47bdcc9267338c21acb1cc54d27514d6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676360, "uuid": "98c1c529-919a-4fca-af82-b6026983673c", "comment": "Malware payload (RemcosRAT)", "value": "d1d0597835a5c6cd4c637d844509729fa7cc10bda68bcd8e78a51d2db465e1b17f47e866fceeb037d8ca70fec9b41a39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676360, "uuid": "3a00935a-9d6d-4e66-8e90-a963d11d30e5", "value": "T1EB24F636B781F42EE082447DB619EFA55464393029A8C453F7C2AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676360, "uuid": "9286811e-afe6-4caf-beb0-4982186d1367", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676360, "uuid": "8fa4dae8-3256-4d2d-87be-387bee5c3e2e", "value": "6144:0QEfD/i1lkemVTtuASZNaEz25TdgVhWCX:ametufNsgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630676360, "uuid": "b4f869f2-7d1a-4c0d-872a-2bb5aff76114", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630676360, "uuid": "8d01b8be-9b2f-42d7-9150-186b4e2083e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676360, "uuid": "38de2eaa-6fb2-4e2b-89fa-d0ec289dde53", "value": "Nieuwe Orde - p31010_20200401_14_31,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371a4e1c-0c7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630648818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648818, "uuid": "a5606fb5-cc3a-4541-9336-2109730c2b85", "comment": "Malware payload (Gafgyt)", "value": "b44ac6a54ffbc22ef12a433e327036e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648818, "uuid": "f3d43607-a530-4920-8e51-b9aa94462447", "comment": "Malware payload (Gafgyt)", "value": "3ac4963149f9db1291dbf854c92b8d46a5a2ee594e835f0cec4c519576fca4bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648818, "uuid": "20b7e677-3f9f-4b1a-bfe6-d981f64d7eb5", "comment": "Malware payload (Gafgyt)", "value": "ef324e2e8edb05accf43bd592d230ecf42e83100", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648818, "uuid": "03af9945-dd99-4a1f-beea-2e4caf64b583", "comment": "Malware payload (Gafgyt)", "value": "4139631d21efd20928f41f582c68a8e5bee4e4b61030ab5d43d908c6fe1404dcd44c23d56324f7d959fc65287650be0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648818, "uuid": "e2d96453-c561-44be-ad96-c5f6ca60f723", "value": "T1B1835B3289142F78E5101A7161F6CD3D47137EC047630D76E18E82285AA7EEEF226FE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648818, "uuid": "fc57034b-c120-4ca3-91ba-fb60f9700c28", "value": "1536:sgfKrW70i2weNN1obEoT34KYr1JWQIXC86tyS8STD:dKrBi2nS/YCQIXL5STD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630648818, "uuid": "996470b8-05f9-41f1-b638-048fee1a0184", "value": 81240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630648818, "uuid": "8115589b-cf5d-4e50-9edb-082b5af83986", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648818, "uuid": "9e530ecc-63b1-4388-8ec9-381a99295be3", "value": "b44ac6a54ffbc22ef12a433e327036e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1d6cab-0cc6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630680718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680718, "uuid": "5fbe365b-309f-49a4-b8a8-85f5d10733e4", "comment": "Malware payload (Formbook)", "value": "ab579c1ab355c2cfb7aa881cb4eb7918", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680718, "uuid": "33fee256-0bd9-4cb6-9fce-23b3c0f2a8c6", "comment": "Malware payload (Formbook)", "value": "3bb6399946b8104ce3eaaa2b0b0e781a966d364cda07ca91239d8104b0038b59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680718, "uuid": "fa6cba1e-6740-4fcd-ab6b-67de938bbd23", "comment": "Malware payload (Formbook)", "value": "e2033c10e674687910553764b596486d65a5061a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680718, "uuid": "c99f42f6-8873-417e-9cf5-0ec3aee018ad", "comment": "Malware payload (Formbook)", "value": "bda2e4312bfecf965c29242a3b37850e3f73be8a4a51fa18ba671b361b69458fd24b4effbc48652c4ad35edf7bc56f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680718, "uuid": "e88083f4-6afd-46d8-a076-f3226ab67296", "value": "T11E24D426BFC1F42DE4D24479BE08EFB5442439B029A8C457B7C1AF1B38615E6DA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680718, "uuid": "1ac27ba2-9b91-4649-b3dc-e6fc4b0f31ce", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680718, "uuid": "160bdc85-6784-48f0-abeb-fb2a65ce8b01", "value": "6144:FQEfD/i1lkemVTtuASZNaEz2pjoLlhGiH:7metufNhLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630680718, "uuid": "4c7b545c-fcd9-449e-b8e3-f8f42c8ad1dd", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630680718, "uuid": "9f3bc45f-852c-4773-9cbe-8099a2512986", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680718, "uuid": "b258b981-0793-469f-8dd9-b49b17503c77", "value": "Evuapotex doo Ponuda n\u00ba 140689 - balkanski Aur\u00e9lio dos list77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773b8301-0c82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1630651502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651502, "uuid": "bf9968e3-3233-4386-b129-333708e1b84d", "comment": "Malware payload (OskiStealer)", "value": "e309fc8f99a6906a80e85a7b9bd02296", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651502, "uuid": "04fce011-506c-4f6f-a862-343a098e6354", "comment": "Malware payload (OskiStealer)", "value": "3d23bb0fbd0b70409765da5888f3e37b4ace5cd9171265acf7a793d428107abe", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651502, "uuid": "480f3bc9-df17-403c-9cc2-63dd9ab436d6", "comment": "Malware payload (OskiStealer)", "value": "acc21cdbe0c7b4db72f788858663b33b2c7d03b3", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651502, "uuid": "481dfce6-47d2-4914-872c-bd5272355bf8", "comment": "Malware payload (OskiStealer)", "value": "5c7a4b0e2c5abc06634211db400bf1e5fbdf5c27d022d9db1b59748e26503aee2ec0ddc4cd30d05435ff4d79a9da4f15", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651502, "uuid": "2fcab7a8-c692-4a25-947b-434b9bea9676", "value": "T1E0527E29E363645DC237943EC64854F4FE0F206A7B05B5897500BEAF15022A7A3DF6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651502, "uuid": "935f0d75-7804-4203-9c01-fd648732ba9b", "value": "192:cE6CVJCGI9mHO5gEtBfNtXuQfaFUlbVvevUqzLDgXkIbtQIKJ2f8++4R9ahX:MCIAVKfX+QUUlM9z/gXNbtdKO8OGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651502, "uuid": "0704e70f-70b4-48d3-8121-192abfe26141", "value": 13253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651502, "uuid": "771f6fd6-d92c-4c14-9442-f5c979afe27f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651502, "uuid": "63842aea-11f5-4c29-834b-a5d1c3a585e1", "value": "invo1ce_attached.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fdb3d7-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Warezov)", "timestamp": 1630674888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674888, "uuid": "b919ef53-0cd8-4f15-8271-5fe8defc4716", "comment": "Malware payload (Warezov)", "value": "4a229a5cd6e95726bd7d73d2ee12961e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674888, "uuid": "fe45ae3f-dd33-4dec-8146-ec6b84d8fdf3", "comment": "Malware payload (Warezov)", "value": "3d82b1c2f563a0614b3329f0527820ebab445c124725df547a5d95444c1ecc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674888, "uuid": "47c3d5f7-4185-4a32-8320-c4b918b76a4e", "comment": "Malware payload (Warezov)", "value": "282039edaa2d2594ed79f6238a26d50f068c0f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674888, "uuid": "bb98fb2a-0c02-44c6-a378-1859a127b64f", "comment": "Malware payload (Warezov)", "value": "b27231c9c78e65d4726fa8648882fe950b0a09e6f1743b0e05fe319e24181bdc6a2637ac05bbfbed3b3ffaca2a81875d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warezov", "colour": "#24E475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674888, "uuid": "6469b607-6492-4b66-810c-6244cb08856d", "value": "T162D48D51F28DC1B1E44A1CB8B4AC936662B27D28177CABF3E760BF18A5732D07C35916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674888, "uuid": "408cd90a-e5bb-4632-9bfa-02b5b6d4144b", "value": "547cd05356c429dc57b17bf0fd6daf12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674888, "uuid": "3d0caaf1-7ad6-43a2-ad9e-caf287c9e7fd", "value": "3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoA:JjqVG/pJZzfwsGX+LOODl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674888, "uuid": "0f3451d2-306a-4f7b-adab-032cbe5ec275", "value": 642035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674888, "uuid": "c63aec9d-c761-483c-9bf7-c329556ae9c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674888, "uuid": "8c4e0993-d509-4677-8f58-e5e08d8b5f2c", "value": "test.msg.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b215438-0cf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630699854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699854, "uuid": "7d4c29a8-82bf-4796-8a58-1527599df0db", "comment": "Malware payload", "value": "da1bc28dd6597f51762f0674fda742bb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699854, "uuid": "06741837-7982-40c9-ab9b-03380730fc37", "comment": "Malware payload", "value": "3e31754b07d5475d5e6ad777b328516e740fef64e5de45554f6c6d614c1bb08a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699854, "uuid": "640773d5-e6d3-4d83-8111-acf34f84683a", "comment": "Malware payload", "value": "300d38427ea3cd630223608b1fd82b5bf7839e50", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699854, "uuid": "066b4648-e7ff-405e-adcc-329c045c79d4", "comment": "Malware payload", "value": "97b71ac7926cafb164307c8695586632dd52a0faebf8b9a6e34152a2f83c20fd367367bba454ce77a25d91a8e199e184", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699854, "uuid": "3d4d6470-92f9-4017-acca-0993662cd766", "value": "T138D53383FB9EC0CAD5C7DB740E16D2432A3A06D74381E99B7618970909E3DC87757BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699854, "uuid": "dc2a3d5f-ec18-4fea-bead-aa7c8a3d6901", "value": "49152:4bshArYH2sbR9Vu3x6HzTL2xHW6jzkzJbpeyNsbGYCocMjRGrlaMNe5b:4bserpqNHHL2xuzXey2bLc06lVe5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630699854, "uuid": "308253eb-3bdc-48b3-aa6c-7a34fd570fc2", "value": 2936680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630699854, "uuid": "24b0faa4-2bf4-423a-8d6f-7d055fdfc788", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699854, "uuid": "3811bc51-42c5-4197-bdb4-44938d74e703", "value": "Chrome391583.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a157e7e6-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630654579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654579, "uuid": "60aa558a-cf72-4f33-acee-a137e9583ccf", "comment": "Malware payload (ArkeiStealer)", "value": "31583a68c6122fc2caf37675c016a166", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654579, "uuid": "5abfc7c2-9816-4048-b60c-c3b0e16a6efb", "comment": "Malware payload (ArkeiStealer)", "value": "3e46c3912ced6d4821bb215ad4feb1711e3f0becaae258899ce77037c648048a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654579, "uuid": "815b0c0a-1796-4b4d-8583-26ac2e5a0c1e", "comment": "Malware payload (ArkeiStealer)", "value": "027d084a191db8612b1833267f09bb26f99e2b86", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654579, "uuid": "f1923799-1a6b-4f5f-953b-25f5c625dc84", "comment": "Malware payload (ArkeiStealer)", "value": "b1a7d1fdfaa76e75cea8b78762c0fc0c430149342641f71f4b956668ba87f1068197d25cbd35ae59643aa74eb90c5b4e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654579, "uuid": "36d6891f-5e0f-4f17-b243-6fe554c86b03", "value": "T19824AD317690C433C5A6C67849258FE5163EBC6658648347BB743F2F3E71392AA1236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654579, "uuid": "7dfd8a31-1c0e-4cb0-b84a-16595c8650ba", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654579, "uuid": "6fe72921-35af-4d72-b4f5-0e00558a2a4b", "value": "3072:fexdpLh1x8FfpLaEeKirqj5pscRdpmm80qGgb9ENPGdwDYTuKJIX:2x/Lh1uD2KMQscRdpmrdMGd7TuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654579, "uuid": "67279e80-a537-415a-a26c-ec79733a0ad8", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654579, "uuid": "8d09dbee-5eea-46c3-92c1-72eef11ec6ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654579, "uuid": "7bb7ad02-c6c4-4243-825d-bac7e6fa2647", "value": "31583a68c6122fc2caf37675c016a166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc545a8-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655404, "uuid": "a2484850-ded7-4edd-97a8-007b8ff696d9", "comment": "Malware payload (Mirai)", "value": "8e14324d610521b79bd34260e79a19f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655404, "uuid": "84eb99be-4dd1-4767-973b-6ec6135a2859", "comment": "Malware payload (Mirai)", "value": "3e4d145c5b9d41a580554038a9e7aaa53b564ea0d3c0abab169a07a2d1ce0fcc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655404, "uuid": "d087531d-633f-4e66-a9f2-e5ab54d2dc17", "comment": "Malware payload (Mirai)", "value": "8fcf6bf13ccb254e1add080bb2846a17c8e32d5a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655404, "uuid": "7db178a3-3fb8-4799-b6a5-c827ec444399", "comment": "Malware payload (Mirai)", "value": "0bcd74b7206ce4bb879cf50dd8d2ae0ece93bc726634e418aadc57231dc84e982f1fe6dd66040fae67648f97554026f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655404, "uuid": "4e4ffa26-8c46-4fe9-a9e6-4e4e67103b6f", "value": "T1FE7312F04312BEBB09601D72E43F0450FF2555FCA83B152D59A89DE97CE14A27C9AA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655404, "uuid": "6cdf3f30-ae70-4c7d-a35e-9d4c0c9a0374", "value": "1536:T/D2LRoeywTl9KTlNKY+ow9Rej+rzkDnapt7QLYTjxExDj:uLueywTl9Ilc7oyDrzkDnutQL4Oxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655404, "uuid": "19d36341-be6b-42e2-aaf6-61764f89bbb3", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655404, "uuid": "7929c144-e9b2-42f3-9dd9-7752910f0fd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655404, "uuid": "209394c3-e7cd-44be-a696-7ac6298699c2", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b26adb1e-0cbd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630676942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676942, "uuid": "862ca245-6725-43e8-8236-7cad0117048c", "comment": "Malware payload (Formbook)", "value": "e2f66f96c382e2ec40fb905d8774c992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676942, "uuid": "11a80f31-8576-465d-aa01-ecba4b2463b4", "comment": "Malware payload (Formbook)", "value": "3e7a9887bef003a95c48653e6de366a06d574311a0d78557314b48f06ee55fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676942, "uuid": "30d1ab3c-3c2b-4986-8cec-5506418984c2", "comment": "Malware payload (Formbook)", "value": "c6bd1c61d794f9576a7a49957aaf31929ff41554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676942, "uuid": "3ef66454-6923-4c81-8fb3-845be720d13f", "comment": "Malware payload (Formbook)", "value": "31de45b5bc49e59fadfd8910fb755135f53518206cf098723eabab624858287378439cda7c3508df6dda8a90ea800dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676942, "uuid": "74ba0765-d608-4751-98e8-eeb5619d8a4f", "value": "T11014F636B781F42EE482447DB909EFA55424393029A8C453F7C2AF1B78715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676942, "uuid": "961f9815-43c5-43ab-b70e-19be4742be57", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676942, "uuid": "8a51ab36-e767-44f1-85d9-19166dc8050f", "value": "6144:DwEfD/i1lkemVTtOASZNaEz2RL1enFSC:5metOfNq1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630676942, "uuid": "576dcacb-cf55-4087-9f52-f67ffd8a8a43", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630676942, "uuid": "e9203d26-d068-401d-9c0d-375175906488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676942, "uuid": "6d0bdf28-9a7b-40a7-b5b6-3aa6ec110f94", "value": "Remittance Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afa3b21-0c83-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630651911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651911, "uuid": "29a64d36-c73b-408d-a09e-5b6114378962", "comment": "Malware payload (Loki)", "value": "546ee3732267f5abf1ee309804f15da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651911, "uuid": "0b86e4f1-59a0-467c-b6e3-e07cf42b0f76", "comment": "Malware payload (Loki)", "value": "3f4d815203bc84ec33fc56f8a1e881bfdf11818a7d58ee06250353660fc1b02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651911, "uuid": "fab4cbc0-e260-4ff8-9b89-da32ae92af43", "comment": "Malware payload (Loki)", "value": "085d346bd6f485c28b823cad566b85bb4f4c8ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651911, "uuid": "25873fef-931d-429f-aab7-eea7effa9b1e", "comment": "Malware payload (Loki)", "value": "0ac5122d4f92901bae5faf8144ef246c9cb619cdabc58b79704258dc56700266b5be93fcbda79f4b7f8cbbdd3bebfe4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651911, "uuid": "fa337384-6286-4168-beb3-ef93fe6b7ac0", "value": "T1A4C4E93E19FE23279176C7D5CBE48827F6C098AF3233A96467D747264316A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651911, "uuid": "6c67c67c-07aa-4353-8747-9155afd16812", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651911, "uuid": "ed2f9844-a0cf-4371-9bd2-bec2dfbadf28", "value": "6144:UAMFJLgGtF1GScjeHhlbVJDqTW+99Ni44bRF9blBhpzMkHsp3YeMpO:gc6hlZJOq+9zi44FFxhpRHsp3fM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651911, "uuid": "55ab9950-526d-43c7-a9be-2d46b490657b", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651911, "uuid": "564db6bf-4884-4e48-a067-209fc777fcb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651911, "uuid": "2d273c01-bed8-459f-bccf-1cdc801fc4f9", "value": "USD82,897.06_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399c0436-0c7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630648822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648822, "uuid": "18bccc0d-b081-4652-bc23-ef94ef06c5e7", "comment": "Malware payload", "value": "b01113374c925270cc773dba6e88cd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648822, "uuid": "2a005078-57ea-4e84-adfb-0f9aeefce45f", "comment": "Malware payload", "value": "4009427d13a889c03153fbfa363f35b79198c50a1dab50c65a6f0e35dea37fae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648822, "uuid": "ac786bea-56be-44de-9fb3-fb7940d594ae", "comment": "Malware payload", "value": "b229e8051bd6eadccf7ee79aaf975abe9f1436d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648822, "uuid": "8dd59003-0cce-4a6f-9db7-dd55f2eae84b", "comment": "Malware payload", "value": "da61f906807bb915a2fd39b6f543103951f11fe1cf2cfad6f7b2daf116102b08cc2561ac4c2e7a6252c20c764ae247b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648822, "uuid": "2335ed52-1b74-4140-b004-54a65053a004", "value": "T18213E01954C8D364FAA05C77AE21051D6B43A5F2DC2F5A3F3208DEEDE2E2967C9AC407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648822, "uuid": "f1cec110-23c6-4a8f-97ae-0b6779d4dc71", "value": "768:zdAbVhKbDwOehgy58Gn39RNRN/SXAjUtOfEU4rq3U7qc:zGibgUGn39LAtOfERvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630648822, "uuid": "293b8e4a-d82b-4f4d-b9b0-267cbbb77f9f", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630648822, "uuid": "9e5b6aa1-21ba-4361-bdf8-63b26fded4e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648822, "uuid": "0bedb435-d5e3-4d31-b150-d86909608fd4", "value": "b01113374c925270cc773dba6e88cd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f303bc7-0cb0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630671246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671246, "uuid": "83a30cb6-871f-4064-bb96-e097f69c0dc8", "comment": "Malware payload (RemcosRAT)", "value": "e62293f13ee6567567cedb47d6228583", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671246, "uuid": "dceaa279-3338-4d84-886a-5b36070dbe5d", "comment": "Malware payload (RemcosRAT)", "value": "411104825d974ce23c594374fefc3a9d392f3884eb1262fc47496bc13323627b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671246, "uuid": "8060b154-4251-4b1d-8238-d4961b18b58b", "comment": "Malware payload (RemcosRAT)", "value": "0c445ba050086978b97d7052c4c8793e7a715355", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671246, "uuid": "7ccf51c9-3a69-40d1-9fe8-c1f15931984d", "comment": "Malware payload (RemcosRAT)", "value": "73f589a4157b4aede7657b7773ebcf732b2abd8e9f660165bb263873253ea9a9b6d725936cebb5e73d6a62ad8c6911b8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671246, "uuid": "4fd62118-dbc9-4c2d-8d75-723db8dcf63b", "value": "T18D058EE33DBD44B7F3C158798D674B72561ABF0236B4BC8526E83D8CEB7AB001895252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671246, "uuid": "9f5e71b5-00e0-4a76-a74e-ea15374530fe", "value": "12288:BG0z7gLLMuRN/tMvdEAwM3nrkaoUfpACXDoVttivrlQ5g1+yVt:BfzMzRxtMEqAP0iCXDvvrlY8xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671246, "uuid": "d47743db-8ec1-414a-8653-a2632172d49c", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671246, "uuid": "9a4bc5c5-7755-4273-a2de-388059595a68", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671246, "uuid": "33d0e231-4b3a-47d6-a2e4-7d194af9ed12", "value": "RFQ_EW14416 Novi poredak,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caf459c-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630684046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684046, "uuid": "f42310c4-b315-4041-8c44-7db3aede13eb", "comment": "Malware payload (njrat)", "value": "a213f7c982ebeabf4ebb19f01b23fc63", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684046, "uuid": "8c33190e-8bd2-4ed6-8a0b-b23a5dadf201", "comment": "Malware payload (njrat)", "value": "41b3d8b00b6f5bd80e23bb88abf3c3f47bb36c92846202c19b6261c73fdfde69", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684046, "uuid": "7f5d242a-65c7-4c83-9f68-34d31f515299", "comment": "Malware payload (njrat)", "value": "6ce1031b172f3dfbd2584af8a5af8e2a62cbe093", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684046, "uuid": "ef9a424b-4b25-4e85-b84d-5088c7270272", "comment": "Malware payload (njrat)", "value": "a3c1f9ef87a2ca9c8d715ac7b391296f909e201fe4ae8e1f95f2c406577c86ffb714a8d49ce533cbb34806741796199c", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684046, "uuid": "3531396b-346d-4751-8660-188c63a0b6dc", "value": "T14331E183794541A1065BE2F49ACEB26361470BDA78FE3D770DA3420DC5106A91B432FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684046, "uuid": "3f5f32ba-651d-428c-8a1c-ed3bf6481389", "value": "24:1kCzaifdyYegAY2bWGYtxu5WY5OYWsKYBYjY37Q/GzoXaYgYfY55TB857Pn2bZZY:2YVfRb92gjuv3BDukLZzoXTdwHT07wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684046, "uuid": "2c142c1b-0a58-4426-8f52-bd4ee130d7bc", "value": 1662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684046, "uuid": "8e5cdd90-7229-40e1-b5df-dfd20b9435da", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684046, "uuid": "2b1f60f4-13ae-429a-a87a-bb38781cc803", "value": "Information.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d84c9a-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630660709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660709, "uuid": "13e45d7c-7b8d-48ae-b3fd-2317653f8240", "comment": "Malware payload (AgentTesla)", "value": "1e6e5bd0d5659fbfda3c03aa9d169270", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660709, "uuid": "42a0704f-3f93-44cf-b657-f46ee7bbde6d", "comment": "Malware payload (AgentTesla)", "value": "41d2e7a81627d522fbd744c5bd9c441d14a4d9456609b6ff01807078a0c1d8ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660709, "uuid": "0e23cf3c-0c5c-445a-871f-af32f8956089", "comment": "Malware payload (AgentTesla)", "value": "484b38b5671e2e987ec51e5cafa12d3fdfac25af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660709, "uuid": "75f96976-eb15-4ce8-a631-45b0700fb853", "comment": "Malware payload (AgentTesla)", "value": "adc6f555cbfa2f07f7272f41c8b3849daf0ddbd78acb0999f943f0ceb3c9b69035934fdaac7c1c443f595c6ed95f7e42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660709, "uuid": "755e86b4-77ee-467c-b150-a4cc6ac6591d", "value": "T1B0D423B252C55D01077B7BF70BC3129B3AB695C83E05997A111C1BDAA9D08DB4AF382B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660709, "uuid": "9f188b21-6d34-40c2-b8d5-68e0440061ba", "value": "12288:N7JimhZM5hKLI6kBnCSQTeHAR0xCXvdFsI5JW9F6W:N7Ji15hJCSQTQXCZJWuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660709, "uuid": "60b063e3-3f23-4119-b65e-4faeb5f0fd80", "value": 619070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660709, "uuid": "dc460b97-c813-4b2a-8420-0117a17b1e89", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660709, "uuid": "dfa8d9fa-de23-4f9f-aef8-b16a0c622f7c", "value": "AVS-2021-69145-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211c7987-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630650069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650069, "uuid": "a3183342-ec64-447c-b441-bd974181d3d4", "comment": "Malware payload (Formbook)", "value": "e986ef9f1281a17debac9fbb42818a46", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650069, "uuid": "072c8549-b495-4681-8b0d-1228103d60c5", "comment": "Malware payload (Formbook)", "value": "41e652fe92fac781e6eabb40d316cd8a30ffe285258b2a53c9d9f2f2135945bf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650069, "uuid": "9d5d1f33-23e0-47ab-94fb-e7f5eb6f8070", "comment": "Malware payload (Formbook)", "value": "3239c85064862b2c7983fde1c4672299a17ef7d5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650069, "uuid": "821a8d7d-6c4d-4a52-8263-da8a9de7ed8a", "comment": "Malware payload (Formbook)", "value": "74b0e40e6567735e6bfaeef452a473afe1dfae2fb7b07bcea1889a37908603f6ac1ee44119e0db86ff874327b213bf54", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650069, "uuid": "57b314dd-ec4b-4579-aa5e-4499cde926fb", "value": "T1B12412BC0473853D2DE562CE036FA8F921CE678A2E55C5C0CA63EB17B2A4E59094393D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650069, "uuid": "81e3ddff-375d-4c89-8695-20a51ad0cf09", "value": "6144:hq1rOyu8lp7tFLmNI0uzXzPyzO1mG9oJeq:hq11u277LmRuzXzPnoJeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650069, "uuid": "8531437e-ead6-4b2d-96ce-3f4392862a03", "value": 218385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650069, "uuid": "c1f84c0a-5fcd-49a7-8208-f1df61b237c3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650069, "uuid": "4d1379fe-9d7c-402d-abf8-30a03424cb58", "value": "payment advice_0802421.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5b8e06-0c4a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630627274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627274, "uuid": "f0ecb398-94cb-4942-b145-9c8bb7d8d24d", "comment": "Malware payload (RaccoonStealer)", "value": "b72439dbe487d4607445d3e8c67e16c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627274, "uuid": "46dffbce-8d08-4971-bb50-4d506aaaac80", "comment": "Malware payload (RaccoonStealer)", "value": "4206083a5267dbd406a334237ccecd6d370d098d24d1e4a379a8a521e6eacf1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627274, "uuid": "6586e0e3-b9d0-4cc0-8719-71f89a03f222", "comment": "Malware payload (RaccoonStealer)", "value": "69640700978c7dc5842d1e4da6ca10980010c7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627274, "uuid": "c84590d6-ad64-4981-a036-03d112b1b79a", "comment": "Malware payload (RaccoonStealer)", "value": "b934f760629e903ae7331eb06e980b5be094064237553fd0ea1af3b2aabc660dd582ebd787370e48cc4a90c65b7b2f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627274, "uuid": "6309fdda-dd8e-4851-96a8-ec0d771f90d5", "value": "T102349C20B6A0C035F5B721F849BA83BDA9397E715B24A0CB62D516EE5B346E4DD30B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627274, "uuid": "e4ceff4f-ae75-464b-aef8-4a00b4e6f321", "value": "e1eb14d2b9b63299ef24644e625b9baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627274, "uuid": "75d22919-0d25-4c8b-afc9-c0ea713d4bbb", "value": "6144:G+HNbFzT8j/OznDNLYyeF0IuO6mOvV7UB:lpT8j/O/NLYyHxO6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630627274, "uuid": "41a95ad4-1c26-495e-afd5-f0951cb1ef1e", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630627274, "uuid": "7949f2b0-9353-4463-9dcb-4d83967319bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627274, "uuid": "195d3f2e-b17b-4520-a26e-c2ad66a8e4aa", "value": "b72439dbe487d4607445d3e8c67e16c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bdbfe7-0cdb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630689618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689618, "uuid": "75da3303-5c44-4d4b-9c96-4272f3b049b7", "comment": "Malware payload (AgentTesla)", "value": "205145c02bb408faff7b5230ec588914", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689618, "uuid": "da80809b-61dc-4820-b247-d025ce748868", "comment": "Malware payload (AgentTesla)", "value": "42470aa131fa6fe1faa44f6f9ad7dc39a90b125213c6b0b9c29132cfcf9f82d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689618, "uuid": "40c04ebe-41ce-4047-a0ad-541a5d169476", "comment": "Malware payload (AgentTesla)", "value": "55f83b9634b72174d61d2b75646b40ea506eda4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689618, "uuid": "45d05f08-65a3-470d-b2cf-f6d07561d213", "comment": "Malware payload (AgentTesla)", "value": "8ff9d311b324c6cbff2fc4b282d6d20e182a59c3a75bb1c3b583bae3c3e0687654ed6c51c5f9d89fa80d2912b349193a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689618, "uuid": "d99bdfab-0b8c-4d9b-8e19-ed2a556a7ad1", "value": "T19474EFE4689B84B6F685499DD5C0F4489830FED234CE9D3883AEC872DF596F5AEC4087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689618, "uuid": "2646cfd5-f524-441c-a1a0-3afea34abc24", "value": "3072:isMMfII/YY/00EH1PssvdzFtr5RDAw5wf3:vMMfII/YY/00EVPssvdzFt1RDAUwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630689618, "uuid": "9564a09e-63c9-4b56-b051-0c4f9e7b1580", "value": 349014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630689618, "uuid": "073c2065-eea9-49fa-be54-eb2ac3c75c84", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689618, "uuid": "ff6fa9fb-0a13-4dec-8c3b-fe63073fd83f", "value": "03092021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240113cd-0cb6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630673696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673696, "uuid": "403eb809-9dda-4f81-a4da-4e71e691d33c", "comment": "Malware payload (Formbook)", "value": "c917274c772cb10f220d147c793d5837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673696, "uuid": "b35bc45e-5296-4a6a-a5d3-11761a41322e", "comment": "Malware payload (Formbook)", "value": "43625b0b7ce098d78c074624827e23137ae118f05d6a034f7cadb716fe06e759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673696, "uuid": "3e4db400-d28b-4bb4-b800-968e1285f602", "comment": "Malware payload (Formbook)", "value": "b3f57e994f54b5fa0c271b738af25d3fa89857ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673696, "uuid": "a2db711c-7135-4efa-867f-5d2b810bd50f", "comment": "Malware payload (Formbook)", "value": "fb5844a0bee9831c40770edef50d3f21344fe31451e298468ffe03e37941afee6005fafaf9ff1189f68ddc7ee49225d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673696, "uuid": "62d2a40c-cbff-4b1a-8b2e-b20319f46e63", "value": "T1A724E526F7C1F42EE4824479B909EFA550643A3069A8C453F7C1AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673696, "uuid": "d4fcc0ae-0f2c-4a66-a3dd-af922f978980", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673696, "uuid": "fff6bf12-26e9-49aa-85ac-d240e0329378", "value": "6144:aQEfD/i1lkemVTtuASZNaEz2pjoLlhGiH:4metufNhLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673696, "uuid": "4ae24fba-0e2c-4b09-95aa-08072a4e13f3", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673696, "uuid": "31363bb6-4526-4f1c-b0e2-e27ccf812fb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673696, "uuid": "5e866eb9-61a7-4007-8042-a15d6a0092e6", "value": "c917274c772cb10f220d147c793d5837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef90dd2-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1630660239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660239, "uuid": "80ed78fb-2ccb-45df-bb4b-d9337c92d20c", "comment": "Malware payload (DarkComet)", "value": "bdc9fa03150b08bd14d06c994f5d291e", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660239, "uuid": "35f90ab0-4974-4bab-adad-0757e8921679", "comment": "Malware payload (DarkComet)", "value": "43bfc71737bff97fad2484a55e501262e2b25a03aac1a200843f3222f3dcc9a4", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660239, "uuid": "028d8054-0aeb-488e-a9cf-ce47e0cf8ceb", "comment": "Malware payload (DarkComet)", "value": "e55517f4b36aacd990888c75158ed3fe319b12ff", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660239, "uuid": "e34af01c-7ac3-4ce0-ae18-6e039a0bcbb0", "comment": "Malware payload (DarkComet)", "value": "238d644bc859d8f700f0e5bc8835ebb1c37daa7aa192cefca18384a67e79e342c97dda942eca5fef0741b739c17cdc5a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660239, "uuid": "8a0f0492-276d-471d-aeb2-f7144e871747", "value": "T154E48E31F1808837D97219789C5F92E6982A7E202E39754B3AE62F4C5F3D6C239193D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660239, "uuid": "6537616b-d5af-4654-b7c0-b552072bb9f7", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660239, "uuid": "d4f0397a-4dcc-4421-b17d-b9eda7c5e4a6", "value": "12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hu:KZ1xuVVjfFoynPaVBUR8f+kN10EBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660239, "uuid": "31518f69-d0ab-4257-8120-b473c9ebcba1", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660239, "uuid": "d882f1b3-46fb-4ee7-b818-3c748e5d2780", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660239, "uuid": "0cc16aa0-7247-4569-8ca9-762bf0ceddbf", "value": "43bfc71737bff97fad2484a55e501262e2b25a03aac1a200843f3222f3dcc9a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1db8ac2-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686444, "uuid": "e878b651-9ba1-4893-b452-994465c981b5", "comment": "Malware payload (Mirai)", "value": "75570767c2d9070fbae65046ab368d88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686444, "uuid": "27aed556-468d-49cf-958c-151b7a04449f", "comment": "Malware payload (Mirai)", "value": "442428e11cd00b59a0b1fa070fdbdf627627094925ca24deff7ac661cdac0320", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686444, "uuid": "5026d61b-8b70-4e81-97b3-f495609649fe", "comment": "Malware payload (Mirai)", "value": "c6643d9bdb46078377810035b08fdb4f54c42e61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686444, "uuid": "35939434-fa20-4262-8aff-dcbe38413bcd", "comment": "Malware payload (Mirai)", "value": "20ad6e3cf8b0ba46907e266425a20c9b9c79e6751811dc3913e63cc6246fdc3ab8dc868b4a7ad74c1f2302ac21ef0b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686444, "uuid": "a067d9a0-3f81-469a-8ee3-982e3a75e53f", "value": "T1F5339E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686444, "uuid": "95371662-953a-4587-8708-9dbc2da437db", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40ZdiWFyGoMuJLk3XCmlolN9aXCxM:EcdC753UlwtNFFyGoMD3X3qlGXCxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686444, "uuid": "36ecbc06-a48e-47bf-9f45-b5ba86a1acef", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686444, "uuid": "b942730c-d05c-4199-9af3-f344d2d7a783", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686444, "uuid": "a3a5b57a-6b1a-4e15-ab87-d13eafd4b9c4", "value": "75570767c2d9070fbae65046ab368d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ad7acd-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630650027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650027, "uuid": "33d0527b-6b69-4b69-885f-b0ab7f5ef2a6", "comment": "Malware payload (AgentTesla)", "value": "0508b09b240a70f2be2629025538e57f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650027, "uuid": "877354ca-c3e0-4d5b-b931-b7db7df22aa4", "comment": "Malware payload (AgentTesla)", "value": "446f47d58cc074c64e9396c376a7a7cd15a766a3793bed83107363ec0e2f5372", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650027, "uuid": "0a559e8c-0918-494a-901e-011362b9199e", "comment": "Malware payload (AgentTesla)", "value": "a628bedc46ffc0a374a775f79adfb6286d66a34d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650027, "uuid": "76ed1c02-671b-4e24-9754-de7c963b6f5b", "comment": "Malware payload (AgentTesla)", "value": "83368a0ff2513c97eec30d54b2f57d261443269078b222b434a5ffef583cb63afd45ddcb1fb76a49f42bdb34f5574037", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650027, "uuid": "174d9b2f-c5ff-432d-b58a-42a207e804a7", "value": "T1C215E0147780FA4EC17F4F7A48911510ABF4E6A6470BFB877CC226ED49CB36E4A17226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650027, "uuid": "33099c61-39f7-4a8f-bdb5-4c27855f7da1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650027, "uuid": "7ff3580a-e849-4c9c-9c81-c42f069be07e", "value": "12288:f3zHd0qgDNcoU5mEVSdabX1x5k0Jxk6NRsaE6qwX1R4YGplM6WEMmEpJ9w0zE5KP:LdSDNqbX1x5k0PmaE6olpa0En", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650027, "uuid": "9396d4c7-bf26-47e5-a803-6f084c7afc49", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650027, "uuid": "f784c9fe-c315-4b7b-89fb-763468df276d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650027, "uuid": "41119930-be5b-450a-81f2-6053fb371c50", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d0ef58-0c82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630651549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651549, "uuid": "65d5757b-dfe9-4bb9-bdd7-561e6dda1590", "comment": "Malware payload (RaccoonStealer)", "value": "f3e98675c732830a93b39475b1a1d2da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651549, "uuid": "ed92688c-87e6-43a7-91b3-9dd664140854", "comment": "Malware payload (RaccoonStealer)", "value": "44afe27cba5bc69958b37c9315d8de1c24324415883bbd7e368f9cc744639ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651549, "uuid": "014883b1-dac3-4fe4-aaba-bda8f1c24299", "comment": "Malware payload (RaccoonStealer)", "value": "87c250fcb6cefdf95be0312b03b1b7731ec2fb04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651549, "uuid": "cba66a70-e855-41ed-af7c-2424d8336262", "comment": "Malware payload (RaccoonStealer)", "value": "426d1639692f960dff10bce2dbc4accc205e05ed4791406425468357cde254212aa1b1dc2f9abce1d78a38acd11e8150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651549, "uuid": "38911ddb-cc6e-446b-bfdf-9b02716ea867", "value": "T13BD5696035D2942FF4730B73CBE9B3A9CEADD4F22F1265E8650096708C52EE76F91249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651549, "uuid": "b7b2a616-e7f9-46ad-9fa3-eca1312c5237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651549, "uuid": "2a7fa670-f39f-4e7b-a1c1-03568fd64d21", "value": "49152:DLup5/3jzTRhOa5mBY+yqTF2Q7o2Dp8SlYtmMhyLowIC6S:DLuHHT4YZqTvJWtmCyLowIC6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651549, "uuid": "717904f7-d4d5-4ca4-ae71-b27512d77b5e", "value": 2919936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651549, "uuid": "d1212a40-be2a-4123-a428-ee6cdae1b2dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651549, "uuid": "d1c7f43b-ac93-442a-8d08-f64e82832e4a", "value": "87c250fcb6cefdf95be0312b03b1b7731ec2fb04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18094bb7-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655637, "uuid": "f4ff9154-d705-444c-a16b-8893dac5b11a", "comment": "Malware payload (Mirai)", "value": "d251eba14e4a2adc18526ac0831fe08f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655637, "uuid": "fa1dfa1b-432e-4620-b652-81b9d1ac7a22", "comment": "Malware payload (Mirai)", "value": "45446d1cd7d60fee45d9ce1d1656c9cebb5b40f4f0a71e4dd23b7ddad765ccdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655637, "uuid": "ea18ec54-8403-4a35-afc2-1c02b3871c6e", "comment": "Malware payload (Mirai)", "value": "7854c3e0456980f270f4eec142dbc5fe68e3190e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655637, "uuid": "15e34e2f-3c76-4c49-889f-c656f03eddb7", "comment": "Malware payload (Mirai)", "value": "8f67ca0764f7edabb6642deead0127aa8dd451f191b2f2a43a7152cffafa205319b557b5c3b0edf57b6edaa8b40a479d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655637, "uuid": "b8ce1ebb-0a99-4e08-85c1-b286a9706e37", "value": "T1A133024DDCA5B48BE6AC693C238C17BD6984F8C8309A5F5E13230F8AD0DA11772590B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655637, "uuid": "57c54761-7cc7-4b79-a8d4-cde8d7c5070a", "value": "1536:oUNe5+i5ZCmYDAFRTmZSDJ7+YmyvwQm6oyuzEHQgzFiZ1iBk:r8Ei5ELAFRTmY171myvwr6qzq1gEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655637, "uuid": "f909112b-8d27-4110-bcda-554bf5c4c6be", "value": 50420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655637, "uuid": "ecf26db6-95fd-43a7-a08c-d3c6d1482861", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655637, "uuid": "e0570500-f80a-4700-8e10-de5f4199ff10", "value": "d251eba14e4a2adc18526ac0831fe08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398ca254-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630654405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654405, "uuid": "18ffdfdc-eabd-43f4-b489-57ac59b890ab", "comment": "Malware payload (AgentTesla)", "value": "edc4b9cade2c050ada79cc375a98c9e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654405, "uuid": "b78ba60d-2b4b-40c7-813f-9b353622ac94", "comment": "Malware payload (AgentTesla)", "value": "4545214a54b2afbcd3d1806c2951456fd8d8a8c6f9254b36058093231b0f63a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654405, "uuid": "4abef3f4-094d-425d-9585-2cf41a97b0c6", "comment": "Malware payload (AgentTesla)", "value": "5b5808590b243b00617ca908a48453bb870411cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654405, "uuid": "d21fcaf6-a337-4d6f-a3d2-44b7a8f8a587", "comment": "Malware payload (AgentTesla)", "value": "d148085f982b71115a8b8128ee596be4f88bb425d5728c7c1cf3f33dcdf6683661c359e259d3ff6e61ff9c86b3e2b0e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654405, "uuid": "b4bf78f0-597c-4b9a-ab59-f586c174a15b", "value": "T12F94F11437E84722D67C2BB64230966047F8FA67D732D79A3DC912DA4E63F45CA807B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654405, "uuid": "9e36ca45-a885-424d-8943-7c85f13f250a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654405, "uuid": "27b3d025-a0f7-4e32-8556-979995d3fab3", "value": "3072:PrDa0KAFOvYM90D3ofyeS508dzxXhSRK6CYXlCRRtNxc7vb+GFlnRP8HNnm8YeRl:3aeGmuLS50uhSCYX4fN0dnJaNmcug/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654405, "uuid": "a7904c48-fa79-40fc-b24a-eb880af6adae", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654405, "uuid": "01cfa049-2c82-4167-959b-d9255c329ff1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654405, "uuid": "3c7fa5ae-1b1f-4c2c-b29b-9afb0cb9ddd2", "value": "edc4b9cade2c050ada79cc375a98c9e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2257838-0cdb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630689853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689853, "uuid": "7a8b8f9e-d4a8-41ea-b8e2-d37ffb09c141", "comment": "Malware payload (RemcosRAT)", "value": "643c3d9c512e0e53cacb2b1725f83d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689853, "uuid": "7737e199-b5d6-4eda-ad5e-053beab45242", "comment": "Malware payload (RemcosRAT)", "value": "462062209acc090a567e2bd571acd1d52c19d0d80ee56da256a3c58aaf3b12e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689853, "uuid": "dfd1e149-70df-40e3-9cc4-89236aa9e12a", "comment": "Malware payload (RemcosRAT)", "value": "6a8ef4cdd29fa41d8d45559aadec3e44a90e792f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689853, "uuid": "75355746-6e23-48f4-89db-017e8ec7624a", "comment": "Malware payload (RemcosRAT)", "value": "ce3c35ba8f2289f1cd8f37c7040aa46409332ae5d37f0a82b13b40e3c4176dadab0665ea0a44cd1901b2a787ad66a98e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689853, "uuid": "ec6b034b-f4b2-4393-8dd8-26b1e043180c", "value": "T1B8F48D427BF007BAE37B2BB24C337A399D21BF14192960547FE55E4E0E7C544632D2AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689853, "uuid": "dd19674a-bab9-472e-92e3-3eba9ec2ae16", "value": "683e36fe1155994747e39b9f335ec7e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689853, "uuid": "4b6a991a-ae40-4aed-be10-cab12d888205", "value": "12288:KAQ4TXPbFLYhC0MPsgGsXxItIwX/m/zOOMH9L9T5kLvRJ:KZaZUhJOskXOt5vmb6kLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630689853, "uuid": "44d58f90-71fc-4b2b-a92a-f7f18a261f7a", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630689853, "uuid": "7433f929-6c52-4a89-96f9-3c5bb39b4c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689853, "uuid": "3b77af5b-16d4-4276-b84c-93f68a79eefb", "value": "Pdf Attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e727c81-0c99-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630661205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661205, "uuid": "c76db907-1615-4d5a-a76a-d7f142cc1507", "comment": "Malware payload (Formbook)", "value": "3bd15d06dfd6b00133cf568a802fd6df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661205, "uuid": "3cde01f9-b636-4be8-bd9a-ae922aaa90ad", "comment": "Malware payload (Formbook)", "value": "485ad83319a3a7d9ad350442b92d97ff3900021a6cc49e745b3905beb1d5daa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661205, "uuid": "85cca814-ccd5-4a6d-9b6c-d43f5dc64ed5", "comment": "Malware payload (Formbook)", "value": "3be7192e75763fecf2ce9fec2099605c153b9dd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661205, "uuid": "c07dad67-c74e-466f-99c9-053804ab7958", "comment": "Malware payload (Formbook)", "value": "34f1140833993cd656cb26e33f7ce73d22423069b9ea78021cbcc5e09f1a475555a39a42ce9acb75c81bacde6705d41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661205, "uuid": "ffd059e3-2d75-4d2d-a1cd-72a713b3472b", "value": "T10324F636B781F42EE482447DBA09EFA55464393029A8C453F7C1AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661205, "uuid": "01287f02-b44f-43c4-8648-55c56371f2d5", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661205, "uuid": "14adbc4b-1d77-42fd-9d4c-aa7af8261989", "value": "6144:YQEfD/i1lkemVTtuASZNaEz2pjoLlhGiH:mmetufNhLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630661205, "uuid": "4f5d76a3-e70b-4b86-a510-104e28d08d07", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630661205, "uuid": "6cf4d1ab-30c6-4f19-bd00-4906d8bca369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661205, "uuid": "f7214150-fb93-43c8-be9a-597db1761c6f", "value": "REQUEST_FOR_QUOTE_00989_RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54f082f-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630654264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654264, "uuid": "c6caa58b-1afc-43af-804f-d1ff296d734b", "comment": "Malware payload (Vjw0rm)", "value": "f82eb8608257ba68dd9b75d23fda4eb5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654264, "uuid": "822f030d-8f11-4b91-8724-ac32271cf1d4", "comment": "Malware payload (Vjw0rm)", "value": "494081a119d2e5a4c9486c555b8f0a148b3ea91c5a2a29254c72a3ea0837fea9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654264, "uuid": "cfa3e439-83df-471b-af85-0c19587e9fd1", "comment": "Malware payload (Vjw0rm)", "value": "499abb11b6a33c7eb9f587bb79e7b0588bc3fa3c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654264, "uuid": "d01b3028-2939-4fbf-b9e0-ace1c7cc76f6", "comment": "Malware payload (Vjw0rm)", "value": "5d0ec5f744a964dbbecbcb3e286416d768d7767d22dc3c98517ee7cdb58fc130f10c394d710eee67af925e6c944e5acd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654264, "uuid": "eaefc029-16e9-4dc6-839b-feec8a77d349", "value": "T12FE2D3013E0BB82B2A4B7E08E5F96D394D1DFE701519CD631A87193E8328E05577F6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654264, "uuid": "02330fbf-a7c7-460d-92e3-1cff7aab2502", "value": "96:De2nOSr0EZbdIx7EV/EV7VBVDVh9pfrGqSj:D/nO9AWBfpnrGqSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654264, "uuid": "7ef85faf-74bb-4536-b194-dbc24b675d9b", "value": 32548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654264, "uuid": "68947db9-fa86-4837-b9f8-1075b8baca24", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654264, "uuid": "142b4ab6-56f7-4de3-9d05-df731bd7b231", "value": "inv-m5.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa3e9c1-0cb9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630675004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675004, "uuid": "6a38b1ce-66f7-4742-8b57-554663afce79", "comment": "Malware payload (AgentTesla)", "value": "35debb3a1918cd25c92b28a4cd689d85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675004, "uuid": "a1ab2283-fbb5-482b-9bc7-d66453e9b449", "comment": "Malware payload (AgentTesla)", "value": "4950adb6920bb8a3f9a37bfdab46c5f6c38236cacc1237f47732f30196c32bc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675004, "uuid": "99af8168-9758-4b89-82ff-bc7db3bf9f14", "comment": "Malware payload (AgentTesla)", "value": "e69dd6adb6d7ed7f3848ee76ee9780eb0e35ddf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675004, "uuid": "bc31b86a-ff21-4991-b560-9824a1c63b98", "comment": "Malware payload (AgentTesla)", "value": "d39abe724aff868e958fcea055efd380c46c0989148148779fe59ee2f21cbea847fe288312c111cb10cb58b6406cdb3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675004, "uuid": "5232d792-59b6-43fd-9d46-5fbbc9bb5302", "value": "T13AA4CF5D765076EFC467C8728AA82C24EA61B5B7430BD303A45322ADDE4D6DBCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675004, "uuid": "d083c35c-23a2-4bf5-8bcf-273343a99ea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675004, "uuid": "2aa65263-5e5f-4a8c-9f10-c5e7bc4a5270", "value": "12288:7hW+7YUtmZKnA81XfyaBKOqPLOGo/xvUwhkas7NEAn9sw:7hcYmZc1PMOqTO7/lU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630675004, "uuid": "1e3a0164-7855-449c-9ebb-49ecc2a6234c", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630675004, "uuid": "e917974f-c4d3-411a-8f52-67d50ebadef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675004, "uuid": "33c3df7d-5631-423a-9223-2cc877200820", "value": "MT103-8392832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7d271e-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686436, "uuid": "5c438a72-2c55-45d0-815c-93b0810812e4", "comment": "Malware payload (Mirai)", "value": "88511f9b7ae783cb840e50c202646d12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686436, "uuid": "25e76fa4-91e9-4f12-81c4-65940549a0e2", "comment": "Malware payload (Mirai)", "value": "4a684a89ecf094c35885c9e7c66e123851e68424986a27e2c5e524b6b35d6c52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686436, "uuid": "4ab44c7c-4f45-457a-b6fe-bcc24272c0df", "comment": "Malware payload (Mirai)", "value": "60f535bdc4cc05ad80b58f317418812dfb3e2367", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686436, "uuid": "f4cba926-f710-45c9-93e4-b9c730cc43a4", "comment": "Malware payload (Mirai)", "value": "a53613982908795696671be11e6af1e9760fd7199ca06fbe3aff0120f78fb3e2090409410d77da620e3ab1e3e3dd0c2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686436, "uuid": "d24bdfc2-c958-4e2c-8fad-d35fa9e91650", "value": "T11073B309BFA50FB7EC9BCC374AA92712248D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686436, "uuid": "5ac60b14-6e8b-4591-bd4f-e84f955df607", "value": "1536:aHJtIFGq1QDT+uDEQhKvt191Yi8ZNFDG/:aHJtIMZT+UEQPi8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686436, "uuid": "6ea565ee-a163-4058-8797-d16ac7c50049", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686436, "uuid": "42e58b1a-cc1d-4585-bac1-74c885a74169", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686436, "uuid": "f9e03224-fe12-4efe-957f-ff15da086c8c", "value": "88511f9b7ae783cb840e50c202646d12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1258081c-0cae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Zyklon)", "timestamp": 1630670231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630670231, "uuid": "aa04336a-012c-42f6-916d-e70d45fe428e", "comment": "Malware payload (Zyklon)", "value": "74fecf5d147f568c260d6ffcaa309af4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630670231, "uuid": "6d7c8525-1584-473a-b437-c39a982cd297", "comment": "Malware payload (Zyklon)", "value": "4aa43ac428711299a98c1f5c22d38eb33471ae3e8cc7df31e31d21f6f241f5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630670231, "uuid": "59a0267f-003e-478b-8d82-3bff7305bf9e", "comment": "Malware payload (Zyklon)", "value": "257615d95986db25db71a2381caa64017fb177ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630670231, "uuid": "66e6881c-0314-495a-9655-caedba45f990", "comment": "Malware payload (Zyklon)", "value": "4eb5d75231fccd96a0a1cedba16de5207c8bda37fb8692530997c401739cfe839906502e8ef3ace25f5f7bc4a1d55720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630670231, "uuid": "e3c6ad1f-e7b9-497d-a293-a0be072b46eb", "value": "T17354394623559621C75E527DC05A811432F2E703A73BD38F2A95D9EA1F832CDFE0AED8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630670231, "uuid": "13abc7ac-85cf-4c59-82b2-a536360a147e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630670231, "uuid": "2e19e1ff-993c-407b-a323-13d704b694e6", "value": "6144:rT/gwYoAQozmUzVH76a9zPNUJ+OTxL7QURJjeWL:rTIVb/7NUJrtnXJjes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630670231, "uuid": "690a3858-8b20-4c4c-8c63-4237f5b90ef0", "value": 298495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630670231, "uuid": "9ce59fff-76b2-48ff-80bd-5f5715444014", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630670231, "uuid": "ba54a6e1-a58f-4bc1-bfec-cad6221a0d77", "value": "try.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a6f73b-0c66-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630639556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639556, "uuid": "6b92544f-7915-45b0-8e5f-095b58a87237", "comment": "Malware payload (RaccoonStealer)", "value": "f0af15a2314afee90871fe75a1faa3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639556, "uuid": "e1eff4ba-685d-423a-9253-91f4e1053e30", "comment": "Malware payload (RaccoonStealer)", "value": "4ae2121a59907625840dfc680841abdd1cbb1646f0e46f3078b8f4e7d55f3d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639556, "uuid": "73b9c49b-d332-4a66-81dc-81ade7691dfe", "comment": "Malware payload (RaccoonStealer)", "value": "58a9d3200daf1b04a72c730b9a93b22b94bf5e25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639556, "uuid": "3de0aafb-41a9-4c67-971c-425be53fa790", "comment": "Malware payload (RaccoonStealer)", "value": "9cd6cc9cf89f36a01a0d6e4f072d4f2e25bf4f7eaaac581ff88ed89e5ceb49961da34ce2c25e901200d6c550adef455d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639556, "uuid": "8b309ff9-00ea-443f-8d9e-adee7be25029", "value": "T14DD4D000B790C034F5B736F88AB69379A56A39B2A76850CF52D51AFA46346F0FC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639556, "uuid": "bf419684-6ceb-497a-8bcf-58ea52c4495d", "value": "9b6cb8fb7864152f2c65c8441d386700", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639556, "uuid": "12d62217-c3c3-48bd-b9ca-325f03f7fe83", "value": "12288:xF/Q4o6kX2HpCkZ71STDiYYQbSqDGGPTwEeEAz2:XFoeCkZ71STepKSmbTw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639556, "uuid": "2ffdfb81-0ff8-439e-8341-18acdd2e9143", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639556, "uuid": "af2bc0f2-0b10-444b-8ea8-14e7ed2f1ad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639556, "uuid": "47ab366e-b279-4439-8f97-0394d18b8755", "value": "4AE2121A59907625840DFC680841ABDD1CBB1646F0E46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacded3d-0c99-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630661521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661521, "uuid": "2907b994-6007-4ad8-bd5f-0ed73f1c6fee", "comment": "Malware payload", "value": "f01f9f9f40eab5183b2d60d9db9aafe7", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661521, "uuid": "1fe32fa1-7542-46a7-a9b6-be27e13cfd4a", "comment": "Malware payload", "value": "4bbd3513e1b413fd2cd1a1a4350b3371eb3233be7bc41c61a5d5a080dd4d8cb9", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661521, "uuid": "4d2e8440-e127-4312-8ea2-dd09039eec3b", "comment": "Malware payload", "value": "2d4a9901587bd7545571b004c8bf78a769e8c111", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661521, "uuid": "7f0e4e00-4711-4eff-9a5d-f0438270cc49", "comment": "Malware payload", "value": "03e7bf98adbc2e9c0f3688f927004a1cd556a472c5f98dd482e6be577daedc3125ab0ebc71785a72e0fbe3b888bdec0b", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661521, "uuid": "83e3d109-df61-42b3-adb2-913fe616b3a1", "value": "T15B03F11A9BCA6521C3867F3F1106BDDCF9075A1FD1EFB66B3AA492CCCD198310102A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661521, "uuid": "0649edab-bd30-4dd0-8d4f-ddf9a480d3e0", "value": "768:+LQP+NAiJQucR7gWUU/M108/OLNWU+k3Uod7s3y0PotiWye1o2H3CrpHE:+u+WqQuctgdjm8IEVYUEs3y0PsiWyOXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630661521, "uuid": "862c11b4-4ff1-4349-894b-142d5719b5e8", "value": 40546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630661521, "uuid": "11a0ffd2-ba3d-4337-b5be-a5958026f067", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661521, "uuid": "e7657dbb-0dd0-40d9-8d85-ed042dee4850", "value": "Banca Comerciala Romana_TT_swift_scan.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6befcb8-0c73-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630645220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645220, "uuid": "c38c7509-ca23-4fec-8363-c47b01e05713", "comment": "Malware payload", "value": "688712e42aec016db8508b7b7ad3b705", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645220, "uuid": "9bfe3471-0c61-4ebf-80d8-c0d0b9e8ba9e", "comment": "Malware payload", "value": "4c48e4278779a246f9450f064d3b11990863d37fa99e3f2b7759575fc17703a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645220, "uuid": "30472163-14b6-4e40-af49-04e038e9e862", "comment": "Malware payload", "value": "851e9a725f6f821b240baeda73e363290de2e6b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645220, "uuid": "f3c4f8ac-fb76-445c-8f0d-f430a8317cee", "comment": "Malware payload", "value": "84340cd77b7278c5326d4248586d078d69b5ac4a2d816984c33936ce3514afcc4ce9a508ab3de93bdcc78cc685f920cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645220, "uuid": "f5cd58ee-6629-4df9-92b1-3e7d64e04751", "value": "T126F2E1A048849B31D9F108BCFD7D17AD25183BF5CCA578D26931417CE8E99A1B9E0BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645220, "uuid": "8e4da858-3189-41d8-9828-26175201b3a2", "value": "768:lWL/3AIqMD7D5unD8SlIWvG3DeQ20UNSVuI+Eddcf3Uo:lWL/3ZqM74nD8a23qQmNeuMc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630645220, "uuid": "4ee09ffa-64c8-4bbf-a7a1-0c203afc5008", "value": 36656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630645220, "uuid": "23785d4d-9a2f-4efc-ba6f-e7cd219ffc23", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645220, "uuid": "8a601891-3b66-4c19-ad4a-1d4dc2ece107", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d4ada2-0cea-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630696169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696169, "uuid": "4d9bbb66-ee1d-4f5a-8953-af4164ef4bac", "comment": "Malware payload", "value": "5b5276e6117204297cf817fee27e16d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696169, "uuid": "d8f7e408-60a4-470b-ab7c-0d817c8973f0", "comment": "Malware payload", "value": "4c5fd4ed6d7eda044f08d5369dd3ac130ae1e7d2f8415a77ebbc8010e2fe7c11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696169, "uuid": "acd99a6f-ae21-4ede-b964-77f2995912f8", "comment": "Malware payload", "value": "085f8c31af7217eaa95ddcab32ec8de22f3e93e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696169, "uuid": "4db69105-8cc3-47a2-b46d-ed0ba83ab0b1", "comment": "Malware payload", "value": "e6d062309863d91c102ec474d54463c817ad8f5dd8dd51db555f4984bfbb03c3c59025f163fe5288672ebdd549cdc007", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696169, "uuid": "1f3815c0-92bb-4331-a1e0-2a768bb7f26f", "value": "T18EE41C3E18FE23279176C7D5CBE58823F5C098AF3233A965A7D747264316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696169, "uuid": "d7c6bfa6-a2e1-4a8a-8a60-6c36ed01cb34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696169, "uuid": "521b6f4a-ba0a-404e-a057-cbf1c8abe93e", "value": "12288:xIGmwPTWN5FyYLX8kQMHbNJYYzTsBJqgh:Gw7WN5Frj2M7NBfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630696169, "uuid": "3e5a396f-7725-4e24-8014-4116e459bd54", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630696169, "uuid": "0e845de4-6f7b-4dc6-9290-6d8870d6442f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696169, "uuid": "49c38a9c-8bf1-49e3-8410-aae309cdee64", "value": "5b5276e6117204297cf817fee27e16d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940e4e95-0c82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630651551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651551, "uuid": "2dffa395-b333-4a5c-9a97-74a768ef4530", "comment": "Malware payload (AZORult)", "value": "f3e6fa0e659557c6001a73217c98aa86", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651551, "uuid": "f2ad2b93-6ba7-43d9-b64f-ec90ab6f8975", "comment": "Malware payload (AZORult)", "value": "4da160dc1a5e5f2f2e0dee7ab9ccd3a522e34bbef2d602f35525b788f3afee2a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651551, "uuid": "07fd7b0d-67d5-4e17-aba7-3793c0e173d2", "comment": "Malware payload (AZORult)", "value": "199e41a1c37c789b0f93e0b0ac54a5797e170a74", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651551, "uuid": "99dff78b-eb03-46f2-8c70-0bdd59318732", "comment": "Malware payload (AZORult)", "value": "690139be1a5943bb72f6869934a56a168e01d470c52a39ef98b4942a2fa8b6c3e0ad9496ff56f20f7b2ef8a4279ddc85", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651551, "uuid": "25b37ad3-48d1-4f1d-9690-147438c73a4e", "value": "T1EF450212F6E66832D0279AB55F70B184067BBE3B39F44A5AF70C1D8C5B63D80E846367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651551, "uuid": "995539b7-0daf-4056-a0b4-2c3db0c72343", "value": "c48c98d8d11cf51c73b194502a508be7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651551, "uuid": "98ed0843-8e19-44ce-8d4e-29807290e48d", "value": "24576:l9bVijMRXOttoz4FMz7blnyvFFDLVH7ZzyCr9:l9bIjMRXOttQz75ybB7MCr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651551, "uuid": "e06c50b6-72cc-4b37-b467-c3549b58805a", "value": 1188496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651551, "uuid": "75379ac0-0a44-4ce2-825f-f472a36f5642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651551, "uuid": "cf8090e5-e3b2-41a8-bb0f-386901d981b5", "value": "4DA160DC1A5E5F2F2E0DEE7AB9CCD3A522E34BBEF2D60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f1fcdf-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659974, "uuid": "24590736-0f9b-402c-8a8d-2f71364d5718", "comment": "Malware payload (Stop)", "value": "c14667401627986e2707cc05e33a37b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659974, "uuid": "197b20a6-cf82-4a85-a5b9-87adb02106a1", "comment": "Malware payload (Stop)", "value": "4dcce8f4915ce7cc21ed6bd82421f733096670e3d6b8d9eb07855ecccb052cca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659974, "uuid": "bbf7305a-9b34-489d-856d-2f45848be9a2", "comment": "Malware payload (Stop)", "value": "0544602684e80ad21d9195348a85c3fc7b3e6037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659974, "uuid": "4305fd26-93c2-4ed9-8943-dd81e4e2a4e7", "comment": "Malware payload (Stop)", "value": "dfde40dace12db236a8b914abd0491a07f4e2bb5072c3777354104abc2491579df1935e1ca5f76e9f484368211981e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659974, "uuid": "bb00636f-b5b8-4f80-8c47-a03f0979daee", "value": "T192F40130A6A0C035F1FB11F55AB993BC6939BE715B2081CB63E513EA5B382E49D31787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659974, "uuid": "f7ae5d3b-b43c-4e57-8079-14279616176f", "value": "e1eb14d2b9b63299ef24644e625b9baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659974, "uuid": "2a637faa-2dd7-4260-99b9-c8d742f269dd", "value": "12288:1Zkm+t3o/IWRydTA4Uix0o8cStubP7KHVLGM4CMIL4ticH3HF1epagWEMDp:zf4zGc58zAPuHoTtiE3l4paoMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659974, "uuid": "997f42c7-b23d-46f0-8874-440f2c4722b1", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659974, "uuid": "92730e95-c7c3-4ad9-a240-d78da98cef73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659974, "uuid": "a8137064-d18d-4d4b-8d2e-cacbe1032d59", "value": "4dcce8f4915ce7cc21ed6bd82421f733096670e3d6b8d9eb07855ecccb052cca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4367081-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630659846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659846, "uuid": "b9cedc92-0839-4f75-97a1-58b9df872166", "comment": "Malware payload (AsyncRAT)", "value": "22f47e9e145e34b2dbcf22953b630550", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659846, "uuid": "7ef70728-2952-46d0-8b15-573048ae2ee1", "comment": "Malware payload (AsyncRAT)", "value": "4dfd6902633a3dca2285a30272902b58a133eddef8727fda65844604867f2080", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659846, "uuid": "72a26a8c-3c4f-405d-95ea-fafa2cd36c27", "comment": "Malware payload (AsyncRAT)", "value": "34a3f68e6cfc7009bd6a791f3a3718016bb6fec4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659846, "uuid": "b8cdbe71-0762-4571-8a19-1fa3ad3fa5cd", "comment": "Malware payload (AsyncRAT)", "value": "aee9820fb12d99dbd784411ea600499abb40019bf4c0d6ca4aa5309fb0eef80daf66825390658e0d59f973a31c5800f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659846, "uuid": "7014b840-68ad-48c1-9999-c103f99bf569", "value": "T1EB15053DBD252637E7BA86F8D4960D4EE69410CB22731DDF42D6A3882107617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659846, "uuid": "e6a3aa85-242d-4876-8bea-bd99238078ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659846, "uuid": "bdd1e812-2ddb-4039-ba96-6d479698e8ca", "value": "12288:gbK4HtLGEUBXeu0BU5SisIid0kph+QrA2r79gEflEGD/XnyP112PdsfLosmoyJOp:cWUDddiW3Mk1vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659846, "uuid": "33577163-84ee-4a1c-ad0e-e60e633dd201", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659846, "uuid": "96fd4556-f8ae-46ae-b653-dd970c61dc30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659846, "uuid": "cbc0d888-7bc9-41bf-a44a-f710a935cfaf", "value": "4dfd6902633a3dca2285a30272902b58a133eddef8727fda65844604867f2080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcef7c3-0cbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630676206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676206, "uuid": "05c3a759-fb24-422b-b4be-63802e7e3e1a", "comment": "Malware payload (AgentTesla)", "value": "0f4ad27094fa0184740d799beb2281da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676206, "uuid": "edce77cb-9889-4d34-a225-2531c310ad1a", "comment": "Malware payload (AgentTesla)", "value": "4e78d72248e25dda9fe37d8a037242190ed2c663505ca9c0ececc89320483ab0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676206, "uuid": "21602e27-dcdb-432c-b1d6-ea83c7e4b47c", "comment": "Malware payload (AgentTesla)", "value": "027cb784f0b95487a7069cde7e55e17f0669bee1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676206, "uuid": "adfaa6e3-575e-40c8-8c1b-ee0a4024259a", "comment": "Malware payload (AgentTesla)", "value": "5d55d7edc40bf5405fd72667025929bdb85d3a1e812d2ec4329b6c41ad393a070abbebe0eef69a8c4977b85d6da1c0a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676206, "uuid": "a1818d95-e1a2-4d16-aa4a-012362fc0345", "value": "T19805220772188D52DD6C4373EEE7A1B00BE2FDAA4271E55AB69DB2221FF33450811F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676206, "uuid": "7e0e5cb0-8333-4e70-88de-3e409a208dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676206, "uuid": "0fd694fd-d2e5-48f2-a024-262a93ad5e55", "value": "24576:lhfzq9G2SmnGwwP2YV78Ul/kqczqO367E:Df+9gmnO2Y1lG3QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630676206, "uuid": "4625844e-03a5-42ad-91cb-71a38b313cd4", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630676206, "uuid": "a7e1cb2f-3e6c-44fa-9f8d-8d66613b65ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676206, "uuid": "9a5cc57a-065a-41a4-8155-970f258d8f23", "value": "Specimen copy.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d483db28-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630660249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660249, "uuid": "bc0baf21-bca6-4457-82c1-cd9e4282c6d3", "comment": "Malware payload (NanoCore)", "value": "6b7f3e0c2c5fa3d7683f1c2b3af3c1d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660249, "uuid": "a6483cb3-ee1a-4495-9dc2-fcf1dcbeed13", "comment": "Malware payload (NanoCore)", "value": "4f21ab65d432de2cf873d496e6a54514e12c62f4cc12623cab84f001b7380cb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660249, "uuid": "33411640-240b-4eda-82e2-77e13505a7a2", "comment": "Malware payload (NanoCore)", "value": "b2929e15aa36a731b8976e10d27d9d0f5ef19f54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660249, "uuid": "ef070acd-e2e4-451d-84aa-314dbfaae06d", "comment": "Malware payload (NanoCore)", "value": "a14e749c11d019e8f047a23934781ed1136e77d8fc2cf77b5f91a055392458a982d45012cb06ff5c36885522ffb37902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660249, "uuid": "63f86a6c-4f1f-4459-a8d9-994a2ae9bf3b", "value": "T176E4F101BAC55571E6B22D3159799A20593B7C200F38CA9FA3DC596E9B335C0EB30BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660249, "uuid": "b6272e70-5b58-424a-a0f9-86a3149d17b7", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660249, "uuid": "f72a9d5b-f69e-465e-a1f8-d6b67f11dff3", "value": "12288:IzxzTDWikLSb4NS7t2X+t40XRkeaJSTtlHBZwjKOfPHJz5kgY:+DWHSb4Nc0sPaJettnd6JzOgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660249, "uuid": "c01d8b0f-09bc-47fa-8e10-425a0306325a", "value": 658266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660249, "uuid": "9ad94aba-3384-4e8c-af60-25c5139e09ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660249, "uuid": "b07f449e-46fd-4e6a-a833-f244c000c8e4", "value": "4f21ab65d432de2cf873d496e6a54514e12c62f4cc12623cab84f001b7380cb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9a80de-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1630655462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655462, "uuid": "52799a31-5af6-403c-8488-b79eb88a4850", "comment": "Malware payload (Adware.FileTour)", "value": "f3c58fb85a3d39ec45a78b7fbd11021b", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655462, "uuid": "eecbcbdd-7f25-4e29-87a5-e210819da36f", "comment": "Malware payload (Adware.FileTour)", "value": "4f4c2c9bdfef8a8cfbe2c8f84bf12cc86f26f59d54c277dab39f4c5e92948708", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655462, "uuid": "4ffccb75-e4a7-4a67-a3a0-6f28dc5f85dc", "comment": "Malware payload (Adware.FileTour)", "value": "473d3c0eba1155217fa21dc8b35155516e52acfd", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655462, "uuid": "845bd975-cef3-4d3f-9166-aabbbf28ca8c", "comment": "Malware payload (Adware.FileTour)", "value": "24d90c5cc03201d328c545eed795086b58272c6c92bc216a03ddb34fb145b95802a43663549544dda395be902945a690", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655462, "uuid": "321e04e4-c199-47a4-b517-d7574f44c0b9", "value": "T10246330B9774F464D0ED58F22AA0107F822FEA8332A92F5D173CC6557B12189CB7B9D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655462, "uuid": "ad67430b-2898-4d9b-889a-5e16dcf82db4", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655462, "uuid": "01e126aa-fa99-412a-a76b-51bddee48d2b", "value": "98304:ynUkfKR13D4XPDTc0hoIumxB0oY6O239uspBT9uzGiKN2yUy+eS16w3ajw26A:ynUkfK7IDg0UmxB0UTpTAGlN2DRr0wqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655462, "uuid": "81ed2641-db6c-4321-ab0d-30b5dc3fadc9", "value": 5481454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655462, "uuid": "642098c7-e076-4200-98e2-bba3593da2d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655462, "uuid": "417144ef-2cbf-4b86-929e-95c10c2a8eea", "value": "F3C58FB85A3D39EC45A78B7FBD11021B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bed261c-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655644, "uuid": "3aa9d532-8e9f-43f4-a41a-0a3bb21012e8", "comment": "Malware payload (Mirai)", "value": "f5d08bd0d629633babf34464f1cfcb55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655644, "uuid": "a34d67e8-a74d-4d71-9673-84dd75755447", "comment": "Malware payload (Mirai)", "value": "5325b6eca07da0d710e719f8563f07eab48e8cef84244c409c6fb644a15fff68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655644, "uuid": "971cdb75-9a3b-455c-afe7-26b9774d0fc1", "comment": "Malware payload (Mirai)", "value": "b423f2d98b04fa1f9ab8f156da5474bfbbb421fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655644, "uuid": "c2bf3432-7bf5-403e-9213-899e5e66322d", "comment": "Malware payload (Mirai)", "value": "ce3c3de345fa4b30dbda4bec2539c751e12f12e01bd636a2faea1833b0ddd578a2262338d73096dc80c5ac6a8845401f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655644, "uuid": "11fa9228-e393-4e09-80a4-b9da563ecdb2", "value": "T124734A4272280B57D59309B02D2F5BE187BFEAD024E0B684695FDB668636E371486FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655644, "uuid": "6d9282a5-3175-4d41-9c90-120caf970419", "value": "768:0JIFgfWbKRyBOHCFmONm4nC1bs6C5EDyLHGzF1PVxj0p7DGeLHyem70Tqad81tNe:wIFgYKkC1bs62fyzYGeqE8lkI9wDnzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655644, "uuid": "5fb3c995-b799-4338-9d8d-3208b11ead5c", "value": 75824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655644, "uuid": "a9bb9195-f939-4925-9c56-5790df87e5c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655644, "uuid": "60d46f19-6343-4623-941e-6cf6407568b2", "value": "f5d08bd0d629633babf34464f1cfcb55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2ac5d1-0c6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630641172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641172, "uuid": "1c579ef4-b976-41d5-a9ae-00c4662ca19f", "comment": "Malware payload (Mirai)", "value": "e9c5e43108cb275a22108f2dfdd2475a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641172, "uuid": "b72ad2f2-4917-49ee-ba89-d025d9fb1c26", "comment": "Malware payload (Mirai)", "value": "54114db332b257e586e05d8e70b81438e69eb8e3852a45be4974faa26931afe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641172, "uuid": "33f4f456-a632-4ecf-88e1-4193eda9e857", "comment": "Malware payload (Mirai)", "value": "a97abb9e989f6406bf620a422d6d66b98fe80bf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641172, "uuid": "ec5f3394-6c50-4ebf-93cd-bcec4e09063f", "comment": "Malware payload (Mirai)", "value": "8cd96ec93c7e095d012b136bb461b9df4568548970f56a7e5174e1e7e343e860b3079775ccac7ac2e1a7e3aa94030d5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641172, "uuid": "d058d46a-2903-4511-90b1-fff84fd44289", "value": "T1FE83D71B6E214FADFBAD833447B78E32A75C238633D1C685D56CDA001F6024E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641172, "uuid": "fbb2b139-82b3-4593-9c67-c2b588b76cc1", "value": "1536:BhvM+l6S6o6k6We8UEg6ahSSdpsNQ5d/wTgLTzmenP8EM6:BM7KQ5d/wTgTzZ8Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630641172, "uuid": "d5e30f11-dd0c-4aad-97e6-a61cd7e4b73c", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630641172, "uuid": "23886d27-1efc-4ddc-a919-e3a06f3182ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641172, "uuid": "dec769bc-9079-4fcd-970c-a03cab27f209", "value": "e9c5e43108cb275a22108f2dfdd2475a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be9dead-0c69-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630640800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640800, "uuid": "08e1d079-d32a-4064-b128-01251f08a1f4", "comment": "Malware payload (Mirai)", "value": "ce7380764d51c8b11a7c095e12d78e68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640800, "uuid": "42ff2d2c-23a3-4a18-861f-e2989cbd2d72", "comment": "Malware payload (Mirai)", "value": "542efc27087d1317e69f3f5211f666bd112cbc1adc4e683fdd6df0276e531a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640800, "uuid": "d8b593dd-d759-4458-8674-fd748b1eb027", "comment": "Malware payload (Mirai)", "value": "34cccc7799b4c68b1e246974cc4b6f6ab2349b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640800, "uuid": "97acf394-211f-4c98-a017-e0e244bbbfb4", "comment": "Malware payload (Mirai)", "value": "3238d178c7d37c3d45439667aa458824c3873f78941988b9aa72630100bf6ae14f89dd24955d73b3e7be5416e9647ad6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640800, "uuid": "d250a7e5-b0fd-4d45-a23c-b372aba61d0d", "value": "T1A8633B3576311A23C1E6A67E61B34731F2F5674D2CB8CA2F3C621E5CBF616802162F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640800, "uuid": "1794e61c-f0ee-4f7c-a34a-252af5e42c5e", "value": "768:/A/pRP5IGyaLzEgpJDJXg+JeOKPmh6jWWdxVO+s5D71rrxo1A1tGwbVCIqV:/ArP7DLzduds5P5XtPgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630640800, "uuid": "1e81b651-dee5-44a0-8317-cc3aefec6bbb", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630640800, "uuid": "55a9b100-9f33-476d-8ff9-b6c167318708", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640800, "uuid": "66be878f-70fb-452f-ba68-fbc7c0833d49", "value": "ce7380764d51c8b11a7c095e12d78e68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de28ef10-0cfe-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630704933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704933, "uuid": "a29c5ba0-cde2-4b66-8e45-132bb8b36986", "comment": "Malware payload", "value": "7dd46656a988d8b05cf41486ff90e6aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704933, "uuid": "38808fc3-9f7c-4de3-8521-b0c971656f5f", "comment": "Malware payload", "value": "559cf45c1df3cb20c47fb4a9dda11d5f550471f3063bfd79883e98aed990aaf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704933, "uuid": "97645899-1a03-498e-8e45-7858702f5d09", "comment": "Malware payload", "value": "6367dbb7c43ae24d9d131c174036d29949f71b7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704933, "uuid": "62ff01fb-ba12-4bce-9215-208990df52ad", "comment": "Malware payload", "value": "e1d8dc534caf9808ac3d71dacebb7e4513af9b13695004f03dfae45c6208b9e1597aa9714cd5ce4dba3436260b89b0c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704933, "uuid": "1d0497d5-fe69-46dd-8887-3f48021d3417", "value": "T1AAF5E3D2552AC85AE0CF2B35E91AAEFFC083DE24D311581F15537D0A7CF922A472E46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704933, "uuid": "61f74f8f-f104-4a06-b9bd-4ae6118cac2c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704933, "uuid": "564f2d01-84a8-42b8-8f75-9000402b4a43", "value": "49152:Pcw/P3vIldH0fqaMSGNJ+51Fd0u0+jNb3XGIgrsmUbzhNC75:PtvqdKte+bFdn0+jNboUJNCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630704933, "uuid": "9282d1aa-452f-4e5a-8052-939d89e6bcc0", "value": 3636936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630704933, "uuid": "4015c875-bfe9-4305-8bbf-5de09255ecf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704933, "uuid": "c7af5a5d-a10f-4a39-b7f2-fa578f81f9de", "value": "7dd46656a988d8b05cf41486ff90e6aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4b298a-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630659864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659864, "uuid": "bd315202-dc2a-4210-968a-91e5985afd6f", "comment": "Malware payload (AgentTesla)", "value": "ed52689af1d3fd22b994ae611502f846", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659864, "uuid": "f18e1a0b-6849-4e41-95ab-976f1a285ef2", "comment": "Malware payload (AgentTesla)", "value": "565e856482246139a5f07be019a334bbe9b8e5174f46d233b174d97eb0e7bd82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659864, "uuid": "1dcd3c80-20ea-4885-913e-b74d6073e793", "comment": "Malware payload (AgentTesla)", "value": "2fb365c4de8ddb8d74ab7c12096cc4d052e6327f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659864, "uuid": "d4bfe064-ad2c-421b-8ad3-8f49bcae28ad", "comment": "Malware payload (AgentTesla)", "value": "ed3eb4eba620f78ba974131bb64c608c9b6b76d6012ea81fe9cab540bdeefa60fb013adc5cf0678150b6e63d7f956de0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659864, "uuid": "83bc39f4-6e85-4d03-8962-d81de3b52236", "value": "T1BDD42370AE88648758D705403DD9FB38C50E512CCC327FE9A3A62B45E4B9C2DBA29777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659864, "uuid": "7052a599-0797-4b16-82ca-14da85613fd5", "value": "12288:juEpTEb2iUVZXlWKRiLJreWdTGgFjtS2afhZna5/b8Mbd/FIjkhz+:jobKWkGDCgiJGB/HB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659864, "uuid": "d43ac5ed-3921-4d0b-85a6-ed41cf373620", "value": 656049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659864, "uuid": "da78f121-183b-440e-891d-9d980a410079", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659864, "uuid": "f0d53ddb-5d82-49c5-b88c-c7a59be6a5fe", "value": "Download All Attachments [NEW ORDER].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9f4d9f-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630654738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654738, "uuid": "f3e8c5b0-3d29-4fcd-abbb-97efe12c6298", "comment": "Malware payload (AgentTesla)", "value": "38e40fa0552dd4b13a4499821e57a3dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654738, "uuid": "9c91146f-c274-49f0-9671-5e8c95a4c8d7", "comment": "Malware payload (AgentTesla)", "value": "56ce41513fcb85017d9b3cfa32c31dc6f50bf0886242aefd78bbfd91e1aaa303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654738, "uuid": "cdd806f2-2695-4d1f-abd2-820662b5ad1c", "comment": "Malware payload (AgentTesla)", "value": "9ced71bb897bcddaeebf959392f35164ee172bc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654738, "uuid": "7975b6af-391d-4ec5-8849-5afdc6292a48", "comment": "Malware payload (AgentTesla)", "value": "1113a5ef8e12797cd2caed6eff8744267f7c723e3cc6deaf35fb8c6876d22269d36988f4d1a671b2443489b146a8aef3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654738, "uuid": "4e346c4a-9c47-413f-ae61-c3400be8d4f0", "value": "T17EE41C3E58FE23279176C7D6CBE58827F6C098AF3233A96467D747254316A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654738, "uuid": "daa4f228-6546-4aa3-9bfc-9236809a2b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654738, "uuid": "62af549c-2f58-41a0-81f1-d0a6dbb69995", "value": "6144:WZFJLgGNFpse7dCSdBg7eNv1vxsFEm54oRIP/acJFQqm70KFYL047r+U7d1eLrMm:OtvdWCv1JsFb4hPScJPKFM0cyeUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654738, "uuid": "48007bf7-05b4-46e9-bf74-e9bafad4f511", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654738, "uuid": "0b8e06ce-ec17-48a0-bb09-cff8281ae97c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654738, "uuid": "9f51311a-9d68-426b-9dac-7ea7a94b3b96", "value": "38e40fa0552dd4b13a4499821e57a3dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954d4518-0c6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630642963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642963, "uuid": "e55778eb-a076-4025-97f9-1406279776ff", "comment": "Malware payload (AgentTesla)", "value": "aa10ad52f726cc12e7d90852985545c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642963, "uuid": "759b8113-efb0-483e-a6c2-88b63dada066", "comment": "Malware payload (AgentTesla)", "value": "56e64a112104a4bceeec030a7a5a2b6ef64dee29f9acfd28ab55cb00f906fd26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642963, "uuid": "7f186c14-f0c8-45ea-9bd3-a2715188ce3e", "comment": "Malware payload (AgentTesla)", "value": "ab4449a11a68c77e167dd95155a06edc8fed45c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642963, "uuid": "aee12964-f20a-428e-8e40-14b105e02d55", "comment": "Malware payload (AgentTesla)", "value": "ba1a53b31067a5e2e1cb5f29cf23a9801874536c4882175b079d600f41d5bd5f230d0b6251e6ef97333a4edf87c1c33d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642963, "uuid": "471c24a2-6ddd-428e-9797-21e77d55cc38", "value": "T1FFE41C3E58FE23279176C7D6CBE58823F6C498AF3233A96567D747254306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642963, "uuid": "b218e039-72c1-4a9f-a129-b7930829f2d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642963, "uuid": "e0febff6-62bf-4305-8e6d-0dd6fd4bdabc", "value": "12288:p/c1viXHdTWnni7XCZEO/qIyQOSslcn5LNh:p/c1aXdci7g/mgslcnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630642963, "uuid": "646e42a5-ec30-4e4c-9530-8aa88cf97029", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630642963, "uuid": "96aa8292-c327-46cc-8b55-fe9b3d1f2640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642963, "uuid": "9663e5f0-c797-48ac-802e-64ad7807fbe1", "value": "BCuGuKnqA4EyRGe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1cd9763-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655976, "uuid": "06585351-5a29-498b-898f-ebe14aa78b44", "comment": "Malware payload (Mirai)", "value": "d11041788c1085ff9008b4f35b5c62ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655976, "uuid": "b2d40b29-8cb2-4749-b752-eafc7045c6b0", "comment": "Malware payload (Mirai)", "value": "56ea704fb4d5f6a405c2433460a958d1c420113304f28baa7606cd8401e6267f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655976, "uuid": "8fb0e95e-9fa1-4919-a9ac-15b047abb84b", "comment": "Malware payload (Mirai)", "value": "d11ff5fcaf69769726968986dbe8609e8c14d0d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655976, "uuid": "47f2cf38-44ae-4ac7-bf8a-902d3a335cdb", "comment": "Malware payload (Mirai)", "value": "bbd05c143af936f3d0c7dc92a72c6f0af9d87f16b87ec3a3eb32c1a30afb2c7300898a7065d26fabeaf8dea2bbea55a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655976, "uuid": "8c407218-f81c-4472-883e-6106ab327152", "value": "T1E36339C0B943E8F1DE1616742067FF375A3BF2F7111AE98BD3E4A923AC42A41940769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655976, "uuid": "537b4f65-a7cf-4274-b13b-dcfdc441fda0", "value": "1536:yTmzDttn+ofhw63xq6m7zRRkyTQ2IwKTmChsUoLFBH04leWvTzXtGtxSYCNyW:Z3Tn+ofhw63AQvjTuUon1lvHktQjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655976, "uuid": "c112d339-1e26-4824-8b88-fae1cbf23668", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655976, "uuid": "9eac5790-4bcf-4d77-89ed-9df9d747e0a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655976, "uuid": "73157814-8dfb-4cc9-8884-a2caf884e0d5", "value": "d11041788c1085ff9008b4f35b5c62ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f950e4-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1630660327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660327, "uuid": "969f7a3f-ee63-4378-8957-5a273040c53f", "comment": "Malware payload (Tinba)", "value": "4b58ae42ecb6cfaf2faa83fd4ecde466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660327, "uuid": "43a4c3c5-c373-47f7-b08d-98b3529b2d04", "comment": "Malware payload (Tinba)", "value": "585cf15c667a0e3b4d3d328a962aa012c09298fdc084e2d69a650c0d1d5a258b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660327, "uuid": "5037dca0-840c-4196-9503-389b6fb9db36", "comment": "Malware payload (Tinba)", "value": "490a9ada171c7a26ef0d72d36cb699314f47c4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660327, "uuid": "03967f5f-9ff8-4409-9e07-491dbfe29273", "comment": "Malware payload (Tinba)", "value": "044cba85054febd86428954430449df05f61d7efca3ea86fafca447c6b2f6d260e1f5c6c4a8e0fbe3fe600c447d5bec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660327, "uuid": "287130f5-795e-4fed-8d2b-7bb8da16f08e", "value": "T1AE84F827A589A2B6F4F34CB2174FA2B2A1719B301714D643B60C5F6AA7703D1E5283DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660327, "uuid": "bf6244bb-e23d-4290-912b-2e08e8b6f70e", "value": "d0faf1f829379ff4f83833223a663610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660327, "uuid": "a96a75c3-a933-4b82-9d91-791a79711d10", "value": "6144:uCE6/mUXJ531nIUliViSZbLhaZfvMlLXICgc:m6TOUMBQf0ljWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660327, "uuid": "a4c6712d-4048-4e2e-b62a-5754218336a9", "value": 379858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660327, "uuid": "3c7d7cb8-17fd-48f3-aab3-136dd04466ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660327, "uuid": "9db37579-dfa4-44ee-a749-db7cce1a70c4", "value": "585cf15c667a0e3b4d3d328a962aa012c09298fdc084e2d69a650c0d1d5a258b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafd83f2-0c78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630647348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647348, "uuid": "113dd52d-2c87-4163-8054-0bef64a2be89", "comment": "Malware payload (RaccoonStealer)", "value": "f2710804050ae52b971441e51ceb44f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647348, "uuid": "eae086ef-ad24-4b48-9a0e-5d6fd6da6840", "comment": "Malware payload (RaccoonStealer)", "value": "587e0fb4dfa654fa10eb322756fee3ed5fb0d7c5e903a0f3e97812a821d8f13f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647348, "uuid": "cce2c26b-f233-4fc5-85a2-1b815c367567", "comment": "Malware payload (RaccoonStealer)", "value": "1fd3aff485b9af228894a560cfd6f6f9eb142b17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647348, "uuid": "69da8b6b-376e-4938-a393-ee98628ce12b", "comment": "Malware payload (RaccoonStealer)", "value": "9ad9d123bc7ef33948acf8d01231cc85bf7c001fff34762deada640c3cbad88771e77d58248ffedca03a89cb27a82fdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647348, "uuid": "71b4e6b0-8374-4237-8bd8-b502af1c87bc", "value": "T16DC4E020BAA0C435E4E713F558B987A8AB297DB15B2440DF62C637AE17346E4DC3067F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647348, "uuid": "0b409050-813b-48f9-b51a-e49ce4344c46", "value": "f98082b3dd4af392746814cb64f8deec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647348, "uuid": "bea92f88-c14a-40b9-97f4-21331d708720", "value": "12288:ajIN5UY0Hw+7anByTaLxeLMWYi8kFcGD6ROEDdMIwJpewcinYXaKmV6:hUY0Hw+7/MWYWmGD6RODpezinYXa3V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630647348, "uuid": "552ddc74-5ee8-43b2-b129-87c81a0d6cb7", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630647348, "uuid": "5963aac2-aae5-4938-b29d-c061f0d0cc8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647348, "uuid": "36394cec-5a3d-448d-9ab8-6a843b36488e", "value": "f2710804050ae52b971441e51ceb44f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d3ac6c-0ca5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630666752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666752, "uuid": "cb7987f0-9e19-4b4e-8815-042eda607a36", "comment": "Malware payload (AgentTesla)", "value": "dffdcf20552daf8cfd494b24b6734f26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666752, "uuid": "89a7e0e5-3afd-4e71-bbe3-6080260f0f98", "comment": "Malware payload (AgentTesla)", "value": "588cf49880e13ebf52438e8377d7c959fed298143f7a9fcc000cd654cb01e778", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666752, "uuid": "2b52174b-32a2-4d0d-9c60-422b31e4de49", "comment": "Malware payload (AgentTesla)", "value": "db5ae10955b0743f89a7664471462fcdd83e49d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666752, "uuid": "176db70c-b788-41c6-af77-10c7039e0305", "comment": "Malware payload (AgentTesla)", "value": "429a5a8d786bc8c4b95542ef0c3d2735f93ef1f5321630186ac253feac35a9b8ecd2e94834768b474f46597451ff9955", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666752, "uuid": "3d3eefd9-c457-4d07-9656-87197460816a", "value": "T112A4CF9C765072EFC867C936CEA45C24EA60687B531BD307A45322AD9E0D6DBCF124F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666752, "uuid": "29d0959c-b6db-40d3-a5a8-210fefc766c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666752, "uuid": "4d115910-ae82-4f75-a507-52a20bf486e3", "value": "12288:y0cafVVIoKM2QUZ4G5p07maVwlpl+zroYzRg:y0cafVVxvUyGn9uwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630666752, "uuid": "9bf7e23e-8292-4bf1-9d8a-45a0c5e120f1", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630666752, "uuid": "59b3caca-5959-48c4-a2ff-30deff32111f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666752, "uuid": "f56725be-aa5f-4b57-9d04-5de64f29fa05", "value": "NEW INQUIRIES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec0bd96-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630650361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650361, "uuid": "b5c25f42-5b51-4cc4-b3aa-6fcf0dc31e72", "comment": "Malware payload (RaccoonStealer)", "value": "dfd9bc8144e3d01171554a89d4f52d10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650361, "uuid": "ab4b4a47-cf94-441e-aae5-c61757fbea3a", "comment": "Malware payload (RaccoonStealer)", "value": "58c665dff711329bab255eef59173bcbfbcb12ae2d69689be53efa9370898c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650361, "uuid": "68991524-3c1f-4064-87f0-11a14c236c34", "comment": "Malware payload (RaccoonStealer)", "value": "723920e85644e4aacf70e94d24000732ef6ca417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650361, "uuid": "9ca8951c-3d42-424b-ab78-a4fea6c8ffcb", "comment": "Malware payload (RaccoonStealer)", "value": "358cd07dbbedeed4e02a9f74a089154161a61659f872f5421cbf2f201206eb1833174233bc6fd925df2fdb62ee22e42b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650361, "uuid": "b6d1cb20-107b-4888-a890-29588d652671", "value": "T10C149C317A90C433C592CA30DD36AEA5272EBC725974854BB6743F1B1E727C1AA2235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650361, "uuid": "32a746fc-7437-41f4-b3ab-07febd7f92fc", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650361, "uuid": "a04c9126-c701-4281-b37b-9893e74c171e", "value": "3072:xOhNpL8YFlduqYTSVPGSmiWvAk5y+E+x9ENPGdwDYTuKJIX:UhPLBFPuqYTSVPGSAvQ+E+xMGd7TuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650361, "uuid": "1f550448-7c8a-47ce-9eb1-7592db8ab2c8", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650361, "uuid": "91cd385a-12e2-4758-82cf-78bf1a1f36ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650361, "uuid": "4b7b51ca-d6cf-4f03-98b5-9c89434257fe", "value": "dfd9bc8144e3d01171554a89d4f52d10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6198cc-0cb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1630673200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673200, "uuid": "03c81e2d-649a-45b5-8849-1497f3c32415", "comment": "Malware payload (OskiStealer)", "value": "f74835fb2a70f5720f4f2d5f929ab270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673200, "uuid": "0c874bfa-7a08-4274-b342-e27c69178c00", "comment": "Malware payload (OskiStealer)", "value": "5953d0e6904dcb824fe1afde62ed8c2e2266f9f074514d395a31b759013e846f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673200, "uuid": "14e63a9d-031e-4630-a05b-a28f3a7ccdb0", "comment": "Malware payload (OskiStealer)", "value": "cbb12968b09aca5d61d62590216f2fa157f0f187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673200, "uuid": "254724a5-18e6-44c2-afd7-b0f82ca54b0c", "comment": "Malware payload (OskiStealer)", "value": "084efc5ff474c2c31468b8e5d79c55069e964cfbbd16cd6a48e4edb3a136d5b8d06fbe54f6da983c4db5e339fa3542ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673200, "uuid": "b529a796-358e-4334-8339-6d86017e2166", "value": "T179146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673200, "uuid": "1dd833b8-2f8d-4694-87b7-0d9406adb8db", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673200, "uuid": "dea8a2ae-814b-480e-abe3-3d5326b56e15", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIm1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNf1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673200, "uuid": "aad6f2a5-5c89-4715-94c7-2ca6bbea9de1", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673200, "uuid": "ec546f7f-327d-4973-8424-f34fae705a3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673200, "uuid": "02e314b0-c84a-43ef-80b2-f6e2dffac76c", "value": "F74835FB2A70F5720F4F2D5F929AB270.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9061b96b-0c7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630648538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648538, "uuid": "fcd31203-0f37-41d1-99ff-27071f01573d", "comment": "Malware payload (RedLineStealer)", "value": "f19ea8b8132065599887c7fb760d48ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648538, "uuid": "073965ed-c3a3-4fd2-90f4-2ba20c1f1928", "comment": "Malware payload (RedLineStealer)", "value": "59b6e6fbe133319e646e4c88d3d9bc4ad0259dc96d4d2cd97b227bb9b7da6bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648538, "uuid": "6a5148ce-a569-45d9-868f-f881d2d41653", "comment": "Malware payload (RedLineStealer)", "value": "24d6d6a384a43c5a81b25ed2c2ddc80bba708c3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648538, "uuid": "c645b48e-cfd7-46c9-a08c-2d1b9d6f140e", "comment": "Malware payload (RedLineStealer)", "value": "4daaa2f82c40846564450345549ad34b5000e7f44a1ce1140beba1bb9c6f3a33b7b684405c7d567bac3c1bf5b56ea0b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648538, "uuid": "de372bde-42d7-430f-91b7-ece37650f9be", "value": "T18364BE30B6A1C039F5BB11F469BA97B8A53D7AB01B3550CB62D11AEE53346E8DD30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648538, "uuid": "abea61e8-e918-4e23-b9b0-3276a772272b", "value": "f841f9dee1a38a44fd841e38a1e2026e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648538, "uuid": "c287d838-bc8f-4877-8104-cdb30929a57d", "value": "6144:F5XCDF+sWxc9Lw3jARsgACchZ9L8qafqLsNW:gUsWW9LAAegAvhr0qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630648538, "uuid": "f3017242-4cd9-4961-89bf-ac43ebe78160", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630648538, "uuid": "7d306a0e-ba64-42c7-b329-8a7aecdc78d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648538, "uuid": "7379dccc-d1d4-4ac1-b8e4-6a06986cd8e7", "value": "f19ea8b8132065599887c7fb760d48ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26b0584-0ccd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630683841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683841, "uuid": "8d0fb7ec-7391-4e2d-9592-c11c130864bc", "comment": "Malware payload (Formbook)", "value": "93b16b2225201835d9fe1a4e23ae0d2d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683841, "uuid": "1ed558bf-4ddc-46c7-94fc-e5b19ef2f729", "comment": "Malware payload (Formbook)", "value": "5b4dacdaaf4f3f3913acb3507196147f494df5f5d02056e98d0593de7b6d281f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683841, "uuid": "7c0dc670-1bfb-431d-8710-2a763f32af57", "comment": "Malware payload (Formbook)", "value": "a1c3bb28104aff5f1c17f51c1b796e5d82810c91", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683841, "uuid": "6ecd21d1-d6fd-4845-81b0-01e44ed4479f", "comment": "Malware payload (Formbook)", "value": "4f5ff400507136fdc28f822e9815b982c5ea1d0bfe985ca3ecc47f26a7a779f4e43de0c18667bd9674decdb9283ea46d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683841, "uuid": "4a9a891c-1c89-412a-8597-df8b7b6bed2f", "value": "T1E992A7ACC4A706E88F82A7B82B2B5F80018DBA2DF755D63375749B3117E2D7A501787C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683841, "uuid": "21d7d8e1-5591-416a-9e72-a3492e678485", "value": "192:o/hS+/AixJ+Kl9vV4WsVdhrquqwN+Q3N2JP6mmc268vc9wIOnzHu0Ob+yLj8vq:iSIG+IVfJq0x3N2+cYvqw5zHxLy38vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630683841, "uuid": "2d6d927a-7a9e-4326-9f4f-e5baba4caa01", "value": 21031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630683841, "uuid": "75f8e0f0-085d-4a08-a13d-256c08931232", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683841, "uuid": "33946973-d3f7-4f73-aabc-a957520f852a", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39be4a6f-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659989, "uuid": "024b53b6-8973-4dbf-b216-eba63b56d902", "comment": "Malware payload (Stop)", "value": "de2cd31d8dc7aba990f205d3da4c0da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659989, "uuid": "17070e55-af23-4a9f-a74e-677b0c545b30", "comment": "Malware payload (Stop)", "value": "5b5331bbe40482291d20d031dee20e02574bdc55c9547bf1cbe0abfd5f2cfafe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659989, "uuid": "7742f2db-1aa3-41e8-962e-b47ce62912f1", "comment": "Malware payload (Stop)", "value": "e8699762af58af798468fa60aa7c4f50d37e1ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659989, "uuid": "682c0021-63fe-424b-9435-80a33d38fb9a", "comment": "Malware payload (Stop)", "value": "d009972978fc473c603d4f45102f3fcec8d2be205224a918d83d790b641a9276f543aa92637a137df87a1c666f61f5fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659989, "uuid": "fd7e331e-7966-42ce-b199-aba36513ea62", "value": "T124F423627AD0C033D6F2A5708E994DE4963FBC7568345443B67A3E6F0C72292A91B34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659989, "uuid": "cd56ed22-d716-4057-a3ad-68a616fd764b", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659989, "uuid": "c9573580-2574-4187-a2db-a0e3d5386e0b", "value": "12288:p3a6RtTzmnvuyMKxr7fVACth0T22NEP+9TsjwhrSKn5VoZ4mIVsXXIt:QXvuyMKptACDc2DPhjInI4BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659989, "uuid": "f4939825-8557-44d5-b58e-44e4c6e98474", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659989, "uuid": "f393f62d-8915-45e8-a6e2-cba8c61832c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659989, "uuid": "e7a67363-b39e-486f-a097-a07bb7c3d978", "value": "5b5331bbe40482291d20d031dee20e02574bdc55c9547bf1cbe0abfd5f2cfafe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa999b6-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630684203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684203, "uuid": "fe0135f6-f83e-4a0e-a083-393c42162d8f", "comment": "Malware payload (Mirai)", "value": "22600fc9da6d62e7b6ee899ba0e81844", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684203, "uuid": "23ecbf97-9dbb-4dd5-926e-ea52351c5b29", "comment": "Malware payload (Mirai)", "value": "5b9e6933cba87df85b2b62c08d0abe00763dbe336c0e286568a4a4340b1f7cd8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684203, "uuid": "aa190038-92cc-402c-b59a-3e039fa71a94", "comment": "Malware payload (Mirai)", "value": "477e9f3c429abc60d4eefd847034b2de93d81f26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684203, "uuid": "ac76b370-cc0f-404d-8462-75b03ac96d09", "comment": "Malware payload (Mirai)", "value": "954d6c215272b3c196146ff2cf447b75741bdacb17811b4de4725db22fa788ef7d418ee456ff91ea7f34c2e7034a07d8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684203, "uuid": "ef28d73a-f720-4c44-8f53-2c434249f4d0", "value": "T1BB334AC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684203, "uuid": "390bab83-ea62-4b82-963e-7295bcf5ea80", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNf6OQ6xpwhNbr/i:xZebkP/Ad39UMJRlhNSL6bIbDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684203, "uuid": "680e5b9a-31dc-4836-9f7c-12206ee23ca7", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684203, "uuid": "a512b42f-4274-4bc6-a4df-f7715d0a2736", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684203, "uuid": "d4b07b4d-e835-4ecd-b585-d294aba6f773", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7b655d-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630674808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674808, "uuid": "b66b286c-af69-49ee-9af8-2bec725024ba", "comment": "Malware payload (Loki)", "value": "555b31e37f565369fbd8b622fb81fa21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674808, "uuid": "dc1e9c80-3c99-4361-b745-a3bf3106c821", "comment": "Malware payload (Loki)", "value": "5bc6fe9f7b69fd7527ebca763130f35e8edcddc1666d11ab87c1d56984b70b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674808, "uuid": "15bab38e-548a-44a5-a4f1-edb6f51f9af0", "comment": "Malware payload (Loki)", "value": "9c532bf17d43a1edf7f46d5ca137e6eed7f350ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674808, "uuid": "89b327be-4223-4f9f-a6a6-61b9f76474bb", "comment": "Malware payload (Loki)", "value": "e92032e07efd7d7f99a694851cd24b7ad41df70c9548dc09a6dbdb3adc383b53dfe00837a7036f1c1268ca7f113e2929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674808, "uuid": "fd10b4cd-672b-4716-98ad-f8840f73771d", "value": "T18514E636B781F42EE082447DB919EFA55464393029A8C453F7C2AF1B38715EBDA25F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674808, "uuid": "d3d70d6d-7357-4bbf-ab47-2ac97cd6ea3c", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674808, "uuid": "255de6b7-3d9b-4864-9f69-9a52ce505c7a", "value": "6144:ewEfD/i1lkemVTtOASZNaEz2tEWu3Fil:0metOfNlWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674808, "uuid": "3b6289cd-fc02-481e-964b-fc72a2a2abb8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674808, "uuid": "06b50954-867d-4076-be8c-27fcf8423484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674808, "uuid": "2e341126-519e-4b58-b833-e6c7ce000332", "value": "Doc_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2b31bf-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1630659995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659995, "uuid": "d04bcc3d-1b25-4cb8-ba45-876ab6d045cd", "comment": "Malware payload (DarkComet)", "value": "806b65a2f241146d01b77369371e59f6", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659995, "uuid": "f38422da-76a5-49f5-ab03-32ef80ff7f27", "comment": "Malware payload (DarkComet)", "value": "5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659995, "uuid": "f7307858-cf7d-461a-9727-3c11832681a5", "comment": "Malware payload (DarkComet)", "value": "f95281954408ad3132235c0baa6f75ae00cd748a", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659995, "uuid": "13f83ff5-480b-4ddb-a299-db81e09290df", "comment": "Malware payload (DarkComet)", "value": "4cedb0b5aa20fc2aa2943edc2ce45c7e27b12e64312f793abc751d2a5908edcdbba16b2b84f418e6ddf7fc74dadcccef", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659995, "uuid": "33291afd-80e6-473f-bf97-95269e516ed6", "value": "T115F47D31F5808833D97219B89C5F92E5582A7E202E29754B3AF63F4C5E391C37D1A2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659995, "uuid": "bc2b3837-1703-4046-98c2-040f0171ef0a", "value": "009023b6b22e202aa54365d2270f6f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659995, "uuid": "0f01bc8b-eb23-4ad6-b286-c598278ffbe0", "value": "12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hR3:jZ1xuVVjfFoynPaVBUR8f+kN10EBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659995, "uuid": "a57ff066-5c4f-40a6-924c-9983cd6ac32d", "value": 740160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659995, "uuid": "26e29dd3-36cc-4645-b62f-c360e5cbc080", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659995, "uuid": "161db1f2-50c3-4405-8f60-ee78e5246e37", "value": "5daf38ba7d08872375f14a3d8de794d20aa37e1caeda4da0558e2a9cd4ed668a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb38aa63-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630654703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654703, "uuid": "71a3a2fb-c176-4473-b003-c4bd0a292f6b", "comment": "Malware payload (RedLineStealer)", "value": "2f6da982c9de028231701b84a4be4be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654703, "uuid": "2db9951b-243f-47a4-b6db-01a9d529e2f7", "comment": "Malware payload (RedLineStealer)", "value": "5de532ccb75a66894dc0019f8bd295d0679ab92f25019e31bca23f408e3af4b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654703, "uuid": "510199cd-a909-4016-8893-a9a905960fe1", "comment": "Malware payload (RedLineStealer)", "value": "7c1ee8cf9f6b95746b7cdcb1a3e74fafcc306cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654703, "uuid": "b80ffc72-5319-428c-a21e-617faf33e4ce", "comment": "Malware payload (RedLineStealer)", "value": "bc37945ccb85d542f89bb093e7ec842a8caf63e23560c55ea1351d780ae9236015544749d843244b2ef11702a60bdd4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654703, "uuid": "8c6d79f5-71a8-404c-acec-dd99ec39685f", "value": "T13954DF3166A0CC33C1E2CA7059658EE5163EF821596481CBB6353F2B1D7279D9AE332F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654703, "uuid": "850c3284-0841-4ee8-9b8f-61f9358b9b3c", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654703, "uuid": "f913d061-1756-4fa7-8ba5-483308ebaec4", "value": "6144:mP77LSdrZb4OJ7YBvjHp8Ad33QDH/GtqMGd7TuK:mP77uNZ0SkZJ8Al3ssw7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654703, "uuid": "c501e7c2-081a-48b9-a0a7-20d6c2cf6418", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654703, "uuid": "ae72b612-dbd1-431b-ad98-f29ae9727bf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654703, "uuid": "28d2530d-eb77-43b1-9f80-c6d4d9b0a0d7", "value": "2f6da982c9de028231701b84a4be4be3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f40bbc-0ce3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630693030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630693030, "uuid": "ac87fc99-dd50-4592-8557-640bb050bab5", "comment": "Malware payload (Formbook)", "value": "6d7ca5d8a32cbb1af3e790a764d187cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630693030, "uuid": "dd9e41d0-be41-4440-9b56-35e162ff173b", "comment": "Malware payload (Formbook)", "value": "5de91041d903239cec4eb91f5ca0905beffc2fe8e768ba47fb1e7d40d72cbfe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630693030, "uuid": "342f9b79-f4dd-4f2b-b7d5-b3912a89c61a", "comment": "Malware payload (Formbook)", "value": "39cee98d41d0fd8a5936d9e07c22518ea9da6a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630693030, "uuid": "7fc5b5de-d2c4-43c8-9f7a-80681b378ad1", "comment": "Malware payload (Formbook)", "value": "eb8d292bc5856a5160932051cc3574e28795d9ad1fe7acf61ec1a2f31631b16c882ea62310d60988882a0c241e4c6657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630693030, "uuid": "d001b34d-1134-424d-af1d-75ea7ddffa80", "value": "T13AF46B656BB49A75D0322A3ECC1FA3D5B1ACFC413D38CC8AA9B52D0B19661E4BC03577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630693030, "uuid": "0e0045d3-d9ed-437c-a7a3-74651e4f5ede", "value": "b3373f4e40194d54d32bc6828a771ef7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630693030, "uuid": "677898f0-4af3-4cb9-bc30-ded33f114e36", "value": "12288:rokUWg5OFBhsZUccZk8ME1rbCYxWecXgiSZZZZZZZZZZZZZZZZZZZZZZZZZZZZZg:rGWdB0UcceiKYFcQiVFCkLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630693030, "uuid": "767d7b88-f36a-433a-bbf5-f4e531f6ae40", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630693030, "uuid": "eb5dc5d5-ce2c-4b93-932c-ffd1e13bdb9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630693030, "uuid": "017384bb-6abe-45a8-8068-e756214f5705", "value": "PAYMENT FX-DR-951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc308426-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630660262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660262, "uuid": "e10e3049-9ba8-46fe-91e5-92394f935d17", "comment": "Malware payload (njrat)", "value": "24f2fa2c628f584de5caeea53025d93f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660262, "uuid": "1bddfc4a-42f1-43d5-8255-5710c512d7f0", "comment": "Malware payload (njrat)", "value": "5eb68bbaf58125b0f1bdc8a750a59df3a71707793c2d78d64c483ee8ebe36392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660262, "uuid": "1f978ccf-931f-4565-96ff-d4f84e493fdd", "comment": "Malware payload (njrat)", "value": "47386387814829f24d63fc3a6c3ee1d61559af58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660262, "uuid": "8df32f29-faf7-4f28-85f5-b5bc83bf12c1", "comment": "Malware payload (njrat)", "value": "7cbf1ddbfb531e21c23b5eeef024ba9397e98d2806b9e537d403a360ba41c660532c584069c80a1303375ca1e91d5d50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660262, "uuid": "c474e0fd-ede8-4d53-b777-ab499883a479", "value": "T14CD46B11B780C436E9B222728D76DA79227ABD705B3052CB66D87D7B7F322D3193160B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660262, "uuid": "e96e3b7c-a947-47d9-99c5-becc738db6b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660262, "uuid": "b832f99f-208f-40cb-96e9-b6d576d44cc6", "value": "12288:Uzpeojs6NrsfWa/G2oy9bawFkHaW6Ofm1VHVO:UYEE/9baXaW6Oc1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660262, "uuid": "48d21a99-3560-414b-a4e7-45b1ba98b53b", "value": 651328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660262, "uuid": "f42b382c-1d67-4839-9627-691b36a15cd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660262, "uuid": "91b4a2be-a41f-4632-8ede-0283ea6c5875", "value": "5eb68bbaf58125b0f1bdc8a750a59df3a71707793c2d78d64c483ee8ebe36392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db64796c-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655965, "uuid": "e2d386f2-f4ef-445d-8738-314427490db4", "comment": "Malware payload (Mirai)", "value": "0b82c77ffc48ca06682ba8d2395501da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655965, "uuid": "37fde704-07c6-4706-86c3-5c7f77a5d715", "comment": "Malware payload (Mirai)", "value": "5f5ec019b93f37fbfbe578dd5e47adde18042ab3c21f9dc530b30228c6c3f1f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655965, "uuid": "8d6cbbfa-eb93-499e-9d4c-8aa283aa3f1e", "comment": "Malware payload (Mirai)", "value": "1ced5dad935d511d979542981d24f682aa2867ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655965, "uuid": "40ae4e8d-470e-4b17-b689-ed5303e6796a", "comment": "Malware payload (Mirai)", "value": "dc6e118909fe06dce830af79791dc7e4e291144e3aa3ba142136909e9c37c0c04359c6f8980067351dee6cd7f022daee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655965, "uuid": "648b1d10-5e1d-4169-b065-ad05eeaf6705", "value": "T19323023375CAFCB0CBF209387649D76128562EBCC5B8F974381E0274F4C61A819BA94E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655965, "uuid": "f59f6bf1-72bc-4ab0-87df-91c57dab5daa", "value": "768:xz4hL2pkB55/a9eXsf8n4FUyzEVt+Tkq6BARY7tmPsdirb2QRegEs3Uozx:A3BX8e8+VttBAZbn2keghzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655965, "uuid": "73b4b114-3b3b-48da-a755-e64426b268ac", "value": 46044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655965, "uuid": "1f5e3be9-e634-423a-adac-944eeafccb3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655965, "uuid": "ac7123ea-9e33-44fb-8145-f3b4fda639ed", "value": "0b82c77ffc48ca06682ba8d2395501da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e430c38d-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630660275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660275, "uuid": "e69fc471-e2d5-484c-bb20-f0c0f65bee77", "comment": "Malware payload (njrat)", "value": "8df62873ab01c9ec32e94283d4116842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660275, "uuid": "92d27e67-8497-4fa3-897e-5dc13d7db5dd", "comment": "Malware payload (njrat)", "value": "60a1274f15d4c850c1586946c4ead1c569adc9dcb50811e0202b653597f27bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660275, "uuid": "bafb2566-1b8b-4a9b-93a4-8ed438d11c6f", "comment": "Malware payload (njrat)", "value": "7bde25cd94b3ef86dda750b75814da05658b2cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660275, "uuid": "6ef10634-f423-4deb-881f-9fccc35852f8", "comment": "Malware payload (njrat)", "value": "ef5b404bd76c29d02e9b9743a9041cf08052eef7bb5fd0623115b43c54bbe5d1e454c1b59e7986d07a16c7686299ad79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660275, "uuid": "be278b48-2c8e-42cc-8bc6-4558fb2b11a3", "value": "T171B42314C3A4816AC226C23C88DB6B008A489F956544B75B8ECA7F577FF3F681FD8275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660275, "uuid": "ccd2ae8e-c2d5-41ab-928a-3eb2a9bac14b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660275, "uuid": "1a214919-e14a-4b55-b2b1-1fd7eca41c1b", "value": "12288:c8zmNxGo4IO4tAYKzIGF+T0wxpl1KtQThIUuzKPCu:J60vjzlRIl1fNIjcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660275, "uuid": "b6c4fd62-fd4b-465f-a178-07e02a3cfa54", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660275, "uuid": "d412be0b-4778-428c-9e0e-66aa95804a6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660275, "uuid": "4ee0b921-b49a-45fb-bb7f-2e05d430487f", "value": "60a1274f15d4c850c1586946c4ead1c569adc9dcb50811e0202b653597f27bf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03360ee1-0cf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630699841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699841, "uuid": "fb5cc99b-2400-4263-8c75-0da9eb97bea7", "comment": "Malware payload", "value": "9be3057008e688c31e25df19016ec37d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699841, "uuid": "5d560885-3bef-4484-9c98-7d74c4fb6364", "comment": "Malware payload", "value": "60c6639d2c97140595080cbf0b82dbeff35a55384af0ea4d354a859a0e6b93c0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699841, "uuid": "d20f769c-49e3-4097-8d33-8c1c2c710b41", "comment": "Malware payload", "value": "13644b315579d668f047fcc3b85d205703d9c3f2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699841, "uuid": "e0504049-4f91-4734-a8a2-f8499634076f", "comment": "Malware payload", "value": "9b74d7cbd67e1d938164b3866819b718d5b98b57bf3258ca8d291f3b8c117694c61f8cc8489e0e31e52318908886bf1a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699841, "uuid": "1133236c-1bf8-4b22-9bf3-a893f5adbcdf", "value": "T118C3F25303B09061D2FB153666D5A376BEBED79456F233B33A50608EDCAA6B40F2CE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699841, "uuid": "bb395c58-acd0-47e2-a13c-9960538b9c85", "value": "3072:XnPBv/eNwM8re2kO/DZutbUT1X99xxAhsghsH010e0D:XnPVW6BkO/D4JK9xxArq010e0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630699841, "uuid": "76a3cd29-c0a8-49a6-b4c2-bf86a4f93cf3", "value": 121575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630699841, "uuid": "60f89a80-bcb9-4329-a1ef-c1126eb82883", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699841, "uuid": "1e3e63d0-fdf3-410c-8f59-46560029405d", "value": "tksigned-Android_Guncelleme_build.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5074eb45-0c91-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630657880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657880, "uuid": "896038aa-bc69-4202-9c8e-71c6eb68be77", "comment": "Malware payload (NanoCore)", "value": "6803b7789af179358d3ce545f70b4476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657880, "uuid": "0526d0c6-990f-4e23-a673-ebec1414b6c8", "comment": "Malware payload (NanoCore)", "value": "610edbc82a022b99c215be2e3144befa9b3103a2174eec463de12e929416b5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657880, "uuid": "a5c0247b-fbf7-4345-b27a-bdeacb13deac", "comment": "Malware payload (NanoCore)", "value": "1ddf6759937b38c3cec120c283780db739c4bd4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657880, "uuid": "de96b079-c710-4e82-9585-5a44742cf02a", "comment": "Malware payload (NanoCore)", "value": "7732d56cb3b0918d9d4abd1cb6631ed2acb80e371477b69c48116f6534bf10b81da6c657d049bcb274e536ba7c9f10e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657880, "uuid": "6f6c73c7-ca45-4d8b-8a8c-7a6641747c97", "value": "T14DE43D3E58FE23279176C7D5CBE18923F6C498AF3233A96567D747264306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657880, "uuid": "dbb4dfb0-977f-4cc4-bbe6-d4d8cd21cd11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657880, "uuid": "ef0ec906-44cf-4c2b-bbff-2b8c5aac0dec", "value": "6144:7XFJLgGC2vVhw9vU9KZz+ou5T+eOluCwy2YVWhg/wRLojtHmlfMe52HQ6c:7dvVhw644oup+ecWysg/GSHYfCQ6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630657880, "uuid": "c976475a-7754-47ca-bb9d-e39b92e2326b", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630657880, "uuid": "62de233e-c5c4-4867-b8be-ba765687b63a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657880, "uuid": "854b2997-652d-4b31-b544-c01a41a49184", "value": "SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa32de6-0c4d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630628753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628753, "uuid": "d0b29d90-09e7-426f-a4f4-0c2d0f1add98", "comment": "Malware payload (RaccoonStealer)", "value": "c0a142b43066b0955570641498920957", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628753, "uuid": "59535288-405c-439c-93eb-c1cdaa1f45b4", "comment": "Malware payload (RaccoonStealer)", "value": "62dc6d106cefc8277867d471d1345ce176b7670e464104f74cda40f15a3a5515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628753, "uuid": "3b9945a4-5d4b-45e6-9a16-a7c8553d9e4d", "comment": "Malware payload (RaccoonStealer)", "value": "00555079ce2c7f2a53f06f01023f4504c4d9d149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628753, "uuid": "7ed9b655-bab6-4819-9f92-cdedbf6a1ea7", "comment": "Malware payload (RaccoonStealer)", "value": "7f2e7b8b566dd0949edda677a277ad6a01de17d6efab5f5e3a48caee26f32fc8223c2740c858f72f5c908ffc1b32b85b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628753, "uuid": "69108d29-d6b9-48ac-b83a-20643cd06dbb", "value": "T148B4E020B6E0C031F4B755F999BA83BC7A397AB1AB3490CB62C517EA56343E49D30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628753, "uuid": "a1567d40-f0db-4bab-a830-93b5260b6b59", "value": "e1eb14d2b9b63299ef24644e625b9baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628753, "uuid": "b26d6448-8a1e-4a78-aaa6-2df819e3b07c", "value": "12288:nGYbPw5bQwLysinCcRA0Palthx4tITAc0HkiP/3:G2Yejx60PqtrAuAcwNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630628753, "uuid": "add0e231-2df0-4671-8695-429d45de2522", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630628753, "uuid": "0b44cbbd-64ee-4ef5-b0b0-11822342fa7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628753, "uuid": "f2f606e0-bfd4-4e16-a992-cdfd579b7005", "value": "62dc6d106cefc8277867d471d1345ce176b7670e46410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275a297a-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654375, "uuid": "fea4a324-34c3-45bd-92f6-0a00b9a2afe4", "comment": "Malware payload (FIN7)", "value": "0d12e8754adacc645a981426e69b91ec", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654375, "uuid": "21bddc0c-6d71-4db6-9ca6-0a0be20cde68", "comment": "Malware payload (FIN7)", "value": "6321c30fbd2e7d9d965750ec961766908980f69e946fa3ad97ed7f0d998fa46f", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654375, "uuid": "7ca9dd76-796e-47e6-aaf1-046dcab7f177", "comment": "Malware payload (FIN7)", "value": "f411bc0e65d7eebd9f7cff4e3417d7bc07df0279", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654375, "uuid": "1a9f07a9-f915-48bf-a904-6e6ccf2a34f9", "comment": "Malware payload (FIN7)", "value": "02cf433d6cb1cd0939392fe805f23e452c80ca917b8cdd094c6fe732919bb5e1a8c11014892a771605e826e0f5b82ed2", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654375, "uuid": "908f2328-f53f-4568-b815-963e9e64cde4", "value": "T13AE30917E381033606A28265A60E65E6F71AC13CA376C670689ED13D3316C79B27F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654375, "uuid": "8fe28707-bab9-4692-9ae9-a4f07e2c83be", "value": "3072:ucfc4UCq7BDuYzOTESXAzM3dlaNYL+L+brES6aHxWSUuLmPj:Pfs7BDuEqAzuoNYixSXHoSLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654375, "uuid": "344daf06-b4f4-42fc-8fa7-7ea93b922925", "value": 143678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654375, "uuid": "4e23f975-8881-4068-8546-8653598dd18d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654375, "uuid": "a98cabe6-4a3f-4b45-9005-5f0efe125762", "value": "word_data.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02fac68-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630660295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660295, "uuid": "2dfff1d9-2f4f-48cf-8af8-754ab1440fc6", "comment": "Malware payload (QuasarRAT)", "value": "2da724c9c4d0cad2581f77d2fd3e6036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660295, "uuid": "e26cec73-af2c-4dba-bfca-3c90c46d6165", "comment": "Malware payload (QuasarRAT)", "value": "632479c68df90ee1c0417c09898b496bcd4b44b8e4f7e6132d0e57a91f58f395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660295, "uuid": "65345933-00ab-44e4-b047-999b0bd63025", "comment": "Malware payload (QuasarRAT)", "value": "143535a9719c926d82806ab33992e85529da2913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660295, "uuid": "55e620ff-e461-49dd-9de3-919ba1a50859", "comment": "Malware payload (QuasarRAT)", "value": "453c02f0d19d09ab12b26d9f66a766b4e0d232de8435479b9955e99347673d7ed1ec46ce16db6015a88998e3e90559ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660295, "uuid": "c6573d90-dd0f-463a-a5c5-9d72299244d2", "value": "T142B46B6023E8861BE1AF5779E87144209BF5F407B267EB8F4540B1EE2D62B46DE80773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660295, "uuid": "b2443a11-578d-46b8-9d99-798d35ed09b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660295, "uuid": "3c05aaef-d61e-4ac8-94f0-18a38aff6649", "value": "6144:sTEgdc0YBebGbXOsA6j1Rdh6StuGknaZiFcE+Ob8p9BMN7YncTR3a:sTEgdfYZA6Bf0O9f/ncda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660295, "uuid": "8a13713f-5f28-48fb-a755-c6dde85086c2", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660295, "uuid": "36b43ed2-5eaf-466e-8f20-6c268fccfb3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660295, "uuid": "9a0d31fb-a74b-45b9-98f6-04b1d72f06cd", "value": "632479c68df90ee1c0417c09898b496bcd4b44b8e4f7e6132d0e57a91f58f395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12aa8d07-0cc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630679251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679251, "uuid": "7b3607e6-f523-4bda-8f9c-f9ef8511be90", "comment": "Malware payload (Cerberus)", "value": "e64728c81528dbb27402173152d44699", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679251, "uuid": "cb0b6e2b-f1ec-4114-924e-1586f33f223e", "comment": "Malware payload (Cerberus)", "value": "63c460bf2652832ccda5e0749a6d4c79ef1ce47d125d52407f3f0428cc131f38", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679251, "uuid": "1fa8c30e-e26f-4fa8-9089-cfee884a43b1", "comment": "Malware payload (Cerberus)", "value": "405d053898053f8b0ba1efd657b784acec475518", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679251, "uuid": "23c52142-7315-4ff9-826b-6da7711eb1f9", "comment": "Malware payload (Cerberus)", "value": "d55cd24355ffa258e71a032062af72ce53283e87383c14074fa33e70b5cd60ff5f694c51dade0ca98e9e606aea610fa2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679251, "uuid": "e63aef20-0108-4c73-b76c-ad1a975ff622", "value": "T17AE3129353D55828E15FF97421BA43952BBF422211E8F3B3269A00B1ECB67E95F1CD28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679251, "uuid": "fdec9aa8-a704-4850-9f69-08bf8135999d", "value": "3072:pP/VpWUPuN+ZgH84/vR0txKPnVBIVBQhPZhPAP:pP/VXUemVR0txi/I/SHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630679251, "uuid": "ce00c543-e9ed-4144-996a-2dc7241c0764", "value": 153009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630679251, "uuid": "6ee21dee-e6b5-4fa0-9853-4c418d5831fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679251, "uuid": "d28147e3-a085-4d03-a2da-ce8d033e2f18", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a63db7-0c94-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630659093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659093, "uuid": "391593ee-6a08-4a2a-9948-f0a9f50395fd", "comment": "Malware payload (CobaltStrike)", "value": "8d8d168e25d41e2d4304c08cb3105d9b", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659093, "uuid": "dd99454d-f028-47be-9f80-248f4d13742f", "comment": "Malware payload (CobaltStrike)", "value": "669fcafcaf217a0ae7776d1c98b6cbb4fd75fb97b12965185136a09c7bfc0ef2", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659093, "uuid": "68330de7-284c-4543-9124-2aa46e039d1e", "comment": "Malware payload (CobaltStrike)", "value": "95b5faae967015333cf1a5e3849f437e4122a054", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659093, "uuid": "7f5f509b-829b-45ea-9bd0-ce985d9f0f74", "comment": "Malware payload (CobaltStrike)", "value": "1543c1ec7735dc8c925bd402ec9b4647538a49d5d1caba95e9c73d6e323c7de4ccb7e444eae2e7d32cd7f8c0427f1710", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659093, "uuid": "f4346495-fe9d-43c1-aa70-8b5942b965d2", "value": "T11C54CFCB69B72132E7703A70CD795ABF98184827A1ACF4845CABE33C595E663037E345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659093, "uuid": "7c7201f5-46bf-492e-9582-ca2dd72f515f", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659093, "uuid": "8f607352-cf58-4d9a-bcf9-625812ca016f", "value": "3072:KR15m+yOMvRli6eKU3jPmrOH4PXjel/51+YtwpxoqGZ21SQ1P9Kz:KR/z683jGoIjel/51+qmPD1SQJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659093, "uuid": "1c2c21db-e10b-4437-9d0e-db87dad0bdaa", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659093, "uuid": "069b5c39-ea7b-4df4-9707-ab6e14b9a828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659093, "uuid": "d15306c0-bff3-4e3b-a067-0dd1a28e743c", "value": "beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bbe6d7-0ce1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630692299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692299, "uuid": "1a3901bf-a8be-4df5-9633-b153da42f931", "comment": "Malware payload (Formbook)", "value": "0a9de49281cf90a99f03cb917ac16afe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692299, "uuid": "69b1ee18-4dad-4f23-ba99-5eda7af8a0b2", "comment": "Malware payload (Formbook)", "value": "66e9a440c0e4719ed9c472be00302f7a1176f48b5e0153284abc0c8060d70306", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692299, "uuid": "cee91778-9756-414d-80ae-05305f26f0c3", "comment": "Malware payload (Formbook)", "value": "2f38ef814c67f71710b359308be5b980ac54ec46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692299, "uuid": "4dab485e-ffa8-40a2-b080-51583db6fd5c", "comment": "Malware payload (Formbook)", "value": "9db66fa3fec5810d5e6414ff2bfdb87145e69ec8df2e815acaf4eed8360becb1b6e2e8d8a81a995bf713e661b8487da9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692299, "uuid": "7e2bef17-1aff-4d47-b85a-90fb6e7e1897", "value": "T190341246AB80E8FFC6F747304DB481BC97F651211064EB1BA7813A1EB4123D78D6F6A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692299, "uuid": "9c19b3b9-c31b-4fe0-afb2-4876cb06c2c0", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692299, "uuid": "81f6a833-f25f-422d-b848-32f9ceabf836", "value": "6144:S9X0G6PHRrBTA8lVcf5fNMRkjqm5kDy8iGLkA:00zfRxAschfSOczToA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630692299, "uuid": "2f38b3ce-b58c-415b-94d7-8583ec7b9958", "value": 239955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630692299, "uuid": "54078cba-3ff6-4efb-9d1a-55fbb4c58bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692299, "uuid": "dfd85c41-0120-4dbf-9cc0-43bd9b342c04", "value": "0a9de49281cf90a99f03cb917ac16afe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ff92ed-0cd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630685647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685647, "uuid": "00673b78-743f-45b8-98a6-8937f9831ab2", "comment": "Malware payload (RedLineStealer)", "value": "8e2c6bd0f789c514be09799fa453f9bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685647, "uuid": "715c2f0c-1a02-4594-9376-28487ea2cdbc", "comment": "Malware payload (RedLineStealer)", "value": "67459286369a30ff17fb2df1f92a552979dc8ca3b8720e6c15c380a0d004dbbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685647, "uuid": "d976e211-01aa-42cb-aa9d-84a332670897", "comment": "Malware payload (RedLineStealer)", "value": "5a20567e554a56bcc1c8820502764a7a97daaf28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685647, "uuid": "83e2efed-b1cf-4f2a-9ffb-06f602cf0e65", "comment": "Malware payload (RedLineStealer)", "value": "b4f2ed36c54ec771c8867302ea961cc95046124ff2d6256fd7ffb3a0bb71db30fce2559f00a9922a0492d69993d89ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685647, "uuid": "710936da-9a98-4006-be1f-e2093f52c39c", "value": "T198E3AEB7A1A065ABC9481631E4640F8B363ACF340591B395B04EF3AFCD3DA5DCAF4664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685647, "uuid": "1e7cda6c-26eb-41a0-a56d-0be2b1cf8a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685647, "uuid": "ea915b90-4202-4569-ad15-24e5ef0d68d7", "value": "1536:Ko0a26eNJF1qYGiIIRnAT9zimvbJ6dAVTKCMvYFAtXUxcImAI5jK/zFlzvfd:KukqiImnAT92mvbSCTFtcPAwWLTzvfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630685647, "uuid": "5eded813-bc0d-403b-88c5-539efc5a2aed", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630685647, "uuid": "6a243f53-e3d0-478e-b949-fa1641a8557a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685647, "uuid": "c82256bc-0179-4584-8c0d-98a4f2bd3623", "value": "8e2c6bd0f789c514be09799fa453f9bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129b6412-0c9a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630661641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661641, "uuid": "ddd9774c-d477-405d-94e1-01078d4934a2", "comment": "Malware payload", "value": "369a580b62c85b9912dcf4e00a3b062b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661641, "uuid": "69965f4b-1c94-4265-944f-66de3ab131fc", "comment": "Malware payload", "value": "67e1bdaa2cf8c8d7ec6f6795722dfceaaa818e128504766196651a1041684804", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661641, "uuid": "7757814b-f28d-4f70-85aa-cfd9755204a3", "comment": "Malware payload", "value": "1ea36ebef9b7ee2a3437e7c444daf17debe021dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661641, "uuid": "8a4b156a-5b25-4819-9cc7-57204e45c501", "comment": "Malware payload", "value": "a3147ccb6a5278464df34f2a904878f58a0590cac6b1e75601c1aecd9f6908a5aa56cc2ff9b62ba8eae48282e6998080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661641, "uuid": "d8ec510f-5eaa-4254-8786-b452169d23a9", "value": "T18152E716E543A472F206ADF44CEBDFB69E33FF938CB0453DDEA0D8957A20B506516228", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661641, "uuid": "fc3684dd-b8b5-47cb-90c7-00fd8bab4fa5", "value": "03594801003845b0802063f7058ac04f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661641, "uuid": "a0b46e9a-10a6-48bc-9cea-92a867eb0b0d", "value": "192:b3Zwg0krXLzHYx3fAlH3uY3aByQGioQzVS+X6NOvpAJDBNdR:9wbwLMxg3sjNRSrTNdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630661641, "uuid": "7e0d3f94-676e-4b98-942b-3f997b596488", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630661641, "uuid": "24cf7b5c-ac8e-4e45-8ce8-4be5077825e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661641, "uuid": "034f8094-958f-4d4c-ad93-9c5048cdeee5", "value": "radB7226.tmp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9daeb79-0c78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630647346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647346, "uuid": "02b09c22-fb48-4922-9c41-12d046d2e36f", "comment": "Malware payload (DiamondFox)", "value": "f1c89e8224db361bc46ce3fdab84608a", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647346, "uuid": "2d84c09b-15e4-42cd-aa54-c7c491772f99", "comment": "Malware payload (DiamondFox)", "value": "67f44941b2b6bbb4a51dbf67e96012e6dec4070c5dfff9c778ca1eac43a10299", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647346, "uuid": "46e47d83-b5c8-487b-86f0-ffa7f62b26ee", "comment": "Malware payload (DiamondFox)", "value": "5ec9dbbf8fd65ef11c5416ab3c7b0ce624ce79ef", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647346, "uuid": "09618c23-6434-413a-bf50-8577824178e3", "comment": "Malware payload (DiamondFox)", "value": "ea63a75a5a2741dc434452975eebf3cc636713320b4cb7ba3c2e9fa29cf462b2267e5212a6c2a4832449a690778a0b4c", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647346, "uuid": "2691ff6b-3ad0-44e8-af49-7bf46f7ea5b9", "value": "T17EF5332072D69CFED9419139BB4477BAF0B8C38C4A7189CBB7A0D6495F2E891D327528", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647346, "uuid": "c971acc1-ce8a-4547-b1dc-232496f327af", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647346, "uuid": "d4ae4420-d6ac-48f7-bb9b-3c630bbb902d", "value": "98304:x0CvLUBsg0ls4jLsG+HBIAIsACAbPbanKdoJtp7yp:xpLUCg+AG+hICACVJt5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630647346, "uuid": "57f82f2e-863b-4828-be28-880c58c4ab0d", "value": 3481781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630647346, "uuid": "f2733032-0809-484b-a241-cc38270446a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647346, "uuid": "02d82cfe-1c43-4df4-a125-6abad2ff6765", "value": "F1C89E8224DB361BC46CE3FDAB84608A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457840e6-0c77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630646694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646694, "uuid": "5702492c-6497-4dd6-bc7c-e97280abb94a", "comment": "Malware payload", "value": "ffa8cc1d030d41c5a9d57ed6bdf4c3c0", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646694, "uuid": "96d0ab08-9cf9-4e09-941c-bb8c5b941556", "comment": "Malware payload", "value": "6a4870e3398aa3e016d3673f87de279ef0a2041ac0390e124274ceff98948519", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646694, "uuid": "5a067cbb-06ba-47c5-98fb-e4d1750a0d87", "comment": "Malware payload", "value": "225cd9eea363413faeb96526b015751a0632b0db", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646694, "uuid": "08b92af6-c050-4c92-8d79-d88260b33e14", "comment": "Malware payload", "value": "5676a1dfd60457cd55f5c12766812a15b81338672aaaa3f9fbbbf5235c386306c0d7c3e4accd58303dec1be001c12bd3", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646694, "uuid": "011164ff-5e92-498a-af27-8ced7ffbd1d4", "value": "T13844CE93BEB2C73EE0520BEBBB2122E494FE1F395537461DE4F10B12DE162271978466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646694, "uuid": "9adefc02-3445-428f-b9b0-4e3c4ff226a5", "value": "6144:AQ6c9aWNIqgj/EdrhA9xuzph74RaeAeS+aruHQza/U9:A3c9aW0/E9hKah40Zx4+am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646694, "uuid": "6c258b88-f79d-4a7b-87fe-f47e5171b9f6", "value": 262739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646694, "uuid": "667e74b4-62c3-472e-a333-a15ca45a6a24", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646694, "uuid": "0652e082-64ed-4d71-b040-8b5632586eb7", "value": "x64_beacon_https", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfca096e-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630650389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650389, "uuid": "6b106fa3-07ba-4f68-a8dd-f692a810bf40", "comment": "Malware payload (NanoCore)", "value": "37e977b64b17e53bfcf2e063d481652a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650389, "uuid": "e43c3486-28c3-432e-ac44-20ab96b71194", "comment": "Malware payload (NanoCore)", "value": "6b1df878a0c21217fcbb0faa39b26af2316e2891e4c8ff3d93ab42623f5d07bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650389, "uuid": "0af9acc4-6e27-471a-ba9e-d1e008f6b65f", "comment": "Malware payload (NanoCore)", "value": "8ae8b59e7f1e9fffa5b91d4a7a969ab246c8f097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650389, "uuid": "2ab3a63e-725c-4354-a352-1810aa7480f1", "comment": "Malware payload (NanoCore)", "value": "857934c1cab90f7123e3bd26bbd1477839c91ac874e2c7ade048ca6b8ac15550a5eca61a00f5b5bffb88259e715454fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650389, "uuid": "d409c164-c0d2-47dc-b1e4-fdbffc380e86", "value": "T122E42C3E58FE23279176C6D5CBE08827F6C498AF3233A96467D747664306A4635C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650389, "uuid": "a893584e-f769-4212-954e-1085c882a07c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650389, "uuid": "7e94ca94-a2ec-4a6d-9f65-40d7cbc65c62", "value": "12288:2uc1EqrNp1IE+I83VyWwd8mwciLg72lc:uFL1r+ILWw5+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650389, "uuid": "b3e24fa3-8d43-4ee4-9513-dac122b72d33", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650389, "uuid": "3c287c62-5074-4bc8-acb1-cb5fcdd94c44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650389, "uuid": "f972195e-5c72-4789-960d-c4f4c5e1dd24", "value": "37e977b64b17e53bfcf2e063d481652a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d97da2-0c67-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630639870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639870, "uuid": "c3766136-7dc8-45a1-ba81-cbd0ace176a5", "comment": "Malware payload (Formbook)", "value": "b7cc37e621e5759d0f23abce1b653799", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639870, "uuid": "c3746cb4-f30a-4306-a834-8df4beaa82cf", "comment": "Malware payload (Formbook)", "value": "6b919aedc991817793774e45c3e84c4fd5ec2b6f299566101ad1392fe47595f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639870, "uuid": "35a61784-8056-438d-95da-40b85298d0ce", "comment": "Malware payload (Formbook)", "value": "7aec41727e99cef3fe526470daaf1cd1b4f530d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639870, "uuid": "7946c67c-ca05-4e69-bb13-74afec48c97c", "comment": "Malware payload (Formbook)", "value": "d74ee753b8a030ce33e39b377f1ac5e3439eb577bc6adf7cc5485074c33e9ce6df11248b19a02a9c7eb6bcab531ec480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639870, "uuid": "c1a85256-6085-4ae7-85ee-7e743aee385c", "value": "T1BCD41C3E59FE23279176C7D6CBE48827F5C098AF3233A96567D747264306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639870, "uuid": "7fb6c460-c900-46ff-b314-4320ec4c91bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639870, "uuid": "3d772ade-4c40-45ca-9de1-099680eb6177", "value": "6144:mbFJLgGiF1PVg3PAI54c7mjp5Xvwe2ri3CV0/jijhgwQBF9+r:xG3PAI5LW5oLahjdwQBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639870, "uuid": "ac0c6454-987d-49a1-833c-1fb8a6972a6f", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639870, "uuid": "5f056edf-a03e-4a1b-91f6-8e4fa764bc43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639870, "uuid": "f6c89331-b835-4218-9549-c7d329831f06", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b93965-0c98-11ec-8fa1-42010a9c0011", "comment": "Malware payload (STRRAT)", "timestamp": 1630660861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660861, "uuid": "d27d791b-3995-4112-be0d-1f102c2d46bf", "comment": "Malware payload (STRRAT)", "value": "a2b3c53cc041ee3f2ee7c3446ad13f75", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660861, "uuid": "4f622536-0bfe-4f4d-82cd-f5f219d51111", "comment": "Malware payload (STRRAT)", "value": "6c295a4d4417fe96ee457f820d80a272d4269ba03ce81a0a25143c5bdd3b07d4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660861, "uuid": "12ed1ee8-b9b8-4e5d-98b4-cb8f345f8031", "comment": "Malware payload (STRRAT)", "value": "5ccd327f00c6124a9e2754cb9a3d994798a2a59a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660861, "uuid": "275f968f-cda2-4a39-8977-caafa6bdc3b2", "comment": "Malware payload (STRRAT)", "value": "d4f017ae58847c6e9b66433767f5145f9dcd9c026d22dae7e0db113e3b33bc981e29448bd6964448d116fbb16388ecb5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660861, "uuid": "32aa45f8-cda0-4ae7-827a-623e0832c294", "value": "T1C8E3C00B742AC169C2471A311219C7236F3DAE85C65A212723FFF25C2D39ED9972F5CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660861, "uuid": "db16cc54-1f91-4eb2-8e54-ed6700da8d63", "value": "3072:Vi1k7EAv2RL9oqMCenIP13QGj4G7PNMkG9S21T0xJjv7LI46:01kCfYIBVj4GbNMkoS2GxxnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660861, "uuid": "08fd4cee-6456-4e28-a54b-32ff50e0c38b", "value": 145495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660861, "uuid": "d0030743-d94c-4da4-b162-bca905a93bba", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660861, "uuid": "49f3b5d1-41e6-444f-a625-c89e73622612", "value": "01_extracted.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1c5631-0c6d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1630642706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642706, "uuid": "a1349b2e-52b1-4b15-bd65-8a5a64804d94", "comment": "Malware payload (Glupteba)", "value": "830ffb393ba8cca073a1c0b66af78de5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642706, "uuid": "949e14e0-14bf-45dd-88a3-1116ebf49128", "comment": "Malware payload (Glupteba)", "value": "6c62b768d8b22888724288af038bc0b6e55280ddbbe42a436cdf68889346df18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642706, "uuid": "65c52ec8-7f1c-488d-ba7b-7c022f4e511e", "comment": "Malware payload (Glupteba)", "value": "26fd142ed7a2bc7bb5d249ee88ee93becf45672b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642706, "uuid": "cd42e51e-81bb-4bc8-8805-2570a196bb2c", "comment": "Malware payload (Glupteba)", "value": "0ff05b37fc7e83113eaf0b672563106f39aa9d73cbc272121635962f971d3349d45dd79c030adab3cbffb97728413287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642706, "uuid": "73b73de4-b656-439d-a4ae-0cd6f25a92e8", "value": "T138A533C6DB65C73AE2419FBD52CC8C0112CCE2318F6935CDBB859A59BE417916CEF2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642706, "uuid": "a57c2fb6-ce44-4456-ad26-9a9a04e3590e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642706, "uuid": "169a81e9-8e76-4b18-aefd-5a43c129c03c", "value": "49152:c8dgSDqBqrci8PXdzCPabd+aCUzLUhLpW5If7Z:c8dXDqor18PNzCPabTnzLUhLpWa7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630642706, "uuid": "40d3d6df-3e7e-4ba7-817b-8e465a50d41a", "value": 2107392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630642706, "uuid": "9583fd5d-5166-4448-920c-096c829bc0c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642706, "uuid": "bc3bd0ef-bc3f-4d16-a2af-8832f4eaf68f", "value": "830ffb393ba8cca073a1c0b66af78de5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f7f4ca-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686472, "uuid": "2f053f15-a33b-47a5-83d9-c0e7f9a2daf4", "comment": "Malware payload (Mirai)", "value": "12c5082d3dcacfecff219405d7ebdfba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686472, "uuid": "ff76fbaa-d56f-4616-9257-75d3dfcb7552", "comment": "Malware payload (Mirai)", "value": "6cd173bc2c97e76e7199abba84a38ec115de3fd0f2bb632357f15a9ebaea15e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686472, "uuid": "61675d2a-a9a5-48c6-942e-1ac0b4e47242", "comment": "Malware payload (Mirai)", "value": "0166f97743b4440bca27a33b3f113f7cf7ab648e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686472, "uuid": "94842579-3f19-4052-b753-aea9e34a5531", "comment": "Malware payload (Mirai)", "value": "b26614bbc70b5706cfc843c0272224c97ebd1fb00708558a514442355471c25976d024493b56c62ac66c2bc897863c21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686472, "uuid": "3727245f-67df-44c0-8e35-92dc984d3c63", "value": "T17C432A96B801AD7CF94FE6BE94234D0DFA21335051930B2B67A7FDD36D321A86E12D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686472, "uuid": "ca72a36c-4ea9-4e6f-b292-a08d88b581bf", "value": "1536:oFMAMFlwZA9UwTQPE3wqyIE8WhibBqKpnzQ:zTFlwZSUwTdlfqjKpzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686472, "uuid": "85ac56c7-4168-4062-a932-511b1e40939b", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686472, "uuid": "5ff2572b-6fbd-45f4-8c9d-bf8065916955", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686472, "uuid": "c530e159-266e-4b00-8df1-430f37c42130", "value": "12c5082d3dcacfecff219405d7ebdfba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d87b12-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BillGates)", "timestamp": 1630684143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684143, "uuid": "44595b82-e5be-44af-8b38-58eca0a18296", "comment": "Malware payload (BillGates)", "value": "9eb8c2ce21be0b6f778806b9875f1368", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684143, "uuid": "3c974c43-0231-4f8a-b082-ffb4b3d7a5b7", "comment": "Malware payload (BillGates)", "value": "6cfbe997d6be386d879f4221237877ee194b91fc75320edc1c0b58d7af824614", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684143, "uuid": "91fb9963-6fb3-4855-95cc-770280657bda", "comment": "Malware payload (BillGates)", "value": "11f84fdb6933d410f01b3c17e90e82cf6ecddbb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684143, "uuid": "88497918-4e3c-4b45-9da6-881c7e627b24", "comment": "Malware payload (BillGates)", "value": "e07f46a900633a10b09f234982de6e694558e4908463cfe4e7506dfd6eb1fcc673d92fa3bb5ca4107441e3495ec53061", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684143, "uuid": "19a176e2-d2ae-4f74-9630-bf206887ce61", "value": "T1FF456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684143, "uuid": "f099dfb1-5532-41f5-8ea3-c70da522f51b", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX482y1q2rJp0:745vRVJKGtSA0VWeozu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684143, "uuid": "3ab9689d-bd89-46e3-9e9f-cd92bfb9b521", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684143, "uuid": "7722ec07-4929-4e6e-a0e8-ee12a17dcff0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684143, "uuid": "02d6999e-3b43-477b-838c-957551b96947", "value": "9eb8c2ce21be0b6f778806b9875f1368", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3646103e-0c71-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630644092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644092, "uuid": "e5b6d005-1ce1-4fc6-9fcc-d10a40499d77", "comment": "Malware payload (Loki)", "value": "87e7407a4ac32b27299d759f1ecd3a3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644092, "uuid": "ba6414f4-ec0c-44f2-91c5-e04e95b4c097", "comment": "Malware payload (Loki)", "value": "7009e2ada6aa88b407f4b21e4b07e1b6dd93e46d1c3361c22105f356a22d1d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644092, "uuid": "df15de87-6ed8-44f1-bb92-98192d9b0a0e", "comment": "Malware payload (Loki)", "value": "5620a8d38a9aba35d3a7eacd39e6008b5cf9d9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644092, "uuid": "a56bf2ab-9ba4-46fb-9c69-8fe24475086e", "comment": "Malware payload (Loki)", "value": "d5564ede179d0706eaebbe6dd90c6472cb2694b93d5cdbc05c3a5ed19778ec035791443d6f46383b839feb41406c5efa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644092, "uuid": "d60bec4a-a106-4ee9-a40c-d9a0c8528ddb", "value": "T18B94BF9C365076DFC967C972CAA82C24EA2174BB570BD203A45315ED9E0DADBCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644092, "uuid": "c51c1154-9013-445d-8b83-fc4bf0c7874d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644092, "uuid": "45f27ec8-ff6c-4405-b213-96c0ac6b96c3", "value": "12288:78KDRm4Pr64nPl4m/xwE6vZcrHBR9KQwq93ilYX:WknNNGvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630644092, "uuid": "9996df34-7f77-4d33-ac12-a5c87e061d0f", "value": 419840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630644092, "uuid": "d90d6503-7c7c-4630-9b1d-a76fb4745275", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644092, "uuid": "5c6f3970-1c82-4085-bedb-61276f1fe891", "value": "???(??) ???? ??????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c613df16-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686424, "uuid": "9679bd43-ce93-473f-9f7c-7e29e43c0d5d", "comment": "Malware payload (Mirai)", "value": "d20a54bb02e7080fd572b3adf736e66a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686424, "uuid": "c96b33e7-63de-48ec-ab87-14c3b39b4599", "comment": "Malware payload (Mirai)", "value": "70eb54035907028adca924a8243bc1c67831db023c8283866b71058194b6c6f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686424, "uuid": "5eb87890-0ef0-4db7-889c-19b8afb1481a", "comment": "Malware payload (Mirai)", "value": "cfc79badd1851133a6de1356a9d945454493d30c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686424, "uuid": "e3a95fa4-7b2a-4f1d-bc54-7baf5221ba3e", "comment": "Malware payload (Mirai)", "value": "7f59e05e05a36ff7260f494009fb55dbfd8a6dfc7ceff62dadbe9ab457d4753c2902c2ff4009ce659686efdb24e59d5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686424, "uuid": "89bc7f0e-ca24-4ad6-80cf-83582ea29673", "value": "T19F73A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686424, "uuid": "22b0e527-4ebd-4931-9c7d-03f0c803a452", "value": "1536:zoVvPLWTs7ys6XcniEyNMin3sDmTRdVSabdza3TTLbwXmP5h:zo5WTm6XouMk3sDmTvVSabQ3TTLbwXmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686424, "uuid": "99dedb99-2f15-488f-8fa9-eba962429919", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686424, "uuid": "743225d6-05c1-4c93-b1d1-bf1f34bbf42d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686424, "uuid": "c0959bc9-52c2-44e4-b701-bc04dedef944", "value": "d20a54bb02e7080fd572b3adf736e66a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be2d567-0c4c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630628183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628183, "uuid": "51a22b1e-792c-410d-8ece-cf7d33c4a040", "comment": "Malware payload (ArkeiStealer)", "value": "9770d8c263122462bd1443a3a1ba6f1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628183, "uuid": "ca320066-adab-432a-90a2-155b8160af4f", "comment": "Malware payload (ArkeiStealer)", "value": "7173381414ec85250c6bd3c9b803f2d49b98a7826c8aeea37d9328d5e74d7fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628183, "uuid": "eae4b5f5-0511-47dd-8c47-630971450853", "comment": "Malware payload (ArkeiStealer)", "value": "8467cf8260ff78b94f57c925e592e377e45782bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630628183, "uuid": "d445f14c-aa25-4c20-a6eb-8c4c0462f5bd", "comment": "Malware payload (ArkeiStealer)", "value": "086d77849abe19237e9cd3ec3bddafc1d79c6481702b33e161a950ab507d49d86e0847848c820ef99b306b08a22e9ad7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628183, "uuid": "90644389-0afb-43a8-9870-b3bb9b8aa7f3", "value": "T1F714BE32BAD0C433D5E6C5704969CEA1167FB8715D64858B36793F2F2D712C2AA2232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628183, "uuid": "c836b762-3356-4293-b2b9-cef8f17e86e2", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628183, "uuid": "a0016c67-f237-453d-9135-5ea5352b858a", "value": "3072:djxcoLwFDjV42bk79wWHlH9Xc1oICD5/tTle5oXtjSwrv9ENPGQCeKJIX:djxLLwFDA79hHlFxp555tVvMGQCeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630628183, "uuid": "b3b0ff82-4d1b-4f3e-9ff3-545c697e2249", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630628183, "uuid": "c52b4004-eaf6-4ea0-9b65-9e2dfceac68c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630628183, "uuid": "ad3c3360-5aa7-4a60-940f-965325178655", "value": "9770d8c263122462bd1443a3a1ba6f1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78382377-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654510, "uuid": "0d5b80d3-6e90-41ac-a038-6e3ea6c75477", "comment": "Malware payload (FIN7)", "value": "dc7c07bac0ce9d431f51e2620da93398", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654510, "uuid": "41e8a0f0-9854-49ca-ba9d-acb73467e865", "comment": "Malware payload (FIN7)", "value": "71832696f8efa5ea83ffd5cf0af981ea931297b4679e71990afd6bac350d31fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654510, "uuid": "d5a96d96-7eea-462b-ad2d-33ebd013d5d7", "comment": "Malware payload (FIN7)", "value": "895cbed43d27d42e7a021eb7a7f811f58896d8c7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654510, "uuid": "366caef7-b2ef-4c16-84ac-989f1a06206b", "comment": "Malware payload (FIN7)", "value": "450a7342738124e09b0a6cd72aacbd4339b04519a5e44ebf61e9a80abfcdc949af1745bf7b721a66abfb1099b7c0d517", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654510, "uuid": "a8869164-78fc-41c6-8731-51752c9cf6ba", "value": "T157C52203BB804B2ECED621308489DA80E2E57F241513497727A9F52FE97376C66F36B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654510, "uuid": "44e7dfa6-b0b4-4303-a4b3-4b0edefab2d1", "value": "49152:PpHH1j3mpdgRf+us8azmLBVU3p2XR3451TpKPOv05AFNMnwh:PNxmsRf+u8A+4mtKe0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654510, "uuid": "25dace19-5115-4620-9695-4c3354a34ac5", "value": 2707968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654510, "uuid": "d448fc06-00a0-4339-b41d-6ca851c5044e", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654510, "uuid": "9d6232f5-a9ab-49a6-80ff-0081cb1c774f", "value": "Clients-Current_state-062021-0.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b729bb5-0c77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630646758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646758, "uuid": "f8956aae-59ed-4e3a-8f78-d49a17960940", "comment": "Malware payload", "value": "9775fc76e3f79e4395c4ce97ae30546c", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646758, "uuid": "f4a75a1e-58d7-46b7-ad47-825a53d9adcd", "comment": "Malware payload", "value": "732c656660f3ac39bb2fffd243cd0c973c4c01ad695adf29ad81a6cf59a2bed0", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646758, "uuid": "db325bdc-407f-48e5-94c6-fa48e7eeeb6f", "comment": "Malware payload", "value": "9f5cb22730c0ac21a74c7a81f8fa7888f7f99454", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646758, "uuid": "8ce5c4af-1a25-4970-9f82-bf0fae86fe13", "comment": "Malware payload", "value": "1065559637652f17776012a2349416cefcc1fdb9f9d1d07b5c4646878033257f4bc9698b9fcef8f78a044f962ffbb26e", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646758, "uuid": "b84c777b-57f0-46d3-86bd-243a5a194e2f", "value": "T18824E02D53E754266FE10C23D914BBF55458289B1CDAA29FE0E2C0AB35537CE671FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646758, "uuid": "16ce1468-07e7-486a-bf7b-93088b93ce32", "value": "3072:gWFzJGyzT9kbgQrJiQQMxj3PbxFXIuuJlc0BI3tAE3tvFYPZwj6Aq1eCAof9PEcx:7Gi98gQNixuYNJW3eE3ny48lvwJil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646758, "uuid": "c06d1bcf-ee3a-4a24-89f3-d736096c1b23", "value": 210023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646758, "uuid": "60cf7e5e-7aeb-4ad1-ba42-a007f3218e50", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646758, "uuid": "f13fed12-fa66-49c5-9f16-c2ca0d7ee976", "value": "x86_beacon_http", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4434ffe0-0c77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630646692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646692, "uuid": "6b2963f1-e9ad-4198-afde-b88e6525907e", "comment": "Malware payload", "value": "33ded14f2ee3efe3de2aec0b7e4a2b7b", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646692, "uuid": "eb233393-f17a-4976-91e1-7b5b171c1690", "comment": "Malware payload", "value": "73312e074d7f94d613a26c07964a98b29e34af38105a57fcb930678d7c428533", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646692, "uuid": "62f9f724-4c79-4eef-8987-2d207e0d2ffd", "comment": "Malware payload", "value": "5442bc33e6eb60b9d018644e41948ee0209878d3", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646692, "uuid": "ed8f7757-3788-449d-ae7b-1a9d4679855c", "comment": "Malware payload", "value": "1c02aa69e4fee9d8ec5a354de030bf153754be39a666a6d3130320e832d7652134e078a23ece49d9d7224823e91fa542", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646692, "uuid": "8b30fa62-8e4a-45e6-b5ae-9e8f008abf81", "value": "T17044DF69CDC7910F45F8BB8664F20A5AEBE2AD16E5227BDBBD30BC0DDB8504C57B6100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646692, "uuid": "9b64a698-afb7-4312-ba84-af193b8e6d23", "value": "6144:hYLxJtWigoBdU6Teyrjz7EhJ2bPRKDZhCrdEn4pPbtJrS:4TtzzBfXIhJoRKDZhCJjpxJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646692, "uuid": "dba69636-f9e2-4456-9bd4-22939bb0c2fe", "value": 262739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646692, "uuid": "576e4206-2d19-482d-8315-5cb8a91115dc", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646692, "uuid": "119fcf0e-d1b9-4a22-a46e-72e636b0b7c0", "value": "x64_beacon_http", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c92c50-0c65-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630639152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639152, "uuid": "bff75b32-3bb9-468d-a919-baeb0d7c2a25", "comment": "Malware payload (Formbook)", "value": "563881f7f134da5443d3457a2f983f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639152, "uuid": "0932f530-da2c-42c2-a491-c58e9ac4619e", "comment": "Malware payload (Formbook)", "value": "7349ec9af1459457912535f50d1ad9a73887e2ee95d2b295674e1dcd9205c8c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639152, "uuid": "79a6f536-0237-48a0-b951-13d16655849e", "comment": "Malware payload (Formbook)", "value": "1d7807b9bd58d570b5b8a257c7f2e10288f00657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639152, "uuid": "d23bbb98-aede-447f-8cd4-cf07ea277200", "comment": "Malware payload (Formbook)", "value": "368ab358e3c1e4954469b8f467b167dac6a910f661723c754eda8c00af24c5b0d01a4ca34ad73e3eb124a9a8516ceb6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639152, "uuid": "8766e3e3-3a3f-4f96-8995-f98f5f2fd62e", "value": "T120C49D1294159D2AD280BA3F3FAAC1319B15DC8AD65E6E1BDCFC7E1B38BA4073541D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639152, "uuid": "b2f44fb9-13bf-40f4-8e47-e3cf37427bfa", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639152, "uuid": "4971da60-9cf6-4582-82db-ea3f3b68b5c4", "value": "12288:kXe9PPlowWX0t6mOQwg1Qd15CcYk0We1VkE70D8SSSSSSSSSSSSSSSSSSSSSSSS6:BhloDX0XOf4PL7vSSSSSSSSSSSSSSSSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639152, "uuid": "f022b6b0-3562-42a4-bc7f-99d6ec978d79", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639152, "uuid": "d6aa104f-f42f-41c3-a7aa-fcaf9929793a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639152, "uuid": "9194fa03-5919-405f-b27a-6aef69b37d30", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1236193-0d09-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630709555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630709555, "uuid": "098f8535-96f6-4ee1-95f0-952404e01483", "comment": "Malware payload", "value": "9cf13c69e6df4123e73e32c2798a88ac", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630709555, "uuid": "9e04f3a0-672c-46f9-a88c-ebc9ad15e2c4", "comment": "Malware payload", "value": "73b0cb833944a4cfd8fb52f97f637c161b4bd5cf6828fea147d98a10c1894357", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630709555, "uuid": "de381018-9c91-445b-990e-cada5a6646ae", "comment": "Malware payload", "value": "2b8862dd782da9d158d64ea95ed7843e409b6207", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630709555, "uuid": "7c12c672-0eb1-41b6-a56d-0accdc3b2190", "comment": "Malware payload", "value": "f119371ad37a1ca72f810fbea5b74df95131c5085be4b1e2efacc7b24f158c606751358988f2407aac64012dede69463", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630709555, "uuid": "5220f2b9-bf66-49f6-8927-bb3ecaaf1a14", "value": "T19922BF53C22338880D65B1DC2CEB6CF1294B42C28B6959423D7F15BC972A9BDC531E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630709555, "uuid": "0b7f3236-2357-4ef5-9237-bf3659878aa1", "value": "192:2fJo68oTlkAjgF9KouYphcEugNtCl++SeX9zbX4R+9hMc6l7+dnmWyMfHQG+3x:OJP8EgHvuYphcPagl+3eX9vprMZlpW8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630709555, "uuid": "e219bb03-4f4a-447a-9dce-1c80edf1189a", "value": 9959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630709555, "uuid": "0928125a-d6ca-4ae4-8203-2a17421e0ce4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630709555, "uuid": "50a69e0d-68c5-4076-9433-0e66e5d6f496", "value": "PO.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba483b5-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630684205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684205, "uuid": "00eac341-95f1-4ff5-88e7-6c19eb898e1f", "comment": "Malware payload (Mirai)", "value": "5010d4deff7c3fc26efb13cf9b49e169", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684205, "uuid": "a193d517-ce65-4f07-85d7-f9f60e4c6913", "comment": "Malware payload (Mirai)", "value": "73ed02d373263d97256e46913e250752ab26d8ea16002c2ada6acb04565e6f35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684205, "uuid": "0219cc34-9d04-4790-9597-8d432aa64bfc", "comment": "Malware payload (Mirai)", "value": "a04468cf20d3597bca6d3f80913ce6265ff9fec5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684205, "uuid": "c5e35f6b-7fca-4cb6-80ec-2703e71569df", "comment": "Malware payload (Mirai)", "value": "1432f48a44a79f2de3b739c9dc19039e33405aa1b817880f6cf40eebbd5dd0bd78d06eec131554b58f6a731e7edba869", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684205, "uuid": "03b52c6e-a5c2-43c0-afa5-5be1fb1ea4d8", "value": "T117D34B46EA808E13C4D5177ABAEF41493322E754E3DB730699185FB43F867AF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684205, "uuid": "53ef6013-4792-4ddd-9a52-6feb638760e4", "value": "3072:uw9Lg2RRhpRM54yaRF230tuiC/gH5CEuqMH3l2M/9CIeYj:d9LgaRhpRMqzG+uiC/gZCLH3kM/9YYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684205, "uuid": "76bf2c69-f8b3-4f97-8da1-04b00fe817c3", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684205, "uuid": "466ae96e-4f1c-4a98-9588-bff5ae4f601e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684205, "uuid": "ce94d65d-f64a-4ad5-ad2b-75ebafc23b8d", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca01f52-0ca8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630667913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667913, "uuid": "65508cc2-be68-418d-8522-462c068ed24d", "comment": "Malware payload (CobaltStrike)", "value": "90e6fb23950364a9b9bb85c68f7529e0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667913, "uuid": "f88a3d23-19cc-4f29-9d5c-9b6e420fdc18", "comment": "Malware payload (CobaltStrike)", "value": "7412660c6067e4a7fce10a3bf19b2747205da10d7a805d385fc58ff8e5c813a1", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667913, "uuid": "9b5591fe-b5d9-453f-8350-cbb22e0df59f", "comment": "Malware payload (CobaltStrike)", "value": "a8f563f5f51b67b92802a01c4e1e535068a432df", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667913, "uuid": "c351f5e7-c24d-4e75-b06a-9ef28b70cbae", "comment": "Malware payload (CobaltStrike)", "value": "02fdda3bf22066427fba380c877fd1e4cb4f4e4788b82ea01610eded0a5001399537ffd387f6500ba628652b7159fe9e", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667913, "uuid": "71352a56-eebb-488f-9e21-caf85e3c441d", "value": "T16075E622B89324BAC53EE1F57602A265F6317C75432167DF1AC1799E2A7DBD02E3B304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667913, "uuid": "e22af0e4-a807-437d-84b3-a5778c2d648f", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667913, "uuid": "43749e8d-c568-4f7e-8c44-54556312d17c", "value": "24576:ZhGoc8maHCVh3nxFTNqXmqK54p5kZngyK1a3:ZS8maH4h3dwm8UgyK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630667913, "uuid": "cee7990f-e198-47ee-9956-e9e6b5f75b4e", "value": 1597952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630667913, "uuid": "452646e0-9c88-4284-a1fd-2cb1bea535cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667913, "uuid": "4917a5b0-a270-44c4-a7e5-8e284a88eae4", "value": "7412660c6067e4a7fce10a3bf19b2747205da10d7a805d385fc58ff8e5c813a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c74d84-0cf2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630699469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699469, "uuid": "29f14646-f999-443f-a969-1e0d48ce2380", "comment": "Malware payload", "value": "120344b8eaae70ebb8d245cf9548f6fb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699469, "uuid": "d4adf386-d2fd-4521-a1d4-84731be36e4e", "comment": "Malware payload", "value": "745eadd29be72626e6686654ed778a12e9270193854ed911d961256f8791fc2b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699469, "uuid": "c948b36d-f974-4682-9d51-7420bb8724c4", "comment": "Malware payload", "value": "017c1220bba673489149924e7dc2e45976a55255", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699469, "uuid": "3144920a-ec16-484f-89b7-903ab6408d42", "comment": "Malware payload", "value": "ca0a1297de7428b4dc7c93aafd3088768711d50ee7fdd73bbd580fd8f5ce20395939e61321c8f78a84f881fb83b901aa", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699469, "uuid": "0b9ca301-6d2f-40ac-aabe-492f30ae220b", "value": "T12BF5339FDB034B2DCE164335E24356F656613678B189963E0D2210AF69E7FC0AF44CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699469, "uuid": "08318c64-aeda-4b0d-a72f-f56dd8f4a930", "value": "49152:TJbITsmYlkZg3u1nhyUYGM5P9kjH9SdUvmRg3vn+0TuYKOBen1ZFAk+8vuK3Dfwa:TzmhnhC5VksamRg3vnBtq1L/+Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630699469, "uuid": "a6862dd5-2c75-4a6b-ae19-c97330915066", "value": 3497451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630699469, "uuid": "ab9f515c-33f8-4395-b531-77934585df8f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699469, "uuid": "3d1da7f4-de86-4d37-9edd-cf373d083764", "value": "Ifsa_Video_Part1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af81a111-0ca8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630667918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667918, "uuid": "41059b9c-c642-460c-8b27-e0c81ca2d1dd", "comment": "Malware payload (CobaltStrike)", "value": "febce0ee1ae4aa72863b4f16e25d6941", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667918, "uuid": "f9391cc1-2066-481b-a26d-47e38c95ba40", "comment": "Malware payload (CobaltStrike)", "value": "74f4be670c4f960f997df9c5912d630f3738361196c9010c7dbf69e7e1721d22", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667918, "uuid": "af73e8a1-2390-45e1-a775-51a10545f94a", "comment": "Malware payload (CobaltStrike)", "value": "60739a4893b19184ae75df9f9748d635e179080f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667918, "uuid": "7a24ef70-5755-43e5-8003-e497c250dc20", "comment": "Malware payload (CobaltStrike)", "value": "0f21d985d584ec019ef99ad1001f746ad16b31ef2ac3e5b1361a1ec46d6cd81e595647b933f178b638e19266fe8e2936", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667918, "uuid": "cc571655-8610-4f1e-a349-46cd92d34d5b", "value": "T1A4956D027CE538BAC6B9E2314AA193A13631BC6543313BDB1E45767E1E7ABD42E3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667918, "uuid": "c64968a6-d76c-47d9-935f-80cfaed7ff93", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667918, "uuid": "612fd953-295a-4efc-a37b-40246f499da5", "value": "24576:Kfh3vhifDFpvR3qlbdJP/mg5kZnqIK16TqYkFiWYcnp1eQW:KfvifDHvR3qXmqUqIK16TUiWpnjeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630667918, "uuid": "790fb50c-da64-4200-b3d5-a71c686c35bc", "value": 1950208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630667918, "uuid": "2689a960-d1ef-4aa3-8f61-703f4b37c6a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667918, "uuid": "2db4aa6b-3ec6-4b38-b8db-3a192d632245", "value": "74f4be670c4f960f997df9c5912d630f3738361196c9010c7dbf69e7e1721d22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040262b1-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659899, "uuid": "0bec8821-27b2-4be9-be98-6219d6aaf927", "comment": "Malware payload (Stop)", "value": "9cad22ce2acd99a14bcd4cf853b21751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659899, "uuid": "9a3f1649-13d5-4414-80df-9afd46727847", "comment": "Malware payload (Stop)", "value": "7674f1f7b2b53467fec308bdcaf89c80b4d25eb683ac0ad105084b3dd5cc0cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659899, "uuid": "2616fa22-71c3-4c29-b080-06924355b408", "comment": "Malware payload (Stop)", "value": "1fcd7e5e80f6f3661688608368c98c70ff9456e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659899, "uuid": "bcfc1850-230f-46dd-b08a-731fe0eb020c", "comment": "Malware payload (Stop)", "value": "30de55380be5fd9d5095529a82ffb98e0b310173393eba8cead53ed7bf53f416a30e4fb0deb114d08c98efb36d934884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659899, "uuid": "28091390-1516-496e-954f-9f4c1b14b63c", "value": "T10C05126F7340D83FC18107754CA4A7F9A92ABC9D6E02D20B36D9B59F2DF2190A713366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659899, "uuid": "ee9f9fd3-da53-49fa-911c-3fc8af94bcef", "value": "643ebdf6c61886ec0dd55f3c7b737569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659899, "uuid": "75676dc1-4e7e-47f3-88a1-5b8ff2170fcc", "value": "12288:ZeNUluhoK8GDJyRN6JYpcWulbdPB+JtHjmUyf02aX59Y:flI/k76JYy3RnUi3f021", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659899, "uuid": "bf1c0e7b-4693-4eab-9528-22d9f2e8235e", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659899, "uuid": "20470b30-7892-4978-bb33-a851f9bf95b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659899, "uuid": "2dd64503-1f5d-42dd-8ebe-eaaf4cc0efc1", "value": "7674f1f7b2b53467fec308bdcaf89c80b4d25eb683ac0ad105084b3dd5cc0cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4879279-0cbe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630677402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677402, "uuid": "39786432-296f-4f02-ab0e-444f161daa80", "comment": "Malware payload (DiamondFox)", "value": "f6336737452a7a106dde9be8ba468a0c", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677402, "uuid": "fc6dc5ce-6e73-49b5-ba4c-43debb77de49", "comment": "Malware payload (DiamondFox)", "value": "76c9ba959cb30c682c744ec265b3ae18fa5f92250cdc153139fb83835ca17356", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677402, "uuid": "7410782f-c4ae-4377-9a8d-25808d66a7d7", "comment": "Malware payload (DiamondFox)", "value": "19b4f742ad0beb3bd2306b8e8b1d989e52a01365", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677402, "uuid": "e0254f3c-34b2-479b-82c8-37b8f836f674", "comment": "Malware payload (DiamondFox)", "value": "573b0631cd373b77ffee96fee881931ef55dd02959872d1f7a1006ac28a78c4d48b9f53758f949a87681cf1b62c8a2ef", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677402, "uuid": "7c71e08c-beed-42ad-96b4-e34f552ed623", "value": "T12606333845B6B5CCED335C342A7484EA16CDEA931E17BE8F22030AE9FC166745664FE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677402, "uuid": "3103be2b-f335-4d91-b466-af39e8bffb98", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677402, "uuid": "878befc8-b46f-48dd-914b-a61a94c21c49", "value": "98304:ysevup9c1bf8FmhU3sXZi1ZsarTqLpRgj+uMeCm6:yI9wBhJYZsATqYCuBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630677402, "uuid": "2b327eba-6589-4e92-858c-8c6c3bc52504", "value": 3770717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630677402, "uuid": "7362ee0d-69d8-46df-8d24-21f42d47144d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677402, "uuid": "379a872d-a317-4b0a-9c98-793bbc97ee40", "value": "F6336737452A7A106DDE9BE8BA468A0C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa050f3-0cbc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630676400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676400, "uuid": "5e019cd8-6096-49f9-b0dc-81bc94631d5c", "comment": "Malware payload (AgentTesla)", "value": "363ae44357f10709698686a3ac11a2ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676400, "uuid": "d0b7a3a2-0bc6-4f2c-ae16-6ba6ab3f2ea8", "comment": "Malware payload (AgentTesla)", "value": "76f10c642d9be6759a4a1b94cba83708597d60a9a7dbb05bd8db971e75545d06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676400, "uuid": "132e9b51-28d2-4a0c-95fa-7d2c3e48a741", "comment": "Malware payload (AgentTesla)", "value": "0953c52007c15dfce4f969a1f00112c126784654", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630676400, "uuid": "51ef9e65-4bee-4913-bb77-db8f14b75989", "comment": "Malware payload (AgentTesla)", "value": "c1fbed787db47b60a992a10722fb500c1e2080627f0db92e7db4b362b36d8edc5abd3074a953f690286f5a6690542aaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676400, "uuid": "ba310428-807f-4733-a278-0a7afaa5c2c6", "value": "T1ED44B761F385E45AE44208797829DF711066793468B8C40FB7CA7B1B29F33D7A42AF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676400, "uuid": "ba21efc5-d459-4a57-9c93-72fedb74f2b3", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676400, "uuid": "32052aa9-e63a-459d-97b1-13ae14351cbb", "value": "6144:cQEfD/i1lkemVTtuASZNaEz2pjoLlhGiHVe:ymetufNhLb3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630676400, "uuid": "0f55488f-d87d-45fd-be9c-8cf35e6258ea", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630676400, "uuid": "08d5046b-c74a-4d05-903f-4f5f6f5f9051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630676400, "uuid": "4b0a592c-a2c8-451b-a144-64ec2348634e", "value": "payment reciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3682dd52-0c66-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630639368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639368, "uuid": "31d73705-6e0a-43f8-a3b0-666983ba1854", "comment": "Malware payload", "value": "cf876d4261e9141b8ca7e4b4afddc4b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639368, "uuid": "01d76715-03da-4468-b165-ec2933eceae6", "comment": "Malware payload", "value": "78ace6504e5788bf90b2b06106a519f8096c8b6e0200667c6fb60f6bebe09ef2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639368, "uuid": "9c1e744a-ef35-4d5b-a095-1df25942cc23", "comment": "Malware payload", "value": "994f15df29b8a85207a8db033690225c3b1784c4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639368, "uuid": "6567b793-d785-4c4e-a87d-084a4ec2efb4", "comment": "Malware payload", "value": "05accaf57da31458189748c95d6a6d42450ebb755e0d4d597091af53cb0d744f98e74618b9d9c44c47265bf6d1ee17c7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639368, "uuid": "2d35c2d5-c447-4f0c-8377-3f137f25c0da", "value": "T1A9227E6DD141FC0BE026047DF05983F0E32A5062A512B97F2245B39D07E16D747CFAAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639368, "uuid": "497cb9ae-5734-4f99-a5de-87b93d813706", "value": "192:ScIMmtPi95kG/bGv7m7sOSxLRmf0krFnuTE3ZZN:SPXIBGv7jOSxLelrFnuIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639368, "uuid": "1f3ffe5a-6091-4dce-b66b-69168db63214", "value": 10336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639368, "uuid": "f87bf207-b8c7-4757-9298-780c7b2f8387", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639368, "uuid": "af26d051-2a66-493b-b3d0-398f45a8f4d1", "value": "Payment Advice.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb2000a-0cd4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630686923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686923, "uuid": "f3956c49-480c-43d4-aaef-8777620be683", "comment": "Malware payload (Formbook)", "value": "7e5be1a0006c39c91d220d83fbfa0322", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686923, "uuid": "988aec9e-e6e9-47e7-9058-6a5dc7c52f39", "comment": "Malware payload (Formbook)", "value": "78f29cb2a0bc66083935496f436e08b65f41c3d73cc18e614b53b1aba196905f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686923, "uuid": "43cde3f6-3f06-4c15-83ca-7d300c13b7e8", "comment": "Malware payload (Formbook)", "value": "e48d8df277539b9e2b16998bc5c5c3b764d4951e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686923, "uuid": "ee25c390-8163-40f5-8fce-5811888fafae", "comment": "Malware payload (Formbook)", "value": "863d543838b3b9dcb264bc01f6f0eee32e1567beaebd644bc0fae3226b5afe937ba540114547424adb3d4548c2f2dd21", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686923, "uuid": "9c91a8b6-7448-4558-8adb-82f408e55627", "value": "T1F2B2FBADC06706988F89ABBC5B1B5E81108C7B6DF7885532727CA77827D2E3E501393D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686923, "uuid": "d376a5f4-0bfc-4cc9-a83d-4f2c0b4c9daf", "value": "384:ZqXI+ydXWWxis3DYpc/CfIvAbDpIYTUPb7oeJq9:3hhioUVfIkzTY3RJq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686923, "uuid": "950e512d-ccd9-4fdc-8882-87460db4784a", "value": 24132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686923, "uuid": "244213ac-c9d4-4840-9338-e58370cea906", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686923, "uuid": "666a2240-ada1-4ce6-bb86-beb3e0dc90f6", "value": "aucun objet.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2866cbb-0c8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630655038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655038, "uuid": "5f48d76c-0950-433b-aada-0421d0728462", "comment": "Malware payload (RedLineStealer)", "value": "cc0b2c8753c5da2d04ca89ec46b7a5bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655038, "uuid": "da1a9692-fbc5-42ba-896b-fb5c3167f80c", "comment": "Malware payload (RedLineStealer)", "value": "79bbe7c7ef84ba66a2fe3065e9dd6b94506aba431dcd55e6d3b7b6bfc2bfebd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655038, "uuid": "666d8be4-fee3-4dd2-97be-85e085624dcd", "comment": "Malware payload (RedLineStealer)", "value": "0d50cbecec79b5ea839a92a2307217a19718c0d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655038, "uuid": "3ccbce4b-2ee3-4bdc-8f23-a6ef7d0ec8be", "comment": "Malware payload (RedLineStealer)", "value": "1d3085355db8d8c45881171171108b30589267cfb9383c283cb5a3c94754cdd3e4464f39c368efb88649ed327ab77416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655038, "uuid": "44e683ef-f06e-41e4-9c1e-0c95bf0b38c9", "value": "T12254E0317A91C433D9E396356875CEE4163FBC215924818BB6792F2F2D323D29AA131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655038, "uuid": "aa6061f1-50ad-4764-9847-acb1a441df58", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655038, "uuid": "4c6d13df-71ea-4b2f-a554-9932a0fbeda9", "value": "6144:nI7zL71WBpKtTMhdL77oThF0qtMIbz7tVvMGnLK:nI7zHctL7+hPt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655038, "uuid": "2c63abe2-3df6-4762-93ae-ab6ae676858c", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655038, "uuid": "2fa0fb73-b111-4754-a08f-f7ac0fac0bd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655038, "uuid": "15ba9d4f-5d8e-488c-aaf1-e50a4a996609", "value": "cc0b2c8753c5da2d04ca89ec46b7a5bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7be6157-0c78-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630647342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647342, "uuid": "3ac8dd02-af82-4f47-aa8b-4c873256a6aa", "comment": "Malware payload (Loki)", "value": "d7d72ab4886998af64187027be3daeb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647342, "uuid": "72fb50a7-cd45-4181-b002-35414728e396", "comment": "Malware payload (Loki)", "value": "7ab995509fe427c2646b10be0715c40138ef4da7da41101452c66cf42e081c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647342, "uuid": "7773c9a8-ee86-4547-9d11-edcb0406aaee", "comment": "Malware payload (Loki)", "value": "4950728685c38d6f9835356b76b13d5daf461353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647342, "uuid": "f4bcb28e-2b94-4e86-bd27-6ce111ad6f3b", "comment": "Malware payload (Loki)", "value": "4b9b08d7cb2f0a66a924bb749ee7f4d4054d867ffdcb6f030a18a68c4fbc062e5e8f31fc9bd7928c060575094a137e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647342, "uuid": "d8104aa5-e20b-47af-a253-f0a9082060b3", "value": "T1F4A49D5C3651B1DFC817CA76C9A41C20AA60A47B530FE343A49726ADAD4EB9BCF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647342, "uuid": "86a91900-24ad-4480-bc50-e780d9ab159c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647342, "uuid": "c3b441f8-bafd-43aa-913f-f9755528afdc", "value": "12288:Dw8JnZwcBM92krSXo64JkiLVotV4cLcvTTXxco3zSKa:5JlxkrCrWyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630647342, "uuid": "34f2b411-0a9d-46c1-bec3-8486e98d4b30", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630647342, "uuid": "8675f734-b943-4491-a8be-bef74653f901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647342, "uuid": "85704664-26c9-422c-b21f-7bd6826f66aa", "value": "doc_4585377403.xlsx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6949389b-0c68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630640312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640312, "uuid": "d5581c15-2b5d-4ba0-b092-273fb512b8e6", "comment": "Malware payload (Formbook)", "value": "beee308b51db0c02f8eeebf7d2773a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640312, "uuid": "1bc2f675-701f-4f1f-9091-e873b3700134", "comment": "Malware payload (Formbook)", "value": "7af335cb2a2646ddadf12f730585a217523da868aaeb12ba621b367c1b942693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640312, "uuid": "f4ba76c6-3011-4d7a-a300-c52b08721eed", "comment": "Malware payload (Formbook)", "value": "4df5d609ea5b05dfcba4b9e51120a10374f7d450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640312, "uuid": "030d0ff5-7f56-4895-a6b3-d0b696abe73f", "comment": "Malware payload (Formbook)", "value": "b1b9b768d1fabca17312e30478f7707ec91a7dcc0d05b02237de0d8ad65521941bf5dcd3f2dd9fe23d6cac69fc70b554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640312, "uuid": "1204207d-78d7-4a7a-b82c-5efc0ed150e2", "value": "T138B4230CDB546B3BCAE8C4BD709384A447B9A58F7727E78DAA4E11AC46123CCCC512E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640312, "uuid": "eb024eec-e209-4693-967d-a63f9f09ede8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640312, "uuid": "76bf8af9-234d-4ef9-b7ae-6b7b052e792a", "value": "12288:xjQxFwVygVZcnxaRjV1p/EX66D70vhWzwl7M:OUoi1JEq6kvawlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630640312, "uuid": "d6ac3afe-5ad5-4766-8dad-6095db0e772f", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630640312, "uuid": "20eb942c-1d48-4d57-a23f-98053a4e0a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640312, "uuid": "e88bc42c-723c-4bc5-82b7-e96f890a084c", "value": "grace $.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb17c8d-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BlackShades)", "timestamp": 1630660266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660266, "uuid": "d9f27053-3854-49ec-93f1-1d9624519bdf", "comment": "Malware payload (BlackShades)", "value": "d69058524425ca7fd0b0fec9fd8dcb29", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660266, "uuid": "e7660904-46b4-4a7f-aa60-a99d912951c2", "comment": "Malware payload (BlackShades)", "value": "7baf3c990d60d50353caadebb5909aba4dd9b6331cbfdff7680f7d37a0b6498d", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660266, "uuid": "68cf531e-1659-4cec-bbbb-9ef461855292", "comment": "Malware payload (BlackShades)", "value": "ccbc78b39dabcb77bcbb637d959766c349cea351", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660266, "uuid": "01c487df-8147-4ea9-9396-d85d9bc2c925", "comment": "Malware payload (BlackShades)", "value": "be59ec4d5cdad6aedaf651502f422886c58357aec6bcb74a3e8380db45a4c051e31a66653e13fad2628d40a12bfe55e3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660266, "uuid": "cae862a2-7c76-4026-9ca6-fc63a25966c9", "value": "T1E1C43A1396F52E90E9F3DFB644F5C42A2B237C269D238A1E1551231E6D31A80EDA273D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660266, "uuid": "f33a1046-db07-420a-bf81-2df3d6753acf", "value": "768:TvRdPssW5z+NFSVBDZ16BfuKlA5ZihDigAUWUOWbq0pdGrgWc4v/bmTZ:TLv/jk+0odPAUWUOy/Wc4v/bmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660266, "uuid": "293f9c75-19f9-46b1-9d88-8e5424d67181", "value": 580440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660266, "uuid": "3cc06a2b-f132-4d5d-8fe4-3dab91386f4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660266, "uuid": "c364cad0-6359-4e2a-aa92-4ab3f72e915d", "value": "7baf3c990d60d50353caadebb5909aba4dd9b6331cbfdff7680f7d37a0b6498d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66fabd4-0cb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630673083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673083, "uuid": "6135f83a-1270-45f9-b0a7-32bcef4dd8ec", "comment": "Malware payload (Formbook)", "value": "379088ac1a059bd605fc961bd94ff48e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673083, "uuid": "dbe189f1-bd99-45db-be7c-f1bf64e51153", "comment": "Malware payload (Formbook)", "value": "7bdfa0456c326f2f8081e9aa456395a2db775e24037c62efc52ab89d2b25a172", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673083, "uuid": "080e7363-310e-484c-acdd-5cc597a976d8", "comment": "Malware payload (Formbook)", "value": "179c05f71550bc310ca0805d6a3e56ebffff5dce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673083, "uuid": "892fb08b-b9e6-42c5-8219-74528b10e367", "comment": "Malware payload (Formbook)", "value": "2b1858b39e3f44555fe7e9fde4bfaccc3e6e403bdb19c64723534a844d5d72e4f1b1f6f049f6ea88961cb4e32607b144", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673083, "uuid": "c1882d77-aad2-41d1-bd64-7ef7e72f8f01", "value": "T12E92A4ACC1A70698CF859BB8172FAF4502CC7A5DFB58A532327C573417E2E7A551283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673083, "uuid": "eb68ca5d-b50a-422b-8e71-32a0059bd2f4", "value": "192:I46Yx6avwnTOE8T26NO9ercBPH9Q0HH3QD8oG45x93NkHzjewYnHQXMezCiFGpT1:D1eaKoQBl5n38u45x9dkhYnHQ8PiFLEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673083, "uuid": "135f5d4c-3677-40be-b671-56c664f3a3c0", "value": 20895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673083, "uuid": "a0f97538-bdf4-4b94-a1cd-b9324e3b5d8e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673083, "uuid": "e1d1b489-9fca-4eff-baaf-868c9b44152c", "value": "New Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d348983b-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630674849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674849, "uuid": "d98def69-44f8-457e-a315-9b0d80644ef8", "comment": "Malware payload (AgentTesla)", "value": "3ab485299c39c8a89e0d7031a8d0ab6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674849, "uuid": "24b4cf1c-7b30-4d3e-9720-e5887213a286", "comment": "Malware payload (AgentTesla)", "value": "7c09535cd87ef7bd13d91b73e029c904c8905b700d935e39d9375c60bf17fb71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674849, "uuid": "031758b2-8e21-44b1-94d1-80d638e5fff6", "comment": "Malware payload (AgentTesla)", "value": "7fd60290d1e9605914b7c911ebd397cd4c462e46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674849, "uuid": "6dd9f9fd-13fb-4850-a6ed-a4326400004d", "comment": "Malware payload (AgentTesla)", "value": "8ede1689799cbbc2a6f39276266973d9688085a376df569fc48500870699d846658d3a181514a51cf610c0f5f99b409a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674849, "uuid": "0beebb33-a9c7-4cc2-82cc-3bae917652b9", "value": "T17815E1107B80EA4EC27F4F7A4C905450ABF8E666470BF7877CD126ED098B36A4A17376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674849, "uuid": "49ec7dd9-e49d-4bb4-af29-f47f5fffadf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674849, "uuid": "5fe150f1-865d-4f84-a2b3-c4d64d979bdf", "value": "12288:4NUKrOl2dZbnt5h45tQ/VZmZkZYKHiu7zCy4zof8CWiiNsqbVHa4QPKuJ:4NHql2dZr945t8VZmZkK7wuBm8jFVHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674849, "uuid": "0d5e4a5b-20ef-4335-bd3b-77a7ee0bb3b4", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674849, "uuid": "45cc3b14-99db-4a3f-89df-99c8bb409493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674849, "uuid": "142710bb-fcf1-4d33-b393-cd6f1d7d5501", "value": "MAERSK BL& SHIPPING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b513647a-0c82-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630651606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651606, "uuid": "b977c550-27ca-4ca7-8660-56c529b348dd", "comment": "Malware payload (AgentTesla)", "value": "7254283b53f1501384787e72decc6d9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651606, "uuid": "b054a65e-5d37-4f8c-b1fd-9e6e00b2d412", "comment": "Malware payload (AgentTesla)", "value": "7d651771e88d52df36c36062179de3fb0da569bf47ddc7077454f8d79f6f91fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651606, "uuid": "8495927a-9f99-4c0e-9457-f96bcad9e027", "comment": "Malware payload (AgentTesla)", "value": "50f98102d0ed6c1223af1027923adeea11815991", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651606, "uuid": "6fbe8944-ba43-4f67-9854-b337e7527945", "comment": "Malware payload (AgentTesla)", "value": "79cd26ffe33dd3446bca4ee33a89bced69bd442d254ea6a4eb3228f6ac437518ab2beb90678ad66667259b8a20759680", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651606, "uuid": "0b367c8d-6429-4c77-9490-0532d1a6abd0", "value": "T184A42376F64ED4F72BF74DF029888C1A24CE3B655D6AAC8D433B78D3801A6D125048DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651606, "uuid": "53c5c57a-cf50-4494-b438-bf19fc2e84ee", "value": "12288:vY7TqMsiG9ecR8XR0P+Uaz6APqm0RiM3luVTxh:vY7Tk9ecW0+72m0Rl38Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651606, "uuid": "98538f54-d0f4-42fa-9bd2-018306d4b11d", "value": 464898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651606, "uuid": "b5ebaf6b-6b02-4782-8ea9-6ee49de48c71", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651606, "uuid": "3be2dc16-5d18-4d3f-b435-63a09b648048", "value": "BANK DETAILS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4d3ac7-0c7a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630648132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648132, "uuid": "ff89e538-4e34-409f-af7b-a342b95b3d96", "comment": "Malware payload (SnakeKeylogger)", "value": "04b9ceefad8338259cf0c70d2899e3d8", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648132, "uuid": "fd6a6819-b2b8-42b9-b9c4-690f011736c4", "comment": "Malware payload (SnakeKeylogger)", "value": "7e05870f622bc5f8fdee846f0fb9f16595a5bf446e4a4f1c54eecfe2f61b52f6", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648132, "uuid": "a2600a91-63d3-4704-a477-af790a21aaff", "comment": "Malware payload (SnakeKeylogger)", "value": "40af2e9b269a3fa3ac48dca0a1b911f4555b9c5a", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648132, "uuid": "dc8c477c-2b39-4154-97ec-3f36a6095487", "comment": "Malware payload (SnakeKeylogger)", "value": "a85b4c3f55a76c333585c96e800c81717147b3044f8b01f51916a8bcef4f8dae7cef411c259555819253d1f9eb5ef874", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648132, "uuid": "e32d5110-ee66-4c3d-8d43-1bd5c8a057ef", "value": "T112D4233F684E56A473A7DEFA707434298C4344F987FC49C793B301299B5E2D2A4A706B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648132, "uuid": "94ca0cbd-5174-4350-8e48-659f0aedd426", "value": "12288:zmi9HzkEcz/HvW1EeL5Sjf49maKv0gVOhU1pvTpbJOjY2IzkNGLDjjpy3D:aIc/HvUdSjf8mxvYCvTp4Y2iGGXPcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630648132, "uuid": "81dc4023-bf75-40f8-9e56-35a89febd7c9", "value": 621399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630648132, "uuid": "fe929c1e-59ad-4297-8815-50d80c3f067c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648132, "uuid": "b068278d-60df-4730-b3e5-34545e0aaa1f", "value": "OBL PN210700369.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87af0bc7-0c7e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630649812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649812, "uuid": "15d2472c-0660-4b70-9f86-3601a27f5d5a", "comment": "Malware payload (AgentTesla)", "value": "83052530dc2d87ea00f921ce5a681f43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649812, "uuid": "b608a711-a27f-402a-afb4-32276d3413f6", "comment": "Malware payload (AgentTesla)", "value": "7ed660effe5fdddebcf65d0340744f2d0642d00959a22f3023fa464e686532b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649812, "uuid": "57c30878-5466-4901-a83c-b922c0ed52ad", "comment": "Malware payload (AgentTesla)", "value": "b3eddb4ac41c8f2e490070579d5da4bafd4816a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649812, "uuid": "184588f9-e8a7-41e1-93e7-09a97fae4826", "comment": "Malware payload (AgentTesla)", "value": "18ad100e1da9aeeac23020f58900275e5ed3a0dc077be4c75ef9157b91df47bdb193703aaaa23dc7e54bb749aad16a1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649812, "uuid": "c8b0f70b-6235-47c1-aff0-bd9a3002fb48", "value": "T152E40B3E58FE23279176C6D5CBE08823F6C498AF3233A96567D747264316A4674C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649812, "uuid": "29714dd1-073c-479d-93b1-85381d7fd20e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649812, "uuid": "0990a3a0-176c-4a21-bef0-37ab24abdb0a", "value": "6144:EFJLgGMFqDNmmMU4eSXXFiXZ+crw3bzF6Q7HOAAfh5hrxhH9+bSUfuSYd:GD4uZSX15fz4Q7HUHhrTdhguS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630649812, "uuid": "14bc12a6-12b7-4625-99f8-0093477c782b", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630649812, "uuid": "a1025bbc-7ba3-485c-9787-eb8e2fc93ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649812, "uuid": "64399134-c722-4776-9c30-3d2a7e9cf7c3", "value": "TT Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf62212-0c9a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630661739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661739, "uuid": "21563e4c-c6d2-4b48-bc63-f23748eaf45b", "comment": "Malware payload (AgentTesla)", "value": "f2fc49d1054e65b2b0de1cb14c93541a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661739, "uuid": "855621b0-cd5b-4043-970f-53ae12df233b", "comment": "Malware payload (AgentTesla)", "value": "7f3bc638d00a6b3fd61d768fd39047fc87b97942d809d16042770d42d0e0da24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661739, "uuid": "3aa70893-2530-4304-bdc5-08a0c2eae13c", "comment": "Malware payload (AgentTesla)", "value": "88b29e99127e249d7457eced8e532d85e4133958", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661739, "uuid": "83f5f108-1a92-422e-a2b7-4b706fa91b91", "comment": "Malware payload (AgentTesla)", "value": "fc826b61f88e1cb3a25082923bdb52ab2b8c42f5d3d41e41665938e02a6415bfcc3a88957aeb7f7fb95d32176081658a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661739, "uuid": "015830b0-d48c-4082-b10b-206c956fc819", "value": "T1E0A4CF9C365076EFC967C933CD981C64AA61B47B930FD203A45312ADEE4E69BCE150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661739, "uuid": "89547657-6f99-4e17-82b8-108f6fdaaed7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661739, "uuid": "57f4b7c6-1087-47e3-82d4-5c597e21d7a4", "value": "12288:srT1ocfv5dg9fxBXzKsQvXSQBtR9uMdVciOafzNK:sr2ag9pxzKL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630661739, "uuid": "8a8bb8da-b98c-4a4b-a53e-10a647459733", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630661739, "uuid": "374c2976-a0f4-4558-950c-b41d8fa2592b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661739, "uuid": "0f379a40-5e51-4d0e-b842-9a95b19e6ae1", "value": "SecuriteInfo.com.MachineLearning.Anomalous.94.8891.16126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37f1ae2-0c8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630655093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655093, "uuid": "88810863-e2ae-4cdc-9d8b-2940490c07af", "comment": "Malware payload (ArkeiStealer)", "value": "5e990c5457707f41c3b72acefa304932", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655093, "uuid": "86a59616-f388-4548-b4f3-fae86e849182", "comment": "Malware payload (ArkeiStealer)", "value": "7fb3e8a0c4b50a519c283a7b7702ccd23c38e78dc251d32b120d8e8a89f87b49", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655093, "uuid": "3750f966-4a9c-49e0-b0a8-2118df80f51a", "comment": "Malware payload (ArkeiStealer)", "value": "74170bf430cfc225768cffdb976fa68b917ae9ac", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655093, "uuid": "70b9168b-97d5-4c50-ace3-0b0d43ccf5b2", "comment": "Malware payload (ArkeiStealer)", "value": "ec99efeb5611f9f2e8601a743d9cfbc9279e7a16301c01a18639306acc57c8dadfafa6856f5d7bc0949f6f559d1c96e0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655093, "uuid": "0ba232af-31e9-407d-adfe-581edde14919", "value": "T16414AD217AD0C073D8E286704D75CEE1263FB8719964848776783F2B6E712D2AA6235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655093, "uuid": "f873ec5c-c51f-4423-98e8-461a8c35336f", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655093, "uuid": "f9eaec39-a5c3-4343-8bc6-b54737d064d3", "value": "3072:TjxcoLwFA0HmgidzxalFl8V7WnDn54XtjSwrv9ENPGvi1vw7KJIX:TjxLLwFA05NlFl8VLtVvMGAvw7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655093, "uuid": "527fc19a-729d-43b3-8c9f-009a04e8c1ae", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655093, "uuid": "b5d6223e-f33f-4769-95c1-16aee39649dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655093, "uuid": "49f149c0-e1ef-46dc-85cb-de6937088c8a", "value": "5e990c5457707f41c3b72acefa304932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca085e7c-0ccd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630683853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683853, "uuid": "ce4a2aeb-28eb-493e-9538-fa24e0821104", "comment": "Malware payload", "value": "12d6c06da928ba52f45838a069632d08", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683853, "uuid": "c177a255-c33c-4170-aba2-723ff67aa4c0", "comment": "Malware payload", "value": "810f3744f25894373f1f60ba7805409a8e2c941690058dbc7f49c7b7077c4861", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683853, "uuid": "c9b835af-c8ac-4060-b086-fb00a119fc59", "comment": "Malware payload", "value": "c1d7f0c4698df445851178fc1cdd886906a01993", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683853, "uuid": "bee214d4-e220-456f-9cbb-b54f128278ab", "comment": "Malware payload", "value": "c787fe3ae2c45eb0047f387f0c63ec01f84adb87245dd8fb2b99e64001c9e26f9cceeee1825d72112a76d1666835f017", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683853, "uuid": "b382bb02-2119-4de0-8e9a-48b72a15dabd", "value": "T1217422587B49EB0BD807A67D0B128EB219A0EE89FE7F989911107B1C847F3F5114E727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683853, "uuid": "2345aa02-88c3-4d79-a6d4-6beb01f0ee96", "value": "6144:dWBwaAQIi11B5dis77sjR+afo86kpKNq1RFE0PycpQNHYSsgtpWVcWlq:EBsQf11BjiZwaQ86iKNqnFFyUSsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630683853, "uuid": "e45908fd-ac67-4943-a282-97ff9a2265f8", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630683853, "uuid": "96dcb0e2-0fc0-4d49-889e-8b696ac2c5df", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683853, "uuid": "98f97374-3f01-4406-923a-727d11951ba8", "value": "RFQ-M1723F99.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3ccedf-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654380, "uuid": "4083ebc4-0bfe-4037-a32f-5d46a035e2dd", "comment": "Malware payload (FIN7)", "value": "8f5302dafa90958117cbee992a0e09a9", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654380, "uuid": "13db2c85-3435-4913-94bd-e1d7a9727551", "comment": "Malware payload (FIN7)", "value": "820df29031263bbbcc9f80ff560ddb478060c771318b2a7e74f87946e13d6f9b", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654380, "uuid": "2b5f576e-7a28-4425-9697-681efd74e3de", "comment": "Malware payload (FIN7)", "value": "7c39c0f7f4e757fe1548262ddd106b392f1d8bf7", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654380, "uuid": "d912e03f-7884-45b5-96cc-2c4d4e5ee8aa", "comment": "Malware payload (FIN7)", "value": "8072e318a57f9c945cf2659f3bd8a11fd1c48e3b234e02a8f31d99201e1c9c777a2feb0147f4165522909afdafa3ac3a", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654380, "uuid": "e6120505-3840-4e9f-9f96-d4c5e5181dc5", "value": "T1BFE171846CAB64C5342230A60A1FA15F393191B978DBF7C27590D7E2ED7BEE0709C670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654380, "uuid": "7db3b996-e830-47dd-aef5-de3ee1f2022c", "value": "192:wUrG7aNdSUnD0XilYqUItCYG5mbybA3gT+ZmoMiQuS:brG7QRD0yiItCYambL3gTQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654380, "uuid": "6bb0e3f4-ee1f-4fc0-b72e-8b3b47004217", "value": 6784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654380, "uuid": "b8f56611-e32e-40c6-b8d3-d36b14778880", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654380, "uuid": "9b1a018f-c920-4cb0-a447-14ce143b017f", "value": "word_data (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71635ec6-0c65-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630639037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639037, "uuid": "f0ac0598-d523-487c-9749-45dbe01bd656", "comment": "Malware payload (SnakeKeylogger)", "value": "8c68fc26effd0c6d4a12722fbcefeeaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639037, "uuid": "1cae85c1-bb33-489d-b7b1-aca79684d031", "comment": "Malware payload (SnakeKeylogger)", "value": "82c48c73887a3f56ba4945e9265d9c616658b0f367d99e25d80df35beab5b6d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639037, "uuid": "5d7e3d27-a04d-4a17-9769-6e3d841ed851", "comment": "Malware payload (SnakeKeylogger)", "value": "afaf20127a23b5931b421ed0ce939ae2cb9164fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639037, "uuid": "e16eb9d3-bfc5-4005-a2ff-64d0bc6a912f", "comment": "Malware payload (SnakeKeylogger)", "value": "df4d430f8410a54ab09bcd0e03bcbfb65d69c7025da5b8681bc9461be70e38eb1f92513769da38236732ca8c1a39352f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639037, "uuid": "6606077c-9cf0-49be-9b4d-bf3744b46053", "value": "T11CF4C0147B90EE0EC17F4F7A49900450ABF4E666570BF3C77CD122ED49CB3AA5A1B226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639037, "uuid": "c1b5cd63-acdf-4a77-acb6-520709207058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639037, "uuid": "aa32f981-af6c-43db-9ea7-ce916b767413", "value": "12288:x5a3f2EaUNP6h/I4yozMhhS8jYEFJr6ZrMUiQO34owtnrK0fYjw:3q+EaLhFf4i+lQXn20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639037, "uuid": "3562a873-b442-4792-aa28-5fd882ca8740", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639037, "uuid": "d70ac1af-8ce7-45ec-9fcd-13deb1666823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639037, "uuid": "6f02e54d-4139-4422-84ac-150346daede6", "value": "Transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29a23e5-0cfa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630703141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630703141, "uuid": "2f5ca3ca-5f18-4a53-a42b-224414d36b27", "comment": "Malware payload (Mirai)", "value": "481dbe7cf4baacac4fafc48b3efd51ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630703141, "uuid": "70eb80d8-8a61-4948-a6f5-de2512805ee4", "comment": "Malware payload (Mirai)", "value": "82fae4b9c74698c49a385910295692673d36ed9f5641f2361356ce878610881d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630703141, "uuid": "c8ac3782-8d67-4cfc-a5a7-8e59b63160a1", "comment": "Malware payload (Mirai)", "value": "665a8af47d910bf7a510490cb9c2adc40d0e2021", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630703141, "uuid": "ec548c12-991c-4748-85a4-52f7b7ff17e9", "comment": "Malware payload (Mirai)", "value": "96979a53240f4061d04c8d294200a8ec5eea9ff429bca3f39fdd55f0928b5870ee9c30c840f7a93ee1a872f784ad5e5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630703141, "uuid": "ccab3278-9e60-498c-a0e4-550b5bd8cd47", "value": "T194630682BC80E616C7C01677FA2F518E3315A7D9E1DA3242DD165FA07ACEC1B0D6B786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630703141, "uuid": "4fc76a76-c863-402e-8fbb-9a744a4d3504", "value": "1536:b4blEKw06Z1XjuxfEQ5m5YB8t46zHMSksJM3:b4bllw0WQ0484EHvksJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630703141, "uuid": "0eabfc39-1a6e-472f-a23f-257ced47da1c", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630703141, "uuid": "d0544213-bf74-4ff2-a418-98f838ad10dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630703141, "uuid": "95dd098b-07dd-429a-a112-2791c972706c", "value": "481dbe7cf4baacac4fafc48b3efd51ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a83290-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655263, "uuid": "eb7dc860-0088-4257-b877-b5005ec5a765", "comment": "Malware payload (Mirai)", "value": "0b4eff046552c042af882e591c0657e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655263, "uuid": "be44ca95-440b-40e4-b05c-61f470e67eb8", "comment": "Malware payload (Mirai)", "value": "839f4e21e4bfdbc9339571087340f40003fb69e11b7213c9e34f1cbdcdec8b7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655263, "uuid": "236eef0f-adad-4b1e-93ce-d974ee63cc41", "comment": "Malware payload (Mirai)", "value": "c31fa0cde8d37d7a527ff63aba9c5842de16d5bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655263, "uuid": "54dcfc0b-1355-4fe7-821a-67595a3c3713", "comment": "Malware payload (Mirai)", "value": "c522e3952b20968377408c3e381ee05e51e0d84d589c492711301b41409278608487cce070165af40e39283732c1cc7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655263, "uuid": "2709ed1d-0a7d-4a14-8078-bf1b97285b12", "value": "T1D143D695B883892AC5D413BBBA6E11CD332477E9E2CF7223D8105B647BCA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655263, "uuid": "facdf9a0-1a76-4a96-b5b1-2f93dbfe13c2", "value": "1536:1r+ko34/nu29aZOAQ6abRNZ71+nkZ1j8rgPvIyi1Wrz0nn:Pnu29+Ox6SN5Ok7Irg3fiErA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655263, "uuid": "a3995789-f594-4f5b-8542-929949e4bc10", "value": 55316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655263, "uuid": "e29a2d10-850f-4756-bd34-c37f761a21e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655263, "uuid": "7bea5113-f896-4736-bf75-787ba474863e", "value": "0b4eff046552c042af882e591c0657e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a33a97-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686450, "uuid": "d74d6fd7-26e3-48d0-bec6-b2c91c0f1a37", "comment": "Malware payload (Mirai)", "value": "5c4a283f2b37a00b382fd7e1cfaf2978", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686450, "uuid": "97d9b157-5d61-4e6b-a886-74358db5eabe", "comment": "Malware payload (Mirai)", "value": "83f06f6027ff4793dead7649e7e9b7be32799315c8f07ae41a8015e2b3f8cc61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686450, "uuid": "ecedf982-622c-4d76-b8eb-c0a4f48e5ff9", "comment": "Malware payload (Mirai)", "value": "8e579baae68f4557cf383a8d9350c772a59426f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686450, "uuid": "66cc6b75-b869-4f67-9882-24890bfb0c64", "comment": "Malware payload (Mirai)", "value": "850e1830b801db842141ee344f6b34739bfea098c265b89e5793abfd416589b33441b4a01215144b26eb48552413e72b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686450, "uuid": "6cff0ceb-7e2a-4ac3-86dd-ed8bad42c8c9", "value": "T167630852B8818E15C5D813BBFA2E018D33126778E3DFB2169D106F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686450, "uuid": "dc76d19c-6c20-4ba3-83bc-7bba800b1947", "value": "1536:StnwsWjjS5+8hEWZc+mQM4fJL4Okw/RqO1do3YpPz9I5iY5UJ/k:MWjA+QEWZbbZx4OjcO3o3H5UJ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686450, "uuid": "4bc24cbd-29d1-410b-862b-6c0751f2f81b", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686450, "uuid": "c927284d-77c3-4d6c-aa63-242b60e57362", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686450, "uuid": "906d8234-9c95-48bf-8ed7-77b8b1c6b4a2", "value": "5c4a283f2b37a00b382fd7e1cfaf2978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fc623d-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Macoute)", "timestamp": 1630660300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660300, "uuid": "41a267c0-4ef6-4731-ad58-203b3ed124f8", "comment": "Malware payload (Macoute)", "value": "5f719f31be847ec1b05e33da90b23c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660300, "uuid": "984a220b-40d1-42b1-9a45-20faf2079aaf", "comment": "Malware payload (Macoute)", "value": "844c220407941a4a7f0678be04168e1554252a9a46c54436cccaf769d52b587c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660300, "uuid": "40ac218e-8476-4efa-9888-68f64d141543", "comment": "Malware payload (Macoute)", "value": "084cf97270e588b87f8f15c469cfd4c9e32c679f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660300, "uuid": "f8dbd6ca-d716-4f95-9d28-664b68c05a6a", "comment": "Malware payload (Macoute)", "value": "94fd064bd5bdf22a25cea1fce4fac0f68fbdee502434b7492afbdb2223f476bcf3b14c44907ca75edd2c076f07337793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660300, "uuid": "b34e4007-c1e5-48c2-852d-b97ca5fea42e", "value": "T1C9B4AE82EBD340F1D8970BB15067B37F9B724B0E502CDD9AD3942E56AC33223992E794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660300, "uuid": "91aa3a90-2223-4b76-a856-8f5f680aa799", "value": "23b7a2ad6dd5722f5566eaa0d8a348bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660300, "uuid": "047a2b17-0a93-4c14-8bee-1f23083ad197", "value": "6144:PafsiuvAQ+tTm6cyERSiytj71cWE4jKS6v:MCvAQ+q6ctRt636WfjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660300, "uuid": "c173a887-a6a1-44b2-b56f-427ccb57cc66", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660300, "uuid": "80439b2f-2eeb-4d69-b603-ed6c51426fd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660300, "uuid": "652979d6-2016-4ea4-84ba-30dbbc06e958", "value": "844c220407941a4a7f0678be04168e1554252a9a46c54436cccaf769d52b587c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21e5e94-0c80-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630650769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650769, "uuid": "b8c3263e-ab5c-4c51-bd6d-26241ef23440", "comment": "Malware payload (Formbook)", "value": "b9e743de98ab24b4f060361bc073b6c6", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650769, "uuid": "2c862f70-9feb-4bb2-8db8-5fba9c14abab", "comment": "Malware payload (Formbook)", "value": "8499b2fc484308fd66fa686a9d8cc559579e1a4e730be9b828234c1a8c4decbf", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650769, "uuid": "ddce44ee-4b8c-4cca-b660-1923e5dee9cf", "comment": "Malware payload (Formbook)", "value": "571870eebc13ac640c4eaebe05ab72b519a5f5b4", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650769, "uuid": "b7601f91-9009-4e2c-9051-9a0c6f059ac7", "comment": "Malware payload (Formbook)", "value": "ae3a702f620d2c1a42f02969b4995143134517331c583dadfae629e15b635c50cf9ccdc5963081ab27661f3d16a17d18", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650769, "uuid": "f4e00d8d-7dd0-4503-97ac-8780885bb577", "value": "T1CAE4238ADA97E4E37C20575B161E3A5BF146AC4B0F8618B137089F0E2676684C7E7C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650769, "uuid": "aabe99b5-dab0-4293-b46d-92d17fe904fd", "value": "12288:ClYFvKmvOIIsyE9D3u52mKSjp5FE0GqC5+AqL2r9uI2LptvWBqqUtF:8KOIIsyE9D3E2ZSjp5F9GB6609V9LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650769, "uuid": "f6aa063d-b7db-4af6-9df4-37c0e27147b1", "value": 676858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650769, "uuid": "caa7328a-49d0-47d8-9dd2-dd779063038c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650769, "uuid": "29747890-78e3-46b4-88f9-f17fca945861", "value": "purchase order No. 00109877 pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd359b4-0c87-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1630653664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653664, "uuid": "12b6fff7-877b-4175-8ca2-80c7b43cff72", "comment": "Malware payload (SnakeKeylogger)", "value": "6438ab52bb99f3aa031d78ea5721d85c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653664, "uuid": "29b6e7ec-1807-4acc-a804-f6dbbe3cc0f6", "comment": "Malware payload (SnakeKeylogger)", "value": "84dc76c7ffc1a51142d6d1f7df7d6e0d4852bc61a821f9e33eb560161ec00158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653664, "uuid": "7d12609e-9752-4aa8-a777-b796da9476c1", "comment": "Malware payload (SnakeKeylogger)", "value": "d6d1f7a919b8ba52760d3baad194b8ee3a16c7e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653664, "uuid": "55897417-1ddf-48b4-92ba-60fd9e47f308", "comment": "Malware payload (SnakeKeylogger)", "value": "b0d86dd91d043fbe7a6a41f622b26858a3c2bda8abd4d917b3aa96dd4f77cc7fa6c6448ee83cea71d05a154c18f93c4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653664, "uuid": "52342c35-5956-44c5-9937-8a439816b26e", "value": "T1EDC4C73E58FE23279176C7D5CBE18823F6C498AF3233A96467D747264306A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653664, "uuid": "28da8151-f85c-462d-9b9f-b9c173faee7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653664, "uuid": "0a4d19ce-6366-4d6e-bf55-91a1fe2cc0cf", "value": "6144:RFJLgGaF7KpFyAoW4HYSZ4UtbMz86MUDlc0+VFM0xpaW9BCsEBrg06:koUtwQSlc0mFDaE4rgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653664, "uuid": "44fa2693-7764-426d-8ab8-93c114855560", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653664, "uuid": "b233ac1a-d393-4353-9005-4f429862a79c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653664, "uuid": "8a5bfb89-6910-4b9b-9f26-0849eb589e9a", "value": "Swift TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8333f8-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659938, "uuid": "3381f7b3-51d6-4af7-a719-f5ec635602be", "comment": "Malware payload (Stop)", "value": "d7bee78cce3e29b0d6b6696f6c01e801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659938, "uuid": "179460c0-ec52-40a9-9ad9-6fd67cd97348", "comment": "Malware payload (Stop)", "value": "857fd1017141f401e9a263e477a80f000d9d064b891a1087b9a51220924a017c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659938, "uuid": "6b33f3f3-498e-4c2a-89fb-cd303c1d9668", "comment": "Malware payload (Stop)", "value": "0ff257b4e1518d8c5582c796ac55964d2a615aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659938, "uuid": "233ebe0e-8ba1-40de-8112-21468021552b", "comment": "Malware payload (Stop)", "value": "1d7b2357e9fcbdb33c265884fbf2c58a5e190c000cf79adb7cf1e1bbaf43b9fa1dc454e07a01739fbd488d353f935c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659938, "uuid": "f4d39ada-f708-4c15-83b5-d142f340b4fd", "value": "T1F405121B7663E47BF29006398C6073B5E42ABC4AEE16E147F2D4661F2EF06A05726317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659938, "uuid": "5bea1474-f79c-4b6b-949e-91ff79023ba4", "value": "72021c954fb2224cd9089a2e04035b9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659938, "uuid": "d30de19c-f745-4743-9fda-5ac87c8dc192", "value": "12288:vUijrlaksXJbp861gxPHVhoqA/5nFwfqbO5icnXJZZKaX59Y:zl0Xz86SxPi5nCfqbhcnXJC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659938, "uuid": "3f9aead8-8056-4724-b097-e264f8eaca7c", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659938, "uuid": "def2f9ab-e285-420b-8460-270645bb05c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659938, "uuid": "0e6e6e83-9ea0-4c72-b935-4293bc22fb35", "value": "857fd1017141f401e9a263e477a80f000d9d064b891a1087b9a51220924a017c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf311fa-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1630660313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660313, "uuid": "edffde58-1de8-483b-936f-63ac7c8072c3", "comment": "Malware payload (DCRat)", "value": "5d3c64b1c0bbaa648c6834a3b64fa2c6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660313, "uuid": "9fd3be8e-0d4f-4e62-ac85-b134a2ca6007", "comment": "Malware payload (DCRat)", "value": "860834da72a2fcbd5c555b0d187c7b1c3cd20ec3e25d2a1d81c18d2b68458a6b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660313, "uuid": "88205f9a-ddff-48d3-834c-981952f449cc", "comment": "Malware payload (DCRat)", "value": "5b0df5f0ecbccb6cbd124be90ea036a2927e09d6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660313, "uuid": "e52515dc-a052-4cb0-8068-cf8435a8f0d2", "comment": "Malware payload (DCRat)", "value": "b002b2584e9eeb3f975489bfeb35700da9cb8c01a4c12d6ea2a668b07d4bb7b24d36f96e18424f776eeefea426c6ac14", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660313, "uuid": "89118860-49d5-48a0-8872-3f6029354088", "value": "T150844AED0B88FD2AC5AE0779B0D9345867F9F1C6DAA2CB2D0CDD908879033B2559158F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660313, "uuid": "afdf8919-43ff-4251-b70a-9682ebcf522f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660313, "uuid": "bab55a03-fb49-4891-a04b-fcca6498f729", "value": "6144:687hTosCwFDF++c7CHwthm+2OTrQL480Xr0w7dqqDL:68iwFDAMHwhmvf9wkqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660313, "uuid": "08ec6f9a-c107-4139-8f87-5eb0c6656ba8", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660313, "uuid": "f265f8ff-93e1-4d72-8870-998846298b25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660313, "uuid": "16640e5b-8dac-4ea3-8972-662a144f64ab", "value": "860834da72a2fcbd5c555b0d187c7b1c3cd20ec3e25d2a1d81c18d2b68458a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a6f57b-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1630660331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660331, "uuid": "46461461-cc99-40cf-95aa-95291bc4a1c9", "comment": "Malware payload (Tinba)", "value": "3096e251ba2544b8178170d687321183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660331, "uuid": "5618d3be-c8c7-4788-88ee-426ffa1ef2f1", "comment": "Malware payload (Tinba)", "value": "860ac4a282dcf987884eb102266644b6442e3cd4bdbfbfbca897f673c89fa82a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660331, "uuid": "f6d212eb-3ff9-4016-890b-c286d4faa9a4", "comment": "Malware payload (Tinba)", "value": "06b9e04bbcc14d62b8a8ce332beb7e9c916c2a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660331, "uuid": "5ff965b4-c770-4073-ad54-5c5fedec15ab", "comment": "Malware payload (Tinba)", "value": "de30f4c51237bf8de20ec3f4e26e4f4f67606eed4390a4d32e352bfd455924d11903029adf443b814091653dff0422ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660331, "uuid": "c7773f5f-0dfa-4dcb-9828-1b7eb13b122e", "value": "T17984F827A589A2B6F4F34CB2174FA2B2A1719B301714D643B60C5F6AA7703D1E5283DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660331, "uuid": "ad90f947-ecfc-4f0f-aa5a-c05bd7bfda42", "value": "d0faf1f829379ff4f83833223a663610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660331, "uuid": "f4af9257-d91f-4817-8b15-6004a801565a", "value": "6144:gCE6/mUXJ531nIUliViSZbLhaZfvMlLXICgc:46TOUMBQf0ljWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660331, "uuid": "637b902a-dae7-4a8f-a595-9ad82502add6", "value": 379858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660331, "uuid": "f7814e1e-3dfa-417b-ac9f-47bd1732ed00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660331, "uuid": "5861759f-9be5-4b86-b2d1-4808d53621fc", "value": "860ac4a282dcf987884eb102266644b6442e3cd4bdbfbfbca897f673c89fa82a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152fa1bf-0c6e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630642748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642748, "uuid": "3382c37a-5473-42c9-a184-b9e213b2d811", "comment": "Malware payload (Formbook)", "value": "a2a6f26ff8b334eaf7a462b0a67046a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642748, "uuid": "94384cf0-f859-4dbc-8a78-98c3056a564e", "comment": "Malware payload (Formbook)", "value": "87e35b392f0e6ba445a7b302b087c7c443d7188240b2efb742d01ab7a62534ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642748, "uuid": "af1cbb10-4a3c-4a07-a2ea-2b0d15081507", "comment": "Malware payload (Formbook)", "value": "dea5f21d627e422047bf7b6e529257f4d64a31f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642748, "uuid": "a1c0ad5e-95c4-4d1f-91ac-b3bc5df80dd7", "comment": "Malware payload (Formbook)", "value": "53e2395b1668deeacba88c2c2ee6b023cc416db2af06fa5bcab06862a562b1dc19f3d2a6c11cee53b81d0384f64c34a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642748, "uuid": "e32a1115-ed97-4316-8772-16d63be85272", "value": "T188B41224C6AA063FC82F1877BDD312984BB6E142A122E7BD7D4F4394236B7E5C2D51C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642748, "uuid": "80af8f16-12e2-4a34-8531-ca361c6335d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642748, "uuid": "69c2001e-9ed0-46d1-933c-32def06ea436", "value": "12288:IeolYYsCeKn27buHvPJjSiycaz7EsmEwuqetdu/c5i2:Ghsiob4Yiycaz79WetmcI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630642748, "uuid": "d292ef01-9a12-414a-aad6-79482beb2d63", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630642748, "uuid": "aa9467f0-9735-472c-b84e-9807847cda21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642748, "uuid": "7a42a6cb-e460-4092-897b-ddb54391b671", "value": "PO 270745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abb47a2-0cbb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1630675909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675909, "uuid": "4dcd41d8-76ad-4544-a907-a6f702e1ff25", "comment": "Malware payload (NetWire)", "value": "8dde8d3377274864b19cfdd9432aea9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675909, "uuid": "69f936b2-1c99-422a-b7b9-45a71cf06f51", "comment": "Malware payload (NetWire)", "value": "88f47e23c6b59062ba27bebe4cd6004379567bb613a91ec0b83644986212cf8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675909, "uuid": "b66fe498-4038-4b6c-a78e-0f332f814238", "comment": "Malware payload (NetWire)", "value": "3ea2077e34246045af909dc902698a3d51b6d3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675909, "uuid": "1d23a191-96bd-4667-859a-e45c486121de", "comment": "Malware payload (NetWire)", "value": "ad7869ee2719ae6791a3d48ebee460c0b760643e3836421aeebbef7f3d8e905ae08147f330af49ff463e035f695cbba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675909, "uuid": "391907d5-8761-4790-ab44-c32e430e902e", "value": "T1E515AE6EBA814473C0222B701CAFAA199C4ABD213E15BE6D3AED7D5C4FB47D6361C143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675909, "uuid": "f7c6e475-52db-468f-b517-f1606d624301", "value": "1407e2d87d7efca6bd106fef3862efae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675909, "uuid": "5d281514-0df8-4e66-8f5c-1aac7f8eb090", "value": "12288:K1+UzwWLYx9/EISfjI3916W3WOsA0QLEkpwaGKqa/y21pKQcj2VncY:+BfYx9tGjI39DmOs5KTGKqX27cSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630675909, "uuid": "5f9f223f-98a5-49ab-ba1b-92888fdf0ad4", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630675909, "uuid": "8b5b94d1-e4d2-4fec-8f01-50f69cdf1b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675909, "uuid": "02f49792-40b1-4fe4-8d2f-350ba7484e40", "value": "Uvnjtdnyzzyrqntxmdlgahpbcyrosnjtqn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928dc7a2-0c7b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630648542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648542, "uuid": "f54e199c-7854-4c2e-8289-b180485d8553", "comment": "Malware payload (Formbook)", "value": "06055bcfb3483028936e03b13dc84330", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648542, "uuid": "d8961415-3a59-45db-85e0-9a2ff7a51c21", "comment": "Malware payload (Formbook)", "value": "89ca79d155812a91049697409e5a809ea342547154705edde9dfcbb7469c210a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648542, "uuid": "54c6f653-09e3-4d96-abcd-d3f638f3588f", "comment": "Malware payload (Formbook)", "value": "063adefce30931665661dd45e9187fb117bb2fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648542, "uuid": "92708b04-0a95-49f4-80aa-38c47df0447d", "comment": "Malware payload (Formbook)", "value": "6451a4110c0ef3b3521f57fbad615caed7f234ae9b875888a98a30736c56fe04f1713a406b19fdafe092f7e5abde7d1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648542, "uuid": "b63dbe33-f62e-43bd-b543-c515d3e2905d", "value": "T1A9E41B3E19FE23279176C7D5CBE48827F6C498AF3233A96467D747264306A4635C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648542, "uuid": "d4aa1198-470d-445f-910d-e9188971d03d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648542, "uuid": "532f7b8f-fb38-44b9-b021-c141230183b4", "value": "6144:aFJLgGfFrBp4HRt7rLWoSkSdRvvRGHKuhpwZmMjyaHDN4id157g+C:iBpg9SkSdRHRxipwkM+ajXhg+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630648542, "uuid": "3f7019e2-d2d6-44af-b268-fc34a64f9473", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630648542, "uuid": "24c8ae3d-f961-46e9-ac21-292491394987", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648542, "uuid": "0ddaa179-d000-45f9-b410-c7f5945b356f", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df80fa0-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654386, "uuid": "8da105cf-c9d6-4d77-8c21-2266bb3424f0", "comment": "Malware payload (FIN7)", "value": "f4c77f40e325a420be4660370a97158c", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654386, "uuid": "7a89828e-9477-4bbd-9451-5e88dcaba398", "comment": "Malware payload (FIN7)", "value": "8a392ab0f0ab1244dedc52fb1f99a2cf06f50766c0a75f1c4236375290be56d3", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654386, "uuid": "90a7aef9-bc69-41ba-9119-9042e1b78099", "comment": "Malware payload (FIN7)", "value": "6f6af41c3c5f6d8b5d0a804a443292438b2b478d", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654386, "uuid": "e0bca0bb-156f-450e-b457-4fa1e6670e1f", "comment": "Malware payload (FIN7)", "value": "d4eb77c5d5c4c8981546c9c62145e3790c97e425e0b25a87e4379be410b0f406b58254b7f3ae45d9a518aed2bd51f3bd", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654386, "uuid": "7c8f0e85-a768-4598-9dec-dbfd1528b8c5", "value": "T1A3D3E717E381033616A28365A60E65E6F716C13C637ACA70689DD43D3346C79B2BF6F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654386, "uuid": "aab94e6d-4a63-4af5-b2e1-bda1996ef9b2", "value": "1536:m7Sk5qkRN3BvLVoyN+aL93vZZazLE8JxpH5vjgN/U0HNN2RgBgJBCOD5HDK27HaD:m7S+btBpz9ZXOLxgN/U0Hum/FjHlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654386, "uuid": "8ca04d42-c826-4001-9719-c4d7c1936a97", "value": 140643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654386, "uuid": "b7b5dd1f-dec7-4875-b336-23c286fec22a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654386, "uuid": "f9642d3e-d347-459c-8f17-0cb40f513f11", "value": "word_data (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadf8bb8-0c76-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630646435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646435, "uuid": "203d3865-17f1-47b5-99eb-0c2931b79db0", "comment": "Malware payload (AgentTesla)", "value": "29658e5b29a0c600319dd07609003428", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646435, "uuid": "afa1993b-2278-4ec5-af13-78720af6152d", "comment": "Malware payload (AgentTesla)", "value": "8aad37f11743588002ae17b9be7e92afe8389e29e3522d02b2541fcb0d18fbea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646435, "uuid": "9d977b69-93ee-4032-8e91-c9158052457b", "comment": "Malware payload (AgentTesla)", "value": "ee7561695b83cb3d97313be2e3226cdc7b6a62b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646435, "uuid": "660c80f8-065e-4e14-b4b9-68004b1f52de", "comment": "Malware payload (AgentTesla)", "value": "c2911da49fd52bd731acc352baa4c4d939ccd1c0ee7cf4157212956675fde12ae8afd8e215708be3de63b0fbe4433334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646435, "uuid": "da88aa6b-f9f4-43cc-b1ef-651c10aa7a48", "value": "T1E5F41E3E58FE2327D166C7F5CBE58823B1C49DAF3132A92557D767264322A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646435, "uuid": "b95262b6-1227-4578-b6d9-374478679f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646435, "uuid": "f8dab032-62a4-4d78-a139-2c64caa23aef", "value": "6144:vFJLgG0FUgL910bpB90u+gua7zPE1X572ad/gs2MDNGslgFBoxmTJEAmg+:lgL8F0UszXYsb4vFBoxmFEAmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646435, "uuid": "62ff5cd4-0dc3-4df9-991f-5a111201c5a4", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646435, "uuid": "3763a0ec-8929-4215-b576-33d08ea78707", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646435, "uuid": "c604dbb9-5b63-4d2a-be00-3f498478545e", "value": "Updated SOA - (USD1,963.00).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311da091-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654391, "uuid": "6faf73ad-6a01-4225-b785-81148535eb21", "comment": "Malware payload (FIN7)", "value": "ce80bf89bbc800547039844d400ab27c", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654391, "uuid": "a567eb0d-88fa-424c-be76-0f1ae6ebbca5", "comment": "Malware payload (FIN7)", "value": "8cbf62b382ea5e4fecde4a6fb376014ad2aacfa0296df205a1a6ab1d2f5de3d5", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654391, "uuid": "4ef74652-9ccb-45ce-8364-cebbe6cf48b9", "comment": "Malware payload (FIN7)", "value": "59fcfbfa399857d31b5a253b8ee53a29c65ba243", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654391, "uuid": "34acb8a8-5e76-47d3-94c7-3dd8551a803f", "comment": "Malware payload (FIN7)", "value": "53f8e4cd5613708e0c2dd6334ed2f0f206274bee12ab48e075fe439646ef67ec6e1b7509deca23c2afd48721299b23c5", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654391, "uuid": "7065ecc0-2d36-4ec5-90d9-cd904d9cf396", "value": "T1B1041A277784133246930291A64E66D7F739C1BC7366C26164AEC13D2286CB8937FBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654391, "uuid": "f68f1931-94fb-4af9-a846-63fe9c9206cc", "value": "3072:u0Pfdu+O7TcF1Ibj+25HEb1yfTynB3aINbiOnwD0bdZnf7D3CV0Ix0H:VQ7TcD0Lkb1Y+53hC0bdZnX3CVxeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654391, "uuid": "89141d43-1008-46e9-9142-6c5ab1b1406b", "value": 188623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654391, "uuid": "7321a58a-0edc-4216-8f91-c5763142ea5f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654391, "uuid": "c49ed77f-549e-4628-a2de-15cba41a2900", "value": "word_data (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7866fc99-0cb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (OskiStealer)", "timestamp": 1630671691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671691, "uuid": "79a0c415-2fe9-4402-89dc-e5e78a40e50d", "comment": "Malware payload (OskiStealer)", "value": "c9e641421efb567880da1b9b83d56c4b", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671691, "uuid": "16fd4b61-1c8b-4bee-a4bf-2d37f33714a6", "comment": "Malware payload (OskiStealer)", "value": "8dd2838e6c0869607e3ec82c390e1c89ca8f768793e6043a4763be4b3c69801b", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671691, "uuid": "4577832f-065e-4937-9681-f280998ca0f3", "comment": "Malware payload (OskiStealer)", "value": "618354519fc5d19eaa3cafd1f4eb8b9f0d5fa153", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671691, "uuid": "69b058cc-f066-44b5-87fb-74e15c70d588", "comment": "Malware payload (OskiStealer)", "value": "0d2c88ee58c0e8b98b6177c461e9bf968ef91f73c6580dd69c589c36598e88e824e4d2180215849f32cf9b9a2e4f7740", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671691, "uuid": "d8f658c8-334a-4ad8-bead-f149fc516fc9", "value": "T14EE43337530B6C366B3842E06B89078BFAD31F2A676FA3571A07BE892D1E3C1449D350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671691, "uuid": "562b492b-84b6-4ea5-b1dc-d1d21c65c641", "value": "12288:XUrijiF3HGxAWCQIJHLuuRI+DOfQ2rag+cKM2aNgtfZEc433J4h51Z:XW3Hhi4LHDODKDaOfZCIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671691, "uuid": "822d9974-4dec-410a-936b-c828bbd5e4c4", "value": 669275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671691, "uuid": "c4af9416-d851-4150-8733-ab44fddeeedf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671691, "uuid": "4bd78ecf-8610-413c-9d00-c9fa9c32c811", "value": "payment.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581a4cd5-0c8f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630657033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657033, "uuid": "785ce551-d887-4535-ac43-6c43b179e05c", "comment": "Malware payload (AgentTesla)", "value": "e6071d935e5a30937e4836e0521bad88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657033, "uuid": "3f661486-f642-4588-85bd-f78e04ff7191", "comment": "Malware payload (AgentTesla)", "value": "8f06c0a2b8a282631373bfa4db2e71c74dffac1df4eb267266911903fd51120a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657033, "uuid": "3844fed7-fb6f-439f-b538-8346412e2ab2", "comment": "Malware payload (AgentTesla)", "value": "3e8f04bb0b6c011e572acaa0617098c5f8afa4a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657033, "uuid": "dd49fb98-12b8-4b4d-90f4-c6ad2edc4eb0", "comment": "Malware payload (AgentTesla)", "value": "ef7399472e3961a762fcd4d0f8ff847af047deaa1ffc1fd583f155191dd729b23a809453d31aa898b8a1eada187f8ece", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657033, "uuid": "7731d786-faf1-4fad-a1ae-5a25d942e199", "value": "T198A4CF9C7650B6DFC867C93289981C24AA51BD7B531BD203A45332AD9E3E6DBCF011F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657033, "uuid": "f64d9acd-e4ad-4947-b07d-dc53235105be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657033, "uuid": "e65dd2cb-e35e-48f1-b86b-95a18803e471", "value": "12288:x61jJqw2Bz97/CoAK1h47vSUvqm6KbeI47UfbyL5H/aTw3:yjJqR7Kz7vSUim6Kb747", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630657033, "uuid": "e27324cb-c6f9-4942-9ee6-10e04201e2e3", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630657033, "uuid": "dad18849-5883-4d07-9ead-6d2edc568624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657033, "uuid": "60884bd7-a067-4feb-94e2-f4defc33cd1a", "value": "PO copys.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308b3edd-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655249, "uuid": "68037b60-e140-49ca-ae0a-45c610185808", "comment": "Malware payload (Mirai)", "value": "4d57e4a24e236511c60e54a970c18a8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655249, "uuid": "4198c92e-80bd-40dd-8abd-806b8bd12e01", "comment": "Malware payload (Mirai)", "value": "8f099f8495b424d9546e6ae3eaf45e3268889f4d863dedeea3dbd0497b3f6539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655249, "uuid": "53a77f44-f924-4f85-84b2-e18d8b492c80", "comment": "Malware payload (Mirai)", "value": "1ca9e831575a48440a6b459a396d2fe2769d2e45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655249, "uuid": "54743ad8-3a60-42d7-8ff8-24e4695642a9", "comment": "Malware payload (Mirai)", "value": "40c592827838a0046f1fab267db2785fc01793a32a0b773f77cc8236dad45e9c52bd8669495020f5b1d7d9bcd2878b72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655249, "uuid": "ce211bd4-6cec-4cb2-a667-fc111b0a23f2", "value": "T1AEA3B51E7E259F7CF799823947B78E21979433C62AE1D141E19CEA015EB024E381FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655249, "uuid": "9055aba3-26fb-4d0e-976f-5b82c5ce9527", "value": "1536:S3ui+liCpSv4rBuBS3lIPdLgWVrwNucs3Qfj2Ral0KHz+EFI6Pi:eu2ISvUPePdLgWVUNm3Qfj2Ral0KHKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655249, "uuid": "ddb17f67-7823-468e-b74b-45f5f4020b83", "value": 97912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655249, "uuid": "23cd1b66-8be8-4f1e-b4fe-6b27b1f438cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655249, "uuid": "57ef92d8-59c4-4ec7-99d5-05cc024576bc", "value": "4d57e4a24e236511c60e54a970c18a8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cf5b1a-0cda-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630689421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689421, "uuid": "93a76968-e3a5-475c-9226-610b71ea2732", "comment": "Malware payload (AgentTesla)", "value": "dec29be85f94790985b9ea1a4ce23d82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689421, "uuid": "b5c3b585-21f0-4794-8520-51746aee4304", "comment": "Malware payload (AgentTesla)", "value": "8f21249c4985b018274f077aa38ab11dba4c5e8a2ab7a1228cc926f99655df5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689421, "uuid": "980f9759-8e05-4b0d-aca9-7d415df97805", "comment": "Malware payload (AgentTesla)", "value": "dce6eb7a8bef8de37d446f90014b9b2146e8919a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630689421, "uuid": "9ae0f312-6670-4d65-8adf-d343d8e2372c", "comment": "Malware payload (AgentTesla)", "value": "283f2829d39bdf1285bf0bc388152c6816cada02000d3c11192668dffdfbd052e2d07e5cdf5e4936ee2ff1ceb7d3c3ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689421, "uuid": "f64342f4-e24f-4f7d-a8e0-8239ae45dfb8", "value": "T19AE40B3E58FE23279176C7D5CBE18927F6C098AF3233A96467D747264306A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689421, "uuid": "2c5997a5-f559-4361-8d32-e139ead42f1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689421, "uuid": "2a16e45e-4c89-432b-953e-92378e6c45cc", "value": "6144:KqFJLgGCFYGW/oD0NWIuxXUefvWtUova3bJw8pB1X8XWfsmva756IVjJMzzY0uLp:KkGW/tuSeHWtUEatTyXYA8cmzzY0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630689421, "uuid": "2e2bd369-e9f8-488a-8339-f690e9ea56a3", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630689421, "uuid": "24464df8-f155-4d24-ae78-7ce0be0b6009", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630689421, "uuid": "b2331677-5736-46b8-a9fb-be92f38977f3", "value": "Purchase order. PDF...........................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d8d661-0ccc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1630683306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683306, "uuid": "ccb4208b-85e9-44bd-af23-9ac4315dcb33", "comment": "Malware payload (Gozi)", "value": "ed8988f1433e30276b87384f16825116", "object_relation": "md5", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683306, "uuid": "29550da3-423d-4746-b378-5e57b5aafff6", "comment": "Malware payload (Gozi)", "value": "90663d341cc9a6e9d33df216882beea6dd451ab6a16e57f73392683018309b82", "object_relation": "sha256", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683306, "uuid": "7d9d2f39-1a5d-4f75-bc3e-956e139a8b5c", "comment": "Malware payload (Gozi)", "value": "10c3b841313d765e380460506d5e760b2423680a", "object_relation": "sha1", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630683306, "uuid": "ecf5fb77-6ec3-4a7d-850e-5362a6e980e9", "comment": "Malware payload (Gozi)", "value": "1648f6bf000715bf6beaf2aa9203c94cda641c66be113f15576abdec69ff3064c2a330345a82924acc034f09b4cb273d", "object_relation": "sha3-384", "Tag": [ { "name": "202108021", "colour": "#75661E", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683306, "uuid": "b9870375-6f5a-4d28-8315-b913949dc8ee", "value": "T1FC54AE50FA8020510ED363D79D1262E1FA7DC411935120A9F89EA39C7B536ECD3BAB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683306, "uuid": "db3945a0-a021-48c3-942a-bf56785f5a9b", "value": "6144:0kOBFat5zNdsKOVxqEuS+Vh1X62YJZ5Zzv2jTaY7Qe1buo:0kOLbqh9MB5iz1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630683306, "uuid": "5d1c0954-cd42-45cc-9e16-9ff6d94ed7a0", "value": 284787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630683306, "uuid": "9f768643-4c21-42c2-9706-9a511077ee53", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630683306, "uuid": "7cf7f6be-40bb-4a82-80f3-26c54b301d1b", "value": "2217.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b02337-0ca8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630667908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667908, "uuid": "ed7371e4-b7f3-4281-a720-105b0674ae18", "comment": "Malware payload", "value": "42382d6459a734fb6412dddd909eb03b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667908, "uuid": "5fcc9227-c015-4287-a75c-cf5fde03a50a", "comment": "Malware payload", "value": "907d1b2c1ebe1174475bde98bc366e67beff738c958326c69b65b6050b5a9c0c", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667908, "uuid": "da65b49c-5997-4341-9a4b-7ac6794799a6", "comment": "Malware payload", "value": "6df9f70805df6ded08fd38b7b30e62225b49ec73", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630667908, "uuid": "c7df51bd-d6c3-40e1-80d6-e52650745e8f", "comment": "Malware payload", "value": "1c5b3e143f2e3ee0cb8d38c51878ab834fd2a30143060c7e674dd40227418a1853f8d2e54c9e504cd68c4f10c23e6c3e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667908, "uuid": "60a8ea2c-667d-455d-9c73-397031a1c271", "value": "T19C241267D8560A71A18C425B7C43ED186B020FACAADE746E1533AC5BBF8C2BF49C513D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667908, "uuid": "d3f8a8a5-9b8c-4555-bf18-9c7445c35fac", "value": "6144:LJ9iD+xOBcl3cP07xnCDuZalYPbq9blyi+HL/JuHh06qjeN:PZxOB78nsuaYD2blyi+HLl6Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630667908, "uuid": "f9242937-6eab-4ac1-ab54-89a7247436bb", "value": 224027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630667908, "uuid": "519f6508-c77b-480e-8393-ff1370797bdf", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630667908, "uuid": "f35c5a7e-3c65-44c3-8adf-f47b245df0fb", "value": "'sara innocenti'.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68637fd-0cb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630673056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673056, "uuid": "a0057a94-f02a-4c36-968e-39b892c2b9b5", "comment": "Malware payload (Formbook)", "value": "d579f66c87bee2d308d55a80da729518", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673056, "uuid": "3ef3f03f-1942-43ce-b9f4-bb8ca5ef10e0", "comment": "Malware payload (Formbook)", "value": "9129e6a20387dbea731c09c9feb112113d523e521ff9092536218a64259079ba", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673056, "uuid": "f5d19b26-7848-472d-ad50-eec0a39c80d4", "comment": "Malware payload (Formbook)", "value": "f538343bdce56491bbaaae428b04243c720bbe7c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673056, "uuid": "7563f9ed-86f8-4efa-874b-cd9141119b2c", "comment": "Malware payload (Formbook)", "value": "660c59093b041aa60fbcdaee61e96c2c25a706d256b4308dd18b101b6471e1f9969c0a57ab1aa01cf497116ac3465e26", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673056, "uuid": "cb761654-e78c-430c-80db-5950f3214028", "value": "T199D4F1846342CF97F6A22E33985EEF52F0508EA261D34E81623F35D150BB6726612FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673056, "uuid": "5f1ce0cc-3ff1-4115-b7ee-492bafd2dac9", "value": "12288:C3fhSyR2Yd3c04i9zPDGhfCpIDoqKcjFBJBkLDkUVqohc:C3gg3c0rB6pXDoqfXkXkUwohc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673056, "uuid": "25669962-363e-47e6-9f95-55f8bcc1dc88", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673056, "uuid": "606cabbe-febe-476f-b956-9b3409abff8c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673056, "uuid": "79542b2a-3274-4a80-a961-03cbd79a5b54", "value": "ICM Stellar Presentation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cb1156-0cc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630680226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680226, "uuid": "7399306d-e90a-41d8-bfb1-ea5b002aca32", "comment": "Malware payload", "value": "06c440d04a0bd93ed45a8fddb8085774", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680226, "uuid": "a0004541-9678-4ec7-854a-88cd41f3470f", "comment": "Malware payload", "value": "9133127ffb3f5c1485a64d04222460735ffb57801b17d3692290563176c8597e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680226, "uuid": "562cd136-3908-4961-9808-e193318caf71", "comment": "Malware payload", "value": "dad184bcd3f1f0457afea3285a34ff42b26a1944", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680226, "uuid": "fa1e85bf-ea77-401d-a7c0-a3ca55ff59cd", "comment": "Malware payload", "value": "e12f85e465b2d38423ec1d5fa23f160584293221a6ccb00de53edc856d44622fe84e2ea856f7b362cfd7979ca08e40eb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680226, "uuid": "1a7036a9-cfae-4f48-823b-68b744d9ce68", "value": "T114C50242F364E827C537C136557512362116CD188E4BF79B2A0AB3BD6DFFE888E85AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680226, "uuid": "5f0f425c-f818-4f10-bfe5-2d86e909aea3", "value": "49152:7S0kcvyvVh5QMkfphCWo2er4ImKBKRu/bJd8OpLv4tmBP0:7RkcvUVh5Qm9oKB8ulr8tI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630680226, "uuid": "9aea2f4b-570e-42ae-b971-05e1e1e95016", "value": 2678187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630680226, "uuid": "074ebb04-7582-4ac8-b715-77fe811e890e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680226, "uuid": "081e2313-0941-45e8-8119-a86b828bef03", "value": "Downloader39.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd35eb7-0cd1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630685655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685655, "uuid": "1067d3e1-316d-4c35-84dd-502e6c486ae8", "comment": "Malware payload (RedLineStealer)", "value": "0dd588d0d11074ff583db120b6c551a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685655, "uuid": "e46c1ecd-924c-450a-8214-9d6f91c8fd96", "comment": "Malware payload (RedLineStealer)", "value": "9325769f8bbd3821dd3de085cec6fe2d5d53fc2c4a31fb6003596a7ed9fdc6db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685655, "uuid": "fc6a9573-1666-4e6e-bb54-9365c8fd526b", "comment": "Malware payload (RedLineStealer)", "value": "591a9ac6c5d27af775316557e7991539c6e2780d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685655, "uuid": "c90be5eb-ff27-465a-886b-adf3970138fa", "comment": "Malware payload (RedLineStealer)", "value": "09b901eceeea4c94058ea51240828cf5009534a4376abda06bd3ec779b9744803daf5fee218b928ed3421713848670ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685655, "uuid": "ea56086b-5f4b-4377-bfd8-36c17c2b23c0", "value": "T1F6D3AEB3249580D6C49E1630F8624E4B3AB9EE3C99C0B10BF09BB35DED7A78D44F5169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685655, "uuid": "80fa8b9e-7c5b-4a05-a861-447ea8bba04d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685655, "uuid": "9267b4a6-7686-4d70-bb84-c30cd20edbce", "value": "3072:IxizabCk/h3gB98fx6OBwS50W30ANegbtFMUYt3SUdGa:I52k/6X8wA5OCzm3SUdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630685655, "uuid": "cb433e0d-a546-41db-b12e-c9f4209a1324", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630685655, "uuid": "5eb5dba4-11a6-4048-be00-fa9e473702a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685655, "uuid": "7b8b4621-aa4f-4543-a112-7af5beee9cb5", "value": "0dd588d0d11074ff583db120b6c551a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d789eb8-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655620, "uuid": "2b692e3d-1ea9-4f14-856c-5c616c11547b", "comment": "Malware payload (Mirai)", "value": "0a9b9fdd2dae7fc92ee82159cc51f9e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655620, "uuid": "30b65c35-4d09-4cf7-80a4-7a7d9e9052be", "comment": "Malware payload (Mirai)", "value": "938f7406219a48ebf2c18f17666d4bc165d8069c364e12d36db24878c1a94ce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655620, "uuid": "487ae19a-1f01-4f3d-8820-f491f827bf8f", "comment": "Malware payload (Mirai)", "value": "6eaa59ba9109c109ece2fdc0559907bc9f900e5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655620, "uuid": "5ad8686c-644b-4916-a191-dd8e96b922a5", "comment": "Malware payload (Mirai)", "value": "c62ed945f4ef272fedd5af2623ef1a8c9710735ce1fa840db57e4cc560e82476971fa447c2dd0e5e4990616f943d330f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655620, "uuid": "f76b5f49-ab47-4fb1-ad1b-129821e23bc2", "value": "T127B35BD3FC00DEBDF809D67A40530A06B230B3610E921B73B6636D57EDB11A4696BEC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655620, "uuid": "abe4ac2f-b106-49f9-aaf3-ccdef3f3f893", "value": "3072:7laZIEF0COnI9oeImtNSKvY4MSMLJUySYSJ3MK7:7sZCIKmPSKQ4MSySPJ3MK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655620, "uuid": "c27260ec-507a-4993-aeaf-3540cb221e33", "value": 115384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655620, "uuid": "ec3f3f1a-1a50-4db7-8301-2047c2ef1f69", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655620, "uuid": "a94f5b61-348e-471a-9f4f-83ca9bde3830", "value": "0a9b9fdd2dae7fc92ee82159cc51f9e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c173466a-0cb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630673102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673102, "uuid": "3573dd6b-79b3-4530-b5f8-7483be7b25eb", "comment": "Malware payload", "value": "b452e8bd8e355c3b6a0ae07d9d341d1d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673102, "uuid": "eb516a95-97d6-4c57-affb-5a53a140563b", "comment": "Malware payload", "value": "93f2ab01759bb395925a03cb00740e12e9d10f570731f48f5e0517e828c6f6ce", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673102, "uuid": "05f793d6-75dd-49f6-8b62-30df3c53fce0", "comment": "Malware payload", "value": "9fa572784f5252fc10139cadf1bea47fff79708b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673102, "uuid": "287375c1-51bf-4792-94ef-981b36d45fc9", "comment": "Malware payload", "value": "43f4491bdf97fd6d6f11bd8bf69b6fe3638d17ee91afe77089ef2e4493360feaabfd74e0b2eff44ca2e8d1e1c548f0d8", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673102, "uuid": "659a197e-4acb-4b2d-878e-8b7bee38c92d", "value": "T189D4F11F2EAD1EEEE57BA07D5AA03090CA9D4C02DFB6702B582F3097697792D40D4F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673102, "uuid": "cf42e311-86db-4ab9-bd9d-8e3d39e84c03", "value": "12288:KUr9EJMongs6m37Bv+I6WJIKpcAQlI67byRaBjnUEGKoR3Aj2ET9BQG4DC9:KUr9EJmsxrxENXI0mg5a3Aj958Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673102, "uuid": "6d2c9ed9-8b73-47d3-ab96-e5949b02e8e8", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673102, "uuid": "3a358110-863b-4bc9-aff7-9b7c4456af1b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673102, "uuid": "e0d90d8f-4bee-4f97-9c58-76a8059ce987", "value": "Players profile-661735550.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7434400-0c86-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630653435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653435, "uuid": "1daa69b8-6aa1-442c-a417-d7de515eb646", "comment": "Malware payload", "value": "23704700d80aa3937512cfc802b801ec", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653435, "uuid": "ac487289-fe91-4253-9947-50153809ab74", "comment": "Malware payload", "value": "9418ce61ce37f804d4f26b49c9ae16d02337deb2d24a7376c972214b61cc7836", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653435, "uuid": "3d82f5a4-0098-49bf-b6e0-3ae0eea7aaa8", "comment": "Malware payload", "value": "ab109669134406d3a519e74774e59b8a8e35e40d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653435, "uuid": "8359981d-6c14-4fc5-a5ba-36b4d95b8c1e", "comment": "Malware payload", "value": "b408b61b09661d989358deaef17f385ba45fe112bf73550bcfde06216047ca72e64beb5cc66976bfbfefb64c064e5eab", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653435, "uuid": "fcb9ebec-18d0-4cdc-aec1-86d45428e084", "value": "T15F066E27B284613ED0AB0A365537B61499BF7F6179228D0F5BE4188C8F395C07D3BA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653435, "uuid": "67736495-b042-421d-ad71-d1f422eb44ee", "value": "49152:PgNOYg8kdNdwKHZ2SfwYAMhQokj2n1UJ+wACCTjpfbAOzuA:6OYfk7dlAMCP0UepIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653435, "uuid": "6af2c2fb-c574-4ee8-ae0a-19c2f8830379", "value": 3994624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653435, "uuid": "64931068-1180-4c16-8907-d9367154a250", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653435, "uuid": "0ea9b45b-84a0-48f2-9c7b-1da0740fdb0b", "value": "BaforaLeao.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b12fec1-0c8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630654757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654757, "uuid": "ebf273c9-3413-4be0-a027-eac036c451e0", "comment": "Malware payload (AgentTesla)", "value": "c2d055e3c31f4d59a1e9bc8db7c4bc40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654757, "uuid": "6f550d67-8f43-4c84-b7db-473818307b0f", "comment": "Malware payload (AgentTesla)", "value": "9525197c77e5de1094ea33c3cd76a3e87c91342b4d41148442808bc27b4e2ca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654757, "uuid": "795ecec8-8789-4a51-af1e-a12819ba6fc0", "comment": "Malware payload (AgentTesla)", "value": "32d1b79fc369ad19104754c7a7505f2d952533e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654757, "uuid": "8cb2f552-0651-406f-a159-1e52eb81b70e", "comment": "Malware payload (AgentTesla)", "value": "f3ced754ee664d73d045ca537ace3886aef9c64ad79a90f74b652e3cb1fe6b38f027f6a50bc8e05e2a94927f69b5f5b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654757, "uuid": "8a614ca5-ab34-4716-a0d1-f5c2393e962e", "value": "T1FE15D0247780BA0EC27F0F7A496018006BF5E656470BF7877CC522ED59CB3AA465B37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654757, "uuid": "6b6d5598-c64c-4f1e-83e9-da5000589437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654757, "uuid": "d140b550-6ec4-4479-941a-c6c4b0f992e0", "value": "12288:EIlcHMUPvG3/MOsDf7IQZ3CjugYuNtD7B9YIq1jA9Z4arv/76wuys0LS8jL:kvekO2vZ3Pgh77z9qZA9ZNrb6kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654757, "uuid": "d4047fd1-b32c-4f02-b1ad-81b1afd4e949", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654757, "uuid": "6b13d0cf-1193-49f8-a677-0657f86f43e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654757, "uuid": "2eefbf26-49e9-466b-bdaa-13f66ccb1079", "value": "c2d055e3c31f4d59a1e9bc8db7c4bc40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241676b7-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cambot)", "timestamp": 1630659953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659953, "uuid": "52105705-46cb-4e21-b73e-e1d82c6db4df", "comment": "Malware payload (Cambot)", "value": "75620fdd5d0f2b9bca53bfb8496e7528", "object_relation": "md5", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659953, "uuid": "46539639-2f87-494e-9147-2161b93c6a0b", "comment": "Malware payload (Cambot)", "value": "95f527978167cc6a45e4d42ec7852cd31a12d6413523fa573a85b44ec9886637", "object_relation": "sha256", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659953, "uuid": "c1d8985a-069e-466d-afe9-2abb0489b384", "comment": "Malware payload (Cambot)", "value": "09b9d75339adabef72a54a09736e03a69c6f26a6", "object_relation": "sha1", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659953, "uuid": "369b3ff0-c492-490f-9d98-7069746c4080", "comment": "Malware payload (Cambot)", "value": "cda19cdd5e98f8bc765a02cd709d47a3761ab3ab16b290e62e2c49120bc863dd4efc9b2558e4d25ce548a46b46c821fa", "object_relation": "sha3-384", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659953, "uuid": "27027bab-e592-4d7e-a32d-ce78e8e5b813", "value": "T111F49E23B3E50E94E9EFDB762AB5C5FA662378147F23914E1104236D7C21E209C56B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659953, "uuid": "11aab59e-8fad-4b92-a06f-6131dbc2c0af", "value": "3e8ae3bc85823ef9afa9731fe8e9fda0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659953, "uuid": "75e8faf3-35a9-4901-bcc9-4b3109bf3d6d", "value": "3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1kHjk+0oLnWFnqt:Xo/BHng5HaVG4G/1z+QVMbg1Eout", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659953, "uuid": "e0932dbf-d1e9-41f4-9b5e-227c7d8d72e2", "value": 782456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659953, "uuid": "ef0bb4dc-cc63-4828-99c2-b981513ce369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659953, "uuid": "15783e43-cb30-468f-bafb-46d2330d5c38", "value": "95f527978167cc6a45e4d42ec7852cd31a12d6413523fa573a85b44ec9886637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5b3a04-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630654195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654195, "uuid": "36822793-5c93-433e-a8e4-f2772129fd05", "comment": "Malware payload", "value": "988e439de4d0dc6d3bc0c850cd06977c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654195, "uuid": "4b84d508-5e9a-442e-8d4c-7a7878c26b18", "comment": "Malware payload", "value": "967992647a6a09e8dd501cbd227f1746b466b84847ef87010588172350845b27", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654195, "uuid": "0dd2cd11-6fe7-492b-834e-a781ab840866", "comment": "Malware payload", "value": "d7aa598b370dc54d973a6a600cafdd61a369636f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654195, "uuid": "44d5a54b-1085-43a9-9d45-2daff4a2e54e", "comment": "Malware payload", "value": "03905d3d88a4a96f084e551687c88887e82bce329ef0805397be65517f4701a275205d47d25d2f067d0b2ac7e2011268", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654195, "uuid": "1b68c973-4ce4-424c-bc9e-ca230286f5e7", "value": "T1AA319B20CB1EC4DE4602A1E02B4B9D174EA54F127BDCCBDE2480C904EB1E86D46FD633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654195, "uuid": "a0bf93a9-1f91-4603-b69e-85470da9f61f", "value": "48:c5V/jt1Ia3Geq8qz380exPf70ZvvQHjW7nVU:cxjt1bq8qr80wPfYFvQHjW7nVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654195, "uuid": "3f258906-27cd-4377-b2f0-ae85263ccff7", "value": 1576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654195, "uuid": "2e698720-acfd-43c2-910f-e7c934ee28a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654195, "uuid": "f9eb39a2-644a-4038-9c3e-c671ed7038e4", "value": "ISIKH557.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16053dd-0c90-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1630657666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657666, "uuid": "91a7c6a1-8121-470a-8605-247fbef377dc", "comment": "Malware payload (GuLoader)", "value": "6e60f9403fcee7cac8abbfe27ad26f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657666, "uuid": "31fd8935-24b5-4b88-a666-b8f296482ecf", "comment": "Malware payload (GuLoader)", "value": "97cb7740ec9f0643c911e147ef1365b17babef450c76257a54b65360b8a7556b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657666, "uuid": "9f63d1db-3538-4891-b7f2-da39fce71b6a", "comment": "Malware payload (GuLoader)", "value": "b323653c46c4a37110e29ac42f73a3de43ca9645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657666, "uuid": "c4c390d5-9150-45aa-8831-4c687a71421a", "comment": "Malware payload (GuLoader)", "value": "71608546d25cb43c0ba53e42d1454476880d86c558c0a9a93c7dd307fec733f6a0c7dbac4fcdf98a7f168b4c6ed4d311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657666, "uuid": "30f811c4-7831-4dcf-964e-b514375b9209", "value": "T12193AF331688E692F78A4671C53303431322EF935DB9AFE738C87E195672A0749F2A1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657666, "uuid": "4829f5b1-47f1-4080-a332-eddc2d6b444f", "value": "929bd76d4a79150f11aeae8468aa1e9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657666, "uuid": "c990e7b2-934d-4e9e-86df-f9099be9cbd4", "value": "1536:pCi5rbF5wx7qLkfOzBQqgu5Nt0jup1eGeGy:UExgqLx8uNtsu7jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630657666, "uuid": "5f0e942a-aed0-46d4-8bcb-7cce44757119", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630657666, "uuid": "f057529d-d179-4ad5-9798-b90d1b603133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657666, "uuid": "15464713-1742-4b19-aadb-cc8db53d34b3", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c1f501-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630660351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660351, "uuid": "f336b47f-f1e0-4bfd-97d5-46c550c97de4", "comment": "Malware payload (njrat)", "value": "ea9bf7fd66e692a233b8252c9c64a879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660351, "uuid": "e4551fee-fb2e-4e84-9f70-4f7ad318fba4", "comment": "Malware payload (njrat)", "value": "97f16cb54032228dd889ddec3499dec6b6ba825a7a337a9937b75802a34bd2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660351, "uuid": "466f30a5-52d4-4da3-8c73-8c7df4752dc9", "comment": "Malware payload (njrat)", "value": "06f8c1cab06d866b3ed0522b380bf08e866b9f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660351, "uuid": "3e188d2e-c90d-41af-8537-b7dda4e21182", "comment": "Malware payload (njrat)", "value": "5ca4bad03cf63d53fef67fd8a5feb38f596ad67bddb7b911cf2beed3c61234183f92ca5e379a2be32ddcc468b8681d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660351, "uuid": "7b9f39c9-1ecf-4ca5-85f2-f93eb6d0ca3b", "value": "T13C2407C62B784426C85A4631FC7D824312649BCF4C215B6B9C91FC9D7CFEB8A371BA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660351, "uuid": "4579a7bc-1f7e-40f2-b03d-d1c3f3ac69ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660351, "uuid": "c335e354-7e1d-4d06-9080-4b103beb2be5", "value": "3072:8RudWMoLPiyucv7YZXz89503xH9Pne7fs:8Q4v0cv7YLHPne7fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660351, "uuid": "944f310d-9270-4086-9be9-9e0c550edf9b", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660351, "uuid": "8f5656fd-92b4-463f-94ff-358581d52ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660351, "uuid": "e380a387-6b32-481f-a1e8-0558b8073d98", "value": "97f16cb54032228dd889ddec3499dec6b6ba825a7a337a9937b75802a34bd2a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ad8d52-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659934, "uuid": "91948df2-34da-4897-92f8-496c68682969", "comment": "Malware payload (Stop)", "value": "401344b40ed3c60545efcb8068226075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659934, "uuid": "4aa1d412-082b-43c0-adaf-62df35ae04d8", "comment": "Malware payload (Stop)", "value": "9915b1b61a0eee3b29c2c7238f5f3198137e3b6479689224c3381a155d7b53fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659934, "uuid": "1ce7988a-806b-45a0-a4a6-2106d59f5102", "comment": "Malware payload (Stop)", "value": "26f447c68d9507cb7e6fa85934b6308164761d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659934, "uuid": "3334af7a-407a-444b-b21b-077181a4a9f1", "comment": "Malware payload (Stop)", "value": "82637705d5d5219760a23315d0413a4333335144b2d8aa5b0a74e21ed081d5e788078db4295d046fbfd5dc97ba0cc3eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659934, "uuid": "51e0438b-54ef-43b1-aa1b-f277d2bb7335", "value": "T18F050130ABA0C031E5A731F4597B93BD69287DB0EB2051CF62D62AAE96347F09D70753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659934, "uuid": "2243fe2c-58c6-47a7-bfb3-257176732bcc", "value": "235315ed783e15a9f0262d40cb1ad6da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659934, "uuid": "575a24e7-5e00-47ac-b891-1b3394104a23", "value": "12288:zWOf/+V0FPgtI1OLjwiwYBH+xBy21umwtqFN4xPuN5l1UAvE9GmOYTziCSQ:COf/Fkf/PBH+1Jw4cxY0As9GOiCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659934, "uuid": "ca6b3dcf-d957-4456-8db4-d4b8f0141850", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659934, "uuid": "2011d537-d993-4ad9-ab0b-26c38a1c48cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659934, "uuid": "330798d9-e612-4a84-b152-29693bab6b39", "value": "9915b1b61a0eee3b29c2c7238f5f3198137e3b6479689224c3381a155d7b53fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a6d0bd-0cb7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630674243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674243, "uuid": "219dece2-6864-4d29-8aaf-4272ccd19860", "comment": "Malware payload (AveMariaRAT)", "value": "50801fdff244d354d9d3e3f9495c6fa5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674243, "uuid": "b4c425c2-7a51-457d-a115-f6bc82854fc9", "comment": "Malware payload (AveMariaRAT)", "value": "995c82e7ea2a4f8882876f17fe0e3cacb47860744d48f250bdee6a7e9b01f0f7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674243, "uuid": "b187af8e-59ed-4b72-a06f-c277ec90885a", "comment": "Malware payload (AveMariaRAT)", "value": "986eab8d881a365213914e9dd1b764f700065e8a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674243, "uuid": "d2224eed-fa0c-45a5-b5fe-76e8288d5190", "comment": "Malware payload (AveMariaRAT)", "value": "dd83ca02026bac4ea33b769a3fc6ba98dd2e77b4c86ef16ce7549d7fa14fa27a12faeffad770643959869f2a24cf7689", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674243, "uuid": "1ed52848-fd8c-4bbf-9c18-bb6c07624baf", "value": "T142945B33B382E86AD081447D7658EBE840287E30196AD047B3D57B27B9729DB9F18F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674243, "uuid": "b0b9f4dd-cc08-431d-b595-7a5bcdbf5e5a", "value": "d746df0c6d243e11e2680c79fdf70b3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674243, "uuid": "6588282a-84a9-4364-a9a0-d3b4a2ffc3c9", "value": "12288:SmetOfNlWzbfJolmJxRHHE6mRsc9gC8NLhPtD6IA1:SbtOfN0fJ4OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674243, "uuid": "a5aec0f8-f8dd-4672-ab71-bb74312c40b7", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674243, "uuid": "4d507644-2ac9-4dce-a723-8363f194f2cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674243, "uuid": "ace5baa5-6bf5-4d0f-9a7e-3e61e6e45880", "value": "Booking Confirmation - S2103492787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4339d0a5-0c98-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630660864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660864, "uuid": "d4367610-73ba-4332-b1ee-27f7981f4d21", "comment": "Malware payload (Formbook)", "value": "481df71026e894e91be4b8367d879912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660864, "uuid": "99d0cdf5-1d46-47db-98a2-d673184401b0", "comment": "Malware payload (Formbook)", "value": "9b4f5703c5ab1e5e1ca54fbdf0412956a4738217a0c0cc4c2872090944dbee74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660864, "uuid": "e37918a0-2a6e-426c-9614-9a6902112747", "comment": "Malware payload (Formbook)", "value": "976a2a3152895dd0af7d01ce99f0bad176e4dca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660864, "uuid": "175b1157-8ce3-438a-99a9-1fb87794775b", "comment": "Malware payload (Formbook)", "value": "888261c39aa80ca3df7f4966e30d0f59ee1b403fb548512530fd70b56b59af8c5eeb64419ab448f70e2ee77c319c9e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660864, "uuid": "67757ae6-8961-458d-a90c-df85be9d0b80", "value": "T151A4DF9D325076EFC857C8778EA81C20AA61747B930BD307A45721AD9E4D69BCF121F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660864, "uuid": "9d3d49f5-c038-4fa9-912e-dc1b369f003c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660864, "uuid": "abc1d51f-3f8a-41c6-97d2-70cfd7de62bb", "value": "12288:yaIm00pjRF2urJVJtkYQ6oKUYgyoGED7rFNDOdk2+W6Z:yafxljtkYQ6o7tbd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660864, "uuid": "da937fd6-c2ce-4575-8422-b8bfdd2b2ccd", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660864, "uuid": "62bb2e26-240c-43d0-a377-9e1798c4cafb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660864, "uuid": "cbcb860c-edeb-4b1c-9bd7-54deab722355", "value": "mSR4x9NnMI2lSah.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6d39b5-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659884, "uuid": "4bd3a592-d66d-4df3-b8b4-228c46f8849a", "comment": "Malware payload (Stop)", "value": "75868be74118ea4ede0f5970a958f93b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659884, "uuid": "a658002e-c28c-4979-bb34-845603336a73", "comment": "Malware payload (Stop)", "value": "9dfe173d27af62da7c78754527de5dd892bab94b7cd1658e087c7e64f86211ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659884, "uuid": "aeadba10-06bf-432b-afbc-a4acd3337ec4", "comment": "Malware payload (Stop)", "value": "3a8980599d3b387a84e66e299ba23b1756ffd1bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659884, "uuid": "905a2f10-8a09-49d9-9bdd-8a9eb7362110", "comment": "Malware payload (Stop)", "value": "58ee1618ab5c19491a1512cc7012817d24502f9385eb281a144cb44659c610ccfe8efec73510e5b0f8850c642e6f7225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659884, "uuid": "0542520d-b435-495e-b5a2-ff405cd8bf0f", "value": "T18305F130AAA0C037E7B712F49576427CA4397A705B3C80DBD2D56AEE26352F4AD3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659884, "uuid": "3b5a1e65-1a4a-47ba-b886-e9e954c746f9", "value": "60cc0daaa74806110a4d23b786f367f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659884, "uuid": "b2e68db5-af46-46c5-bd49-5067d11a9d45", "value": "12288:jLJZKvHZc3HEOP0odGgeOs1nLmt6XGTmG6VBaNazMmcCMfnuIp0zX7+OmPrP3u:RUHZiHVs1L/wm1BaNiMmcCMfnui/Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659884, "uuid": "a1f88192-0abe-48d3-9b97-3832c22ee931", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659884, "uuid": "3c854539-0acc-438a-bbee-7f482f9a6d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659884, "uuid": "bfc8da6a-565c-4667-badf-407abf6f9067", "value": "9dfe173d27af62da7c78754527de5dd892bab94b7cd1658e087c7e64f86211ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7cf688-0c5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1630634788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634788, "uuid": "f046b7d0-65f1-4095-8832-7ac9293e3aa6", "comment": "Malware payload (Vjw0rm)", "value": "67fbad40453a19402d1989cfd18c769c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634788, "uuid": "11ad613f-951c-4ac1-b03b-eeb2318e2910", "comment": "Malware payload (Vjw0rm)", "value": "9e08b5396987899e20119e6baa726653c3e03c85772e5f07a71b586338d6e110", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634788, "uuid": "a04afc86-aea2-45a9-bbf7-841e97cd9c43", "comment": "Malware payload (Vjw0rm)", "value": "a6a7980d2200573fa05bd4d00b3bd73445fad99a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634788, "uuid": "4aca6777-7009-4d55-a7ec-44975446dc55", "comment": "Malware payload (Vjw0rm)", "value": "4e1e003581943744330f57d867a90a95f94dac8b7390cebcb880ffcc3643cf24fb31b652ad824197f97db36d4e4e9042", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634788, "uuid": "9019bed9-e529-48d4-8e61-2bde97f54d2c", "value": "T143E2B2CC7CA1B4D99555E178396F6DC827E4630BE09587CD381DB3804F322A8C7EAA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634788, "uuid": "c8de519f-13f0-43a1-9537-d53c08067af5", "value": "768:M4h4XJXAT93bYgqpUbUGguXjEVwGRIwo3lq0+eOhX:o5wxEgqpUbPgvV5s+eiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630634788, "uuid": "23ad3e03-174f-4621-97ef-84c28632df2c", "value": 32064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630634788, "uuid": "2736659d-5722-4391-b022-42afc5858fb6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634788, "uuid": "99b33680-bad5-48b1-871a-ebe4fc6f989b", "value": "Detailedzmc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f447f376-0c87-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630653860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653860, "uuid": "aa3bad44-e80c-4d05-9841-d9f2c33f3054", "comment": "Malware payload (Formbook)", "value": "af2edcfc56410f6c55d61839443551b3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653860, "uuid": "bfdecb53-957c-4051-ba38-b32b1920f543", "comment": "Malware payload (Formbook)", "value": "9e13e3f3e38b3a22e6780c117ddf13b7d24b8548f38dc8fa38ed1bab9d011760", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653860, "uuid": "d3c30386-6685-469c-8ed9-becc0b16da81", "comment": "Malware payload (Formbook)", "value": "d4cd39eca36faa5aefed8d0e72ac8c3bb6cd1004", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653860, "uuid": "c3b8cd05-b067-4a01-a04a-c4bf7f79791c", "comment": "Malware payload (Formbook)", "value": "a9fe62c725029d12aba229e187525e00c68bd6f8104f98519e45dfe93ac899cdc49e0bf9f75c83162131f7a6a916a7af", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653860, "uuid": "b9377410-1bbd-429b-b11c-1baf5c637fa7", "value": "T1C2D4F1E76788DB75C08F4BBA1415AD7849C87C260B3E50E5E60F7B86C7363324B249E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653860, "uuid": "c3a1b4ec-79d7-4eae-a856-84d68c2e1342", "value": "12288:1gTAVRipNHIQfYarb0HLZ3sYsLDWeV/s3M2J:1PipNHYarb0Nc/qSs39J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653860, "uuid": "7cf24369-574d-4fd7-a051-8417046a9355", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653860, "uuid": "fcb5ceeb-3ef5-4294-81cc-4e952513bf4b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653860, "uuid": "c8a5fe12-45bb-4079-8943-b0da55442517", "value": "Plata.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4514543c-0cb7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630674181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674181, "uuid": "f4ebfffd-cc2f-4b6c-8115-9d94c10ea1c1", "comment": "Malware payload (AgentTesla)", "value": "1c0e4ff90648d268163d480f1e451b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674181, "uuid": "9c6b919d-aa3d-46cc-a078-af7b02e2e4bf", "comment": "Malware payload (AgentTesla)", "value": "a049ab7268bbc638b478cba3b798a446195a979c900480ec610ffac49cf4021a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674181, "uuid": "8e6dad17-399f-4036-b56b-18854fd84009", "comment": "Malware payload (AgentTesla)", "value": "61c141c53acf89ee7495237d23792772d58ae90a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674181, "uuid": "1ca2f87e-d644-4bdd-9431-53139c1349ee", "comment": "Malware payload (AgentTesla)", "value": "6e2b676d4e9e71d0e15800de5257c0fdb19cff9ac17d9eb8d3f073c9ec01b94d37365722e989c9142768b665b812cbf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674181, "uuid": "acfadf53-1986-4428-aa65-f21d06729a1c", "value": "T19E64126FCE291997CC6650BEFB0619FC264C27885AC1F3CE45B598B90F811A30D8E9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674181, "uuid": "77969344-5e64-42e9-89a6-1b56310b818f", "value": "6144:pTUGGljC3bRcTY3uHUqla+0ND34vwWQglN9gn1KOA1uFz5zhTZrQ+:pTJKqbRsHUya+0Nr8KEkhTZs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674181, "uuid": "a2956487-e62a-4fa4-a566-df6ecb17e3cf", "value": 331710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674181, "uuid": "92f30906-d236-41db-83a9-dd6055ee1947", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674181, "uuid": "da58616d-3cea-443a-94d7-395af231707c", "value": "PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16f3b1e-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Worm.Virut)", "timestamp": 1630660270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660270, "uuid": "cd85a0f2-db14-411d-8edf-a1002aa99c99", "comment": "Malware payload (Worm.Virut)", "value": "62c29addc6028ce087bb484efe7498df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660270, "uuid": "4a9033b2-1ce6-46c9-8706-41565da6ec3d", "comment": "Malware payload (Worm.Virut)", "value": "a0f8e1fa630e8b0b470bf155ee911a08bd7ee6ede419d9abcbad6473e54f5d78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660270, "uuid": "276755cb-1707-4a1f-8cdf-09ce08ee49b1", "comment": "Malware payload (Worm.Virut)", "value": "45720c6f3e4d03be3b5a1ba3b1870ba7cd284a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660270, "uuid": "ea05f34b-03d9-4280-b6ad-458d8ac94178", "comment": "Malware payload (Worm.Virut)", "value": "cb2b1fa423c331c96b45d71552b6f9884d049754c8d35bf563b8733796bde77a143b08b599b95b83251769e2c4043533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660270, "uuid": "dcf1166b-c6fb-4957-bceb-539a4c490e8c", "value": "T196C4AE82EBD340F1D8970B71546BB77F9B325E0A501CDD9AD3943E56AC332239A2E394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660270, "uuid": "c4ac8e7d-3c36-4c84-b892-e633db0fce10", "value": "23b7a2ad6dd5722f5566eaa0d8a348bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660270, "uuid": "0b57f476-938b-49bc-9164-1c52469e47f5", "value": "6144:FafsiuvAJ+tTm6cyERSiytj71cPE4jKS6vFEZ9h1Ku:qCvAJ+q6ctRt636PfjO9ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660270, "uuid": "f521eb0b-16c6-4031-9e75-ff2457e644d4", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660270, "uuid": "117b1d7c-cdc3-43bc-b5aa-9fe55448b7c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660270, "uuid": "40e974d5-922a-4c9d-8a01-5fdc8a42b648", "value": "a0f8e1fa630e8b0b470bf155ee911a08bd7ee6ede419d9abcbad6473e54f5d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e811e3-0c73-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630645214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645214, "uuid": "564cb42e-42dd-4170-bd22-4cbf4648c0fa", "comment": "Malware payload (Mirai)", "value": "4282e820aa692aea0f2a797f7b2bebae", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645214, "uuid": "1848e9c3-2daf-4edf-859e-fbc451833330", "comment": "Malware payload (Mirai)", "value": "a29b323a5f435ac5f9ba5fe58b1360fecce432261ef927bc2455115e04da57c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645214, "uuid": "a95013d5-3cee-484d-95ae-9d7d47243843", "comment": "Malware payload (Mirai)", "value": "508a2efef5cd791cedaaf8d87cbcd2bd928071b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645214, "uuid": "55e89fdc-3e41-4097-8340-3f967dd56fdd", "comment": "Malware payload (Mirai)", "value": "6a7170dcc3c414e03c239a29b0a5cc59b27e9b0ab864594d88ae8d38291a8dc975fe6a4445ad86d02f65ab05ef1e5cd5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645214, "uuid": "762f5fc4-c5a7-4c82-9de2-d7b36902489a", "value": "T116E2E10358E8AB18E96651B71F2A771A0C12F74DB3C5AA309F5CBF3A9511B262F4C743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645214, "uuid": "2b5b1864-4fdd-46d0-bd16-6a2f372521ee", "value": "768:LrKBirq/kT8aMCNNUsMOZ39QFawt/7xH3vIsR06nbcuyD7UryqX:Lr+i+MoKN6NOZ32Fjlfc6nouy8mqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630645214, "uuid": "60078d7a-7f19-4e74-b961-baea6d9415e8", "value": 34100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630645214, "uuid": "dfdcbb77-ff58-4bfb-b5cc-e94dc703754f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645214, "uuid": "28ce9f07-e0ae-41cb-a0aa-83f30d9695f4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a864d2aa-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630660604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660604, "uuid": "fa0be974-27a5-48e4-b642-66ea66cbe75a", "comment": "Malware payload (RaccoonStealer)", "value": "19c85fb576384f43020ec787fd389e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660604, "uuid": "785e6100-e766-40b5-9577-70212faef53d", "comment": "Malware payload (RaccoonStealer)", "value": "a2f71273cbe02b6f7a01b888444232210fac6217c3ac58370c01c5ee32a8a7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660604, "uuid": "7c2aab64-097b-4cb8-923c-f3f8935e5a06", "comment": "Malware payload (RaccoonStealer)", "value": "7a613944e53ff9afc8c50fd068b3533c123f8bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660604, "uuid": "5efed2a9-c96d-44be-8a48-3a8c7eb60d50", "comment": "Malware payload (RaccoonStealer)", "value": "7d70fad88529bba21495546fdeffacef3eba336e4984fb09038865aac67f951600a1ab94d24f4182106df70f905a51e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660604, "uuid": "b1abe819-9c65-4644-b403-7c041ee7e656", "value": "T122B401A0B618F436C17BD570782ACF845A3EFE6149588147FE683A1B1E71FA04E16B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660604, "uuid": "9ad2aee1-3372-4771-9641-25c13cf1035b", "value": "c4966332d8b4d65c8c07803cb5fb54a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660604, "uuid": "60cedb1d-502d-428d-85df-5e6e405008bb", "value": "12288:kVHPFeImGfEIVaA6oqCdoX/4wtTvn2XMHAOgKcC7THlS:KdeJGrxqMW/hrfgKRJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660604, "uuid": "6a81dc33-5ac8-4528-8ddf-7129798fad74", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660604, "uuid": "04f0b8fd-c8f2-4b99-84fd-06cb902c36f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660604, "uuid": "919a9c3a-5469-4c05-b3b1-54c6b46d911b", "value": "19c85fb576384f43020ec787fd389e21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f349dbb7-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659871, "uuid": "fb9ad03e-3bc4-4190-b588-d985cadff2ea", "comment": "Malware payload (Stop)", "value": "fc2a2984319815dd9a0ab22c3839787d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659871, "uuid": "55c81db4-6a7a-46ea-b690-ea5633412e0e", "comment": "Malware payload (Stop)", "value": "a4656e6277f4a2474916019682ad674c7988a3b30a72ebc34d16089cb3e22453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659871, "uuid": "8606cecf-d6ab-4ddf-adbd-9c1a22ebc610", "comment": "Malware payload (Stop)", "value": "6a08803763c9a795e07aa69549f9d22a17f8e9b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659871, "uuid": "22a070a2-3293-49cc-b6b7-f6f6497b5672", "comment": "Malware payload (Stop)", "value": "9bced5c1526adbdc907f4610831a0ae98018347a3a4d7275b5843907609ccd9704ecaf435b2e5a0ac4870a99512e2cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659871, "uuid": "15c4dd94-e91f-467b-8c90-69dffe866084", "value": "T183050120A650C336E5F315F4A97A837865287EB19B2440DBA2D33BEE17346F0AD31B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659871, "uuid": "09d36b3a-9a4f-4a42-8877-1b364fd6f9b1", "value": "f536c766660697a0f33f0299d3f205dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659871, "uuid": "b941d389-6567-49f9-afb8-2c7264212ee2", "value": "12288:z0GiE80JnPRI+T8STguqrMyMnBOt7+1m4ubRKR4D/GSWRKhvoklHgVSnDun/IQ7j:YGiE8qXTWrkOs17I3uKflHgVSage", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659871, "uuid": "cce7e18e-0855-4ac2-a49e-4a080c59dbaa", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659871, "uuid": "015e4a08-b225-4915-af0a-3060e9eed857", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659871, "uuid": "a5d00da4-a4a7-40f6-aed7-3aa19d0b0cb6", "value": "a4656e6277f4a2474916019682ad674c7988a3b30a72ebc34d16089cb3e22453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1df6dd1-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Macoute)", "timestamp": 1630660244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660244, "uuid": "c1db7a24-ee1c-429d-b34d-0b11b9a23bc8", "comment": "Malware payload (Macoute)", "value": "7e2e75d9ad69f83912e817a8fa8447ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660244, "uuid": "0d53df34-6e45-4663-8193-d3856adb7360", "comment": "Malware payload (Macoute)", "value": "a54a8fa6f96f4274d53488f96151173c097c553f8ecc5af2a07cd8c4596acab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660244, "uuid": "163be86d-fe40-443f-9b08-abf7bc5dbddc", "comment": "Malware payload (Macoute)", "value": "5ae9a270c0acd749a558dda421a05e194703194c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660244, "uuid": "4b8cb543-d15b-40fe-8051-e243941af299", "comment": "Malware payload (Macoute)", "value": "8eac507a03b349b00c9fc338c1dfc9966bc22b78f9424a2564642cf1d7d59f8b85b59202f21ccb75e616463867884eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660244, "uuid": "eca366ff-ac3b-46f2-9024-6cb5a72f0862", "value": "T1D0E4AE82EBD340F1D8970BB15067B77F9B724B0E502CDD9AD3942E56AC33223992E794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660244, "uuid": "63d1af34-242f-4e2f-904f-510920df8ed7", "value": "23b7a2ad6dd5722f5566eaa0d8a348bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660244, "uuid": "1eefcfbf-70cc-48f2-af77-fb46efabb6b6", "value": "6144:0afsiuvAQ+tTm6cyERSiytj71cWE4jKS6v:BCvAQ+q6ctRt636WfjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660244, "uuid": "bad107bd-2884-4199-95a0-5f8ba320d38b", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660244, "uuid": "01d2e7b8-3ea9-4992-874d-362d0492b250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660244, "uuid": "cf47fb42-6dc9-4801-b34c-505483ea61a6", "value": "a54a8fa6f96f4274d53488f96151173c097c553f8ecc5af2a07cd8c4596acab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca7c474-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686462, "uuid": "cd50cadf-2bb0-44f0-8220-1cfc83c38c97", "comment": "Malware payload (Mirai)", "value": "dda9fd3a1c3034fc78684ff7c42bf44a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686462, "uuid": "d2ba8bb2-7ff4-4a44-987f-76d4deb37ce6", "comment": "Malware payload (Mirai)", "value": "a5653f5520ed257dbfea878bd4a2de19159f387bd8f38a26019f943ffd8f87bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686462, "uuid": "64268ba9-77f3-456c-af69-e898ca1a88c4", "comment": "Malware payload (Mirai)", "value": "5751db76d9e26d357e26d037ece8dad79f2c7a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686462, "uuid": "6875aad7-c0b0-408b-953b-c53450eadf1b", "comment": "Malware payload (Mirai)", "value": "9aad01037dd466ac387bc4d71b5305e839e140c18665cf90dd76b9456577f5375c1c9090095a561588fb8a1f4ba9608f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686462, "uuid": "98b5a0f1-2f78-41f9-80f5-793d13d2818d", "value": "T1C6435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686462, "uuid": "fae8dba0-a2e4-478a-9a8f-cb44d5f323de", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEppVuz2GipH6TnSgGABX:ybUg1Jgzz4Cqu1HFsi6nSgG8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686462, "uuid": "d95787e2-5c40-43a3-910e-1db31855793f", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686462, "uuid": "b989263f-eb19-4d20-a057-c2c4c18a87e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686462, "uuid": "8cc94b8d-4110-4a5a-a19a-da5ab5463332", "value": "dda9fd3a1c3034fc78684ff7c42bf44a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e907771b-0ce0-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630692066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692066, "uuid": "f5b8ed72-a235-4213-aa30-8d61fc6c5a83", "comment": "Malware payload", "value": "62459ccd2fbacac2dd46653600d01a63", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692066, "uuid": "ac9f28e4-491d-46e9-a797-c2f997d919c3", "comment": "Malware payload", "value": "a6eca39c1bfa2e285ea50a5de74e1bcb1e56d9f244c7ab3144cce3daf586d5ab", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692066, "uuid": "baf35059-12a4-40e1-bc73-e92fd7f6bab0", "comment": "Malware payload", "value": "9ca7324059344f4134072e021a48e4c1cd667415", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630692066, "uuid": "3e763f8f-dd27-41bb-a29d-ed78b820a6da", "comment": "Malware payload", "value": "f7e6a16d893f069a0600d8a8c13b8ee4e440e372c4d3f306b3945760b6f065dd8552898f6d5c65e746eb7d908c56131b", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692066, "uuid": "ecdbf214-dbc9-4f06-9e82-18d25b388dc0", "value": "T17063B3888307932FA51F18FFEC4A095323E90E26E8FD5185D7F8449E2ABE56D64E054F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692066, "uuid": "051a0561-215c-4691-a7d5-e42c2c0f2d14", "value": "1536:/yrmOP4dnl586not0CZ6lRVrkjEmfQ7RZwuhUEtSepfb0fn7LuO:qrmTD+6nhCZIgEmu7SafOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630692066, "uuid": "c1da99e5-212a-4165-a3cf-49d87d2aa9f3", "value": 69100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630692066, "uuid": "3b37928f-112e-4026-badc-0be7c8e89984", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630692066, "uuid": "a12f35ba-de32-4278-9663-4249ad921fd9", "value": "SystemUpdate.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded8f37d-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FlawedAmmyy)", "timestamp": 1630659837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659837, "uuid": "25c104eb-79be-46ef-9d38-5153e72f8c55", "comment": "Malware payload (FlawedAmmyy)", "value": "a0063f8960f976b6a56ce2831b34ae19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659837, "uuid": "19f53116-a523-431f-9570-637a25ac437f", "comment": "Malware payload (FlawedAmmyy)", "value": "a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659837, "uuid": "df363719-91d3-4b6a-91ae-680c28490106", "comment": "Malware payload (FlawedAmmyy)", "value": "bafde121d67f8359ddebaf5c13ab86eceb6dccc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659837, "uuid": "3d7c506e-be66-4e33-b9bd-bafdc29c7242", "comment": "Malware payload (FlawedAmmyy)", "value": "e875bf187f05a0a9c336e1624fbbfd2a72e2e9ea5a2ac0b675b1eedc924833a7a186a061815a18d53e0410f15d199c73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlawedAmmyy", "colour": "#7CC188", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659837, "uuid": "61370a06-7462-45dc-b861-356180681972", "value": "T1FD25AE267EC241BBD37305B189FAA7B1E9B5FE604927860F53C89F1C5976D01CA12B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659837, "uuid": "658b7bf9-b407-4763-bcf4-10f2aabc244f", "value": "a058756785ba9de3e6bdd1f326bba0dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659837, "uuid": "ffff3c35-17f3-4541-a7f4-73f823ef10a3", "value": "24576:4MjPJ5g9KVGrdNikfu2hBfK8ilRty5olGJsx5:dJ5gEKNikf3hBfUiWx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659837, "uuid": "9dafb85b-64c9-40bd-b63b-5ab2915d609e", "value": 1025714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659837, "uuid": "a919231e-c662-49e4-9b99-e492b7414d86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659837, "uuid": "6f77cd60-20bf-4a0e-bb37-6a35a86f8279", "value": "a7259b65a4acac8f1ef4a5cfdced39a996e97450944ac90a306b5ea71b727cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9512c7f9-0d0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630711682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711682, "uuid": "bf3f8059-8ed0-4749-85fb-bc0b7c6d03de", "comment": "Malware payload", "value": "cb3a5fea2bb9a4a8b09eb97ec192aefa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711682, "uuid": "7be8a8ce-702f-41c3-9b55-b03acd59ca87", "comment": "Malware payload", "value": "a7b8ed29675fe0f87f13b799f3643c69ae777574a467464f0bd4779709963166", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711682, "uuid": "db0fa53b-9465-4c39-a3a5-ed4e06895a6a", "comment": "Malware payload", "value": "724824cae8fbdf1c9371989e172982f21c908699", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711682, "uuid": "38470e9b-5d13-4d76-9ac8-e5221db1a16d", "comment": "Malware payload", "value": "1a0c4098d1a3ee376ed09225718d8d4cd74485a9d45d02ca297fe9a80ba93d88aecb3f14509d63a85ed05df82b05243f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711682, "uuid": "f900196b-9bff-457b-9ef6-4981b80dff40", "value": "T1109292BCC01742988F8AABB8672B9F45008DB62DF7599173327C5B7067E2C76412797C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711682, "uuid": "7b0b08c3-f236-43c7-b73f-7013e61cf626", "value": "384:DpfeaMnMR5S25FAIgaXSM82LG1YG8Z9xuD/1x8:DherM7SgVh828I88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630711682, "uuid": "95ccc544-663f-475e-9a18-29e8b053ca2e", "value": 20814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630711682, "uuid": "54119a19-c644-4e7c-9a3c-2be20a2be9ff", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711682, "uuid": "0f765812-0f06-42f2-8ac4-941eeb5dfdbb", "value": "MT103-202109054839484.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af56df1e-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630673501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673501, "uuid": "b470e5c6-02c9-4c77-8d92-2394aba23810", "comment": "Malware payload (AsyncRAT)", "value": "c94b7f5ee82531ed0e4ca9a3678659a2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673501, "uuid": "434a547e-b3c3-4fea-b229-222b9bd0d494", "comment": "Malware payload (AsyncRAT)", "value": "a7cfc30c34a6e23fdb3812ddc0cca5867dd3b6a02a117f55cc7fd3c6c4550e77", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673501, "uuid": "8a861445-1fb4-4232-a6a8-e7eb069a9cb0", "comment": "Malware payload (AsyncRAT)", "value": "01cdf0889b8739c34f1fa376adad447f82d43fa8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673501, "uuid": "8b66034d-8d7a-414c-a8c2-ca09e032744a", "comment": "Malware payload (AsyncRAT)", "value": "1e7ca8ec3c89f8c2ba1bdaddaa9bacf62ca3c0240030da4dc46d6f51159560d3bbea250a36dbf0d649628c6803d2fbca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673501, "uuid": "6cb5168e-10ba-46c9-a4ec-6687af6d6a12", "value": "T199110077C75C45F90D4482E635D6EF1048E07ABE40D9EB1021B2952EA8EE66C1AD9181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673501, "uuid": "b0bd95a1-e8ec-4709-917e-1a23e25ca27d", "value": "12:IE8OKDm/exzWySmn2Rx2fdz/eaheuQquwxmhENZJl3Q3e5ngqrUWOBzWySmn2Rxq:zi5cxkhe4rxmEZz35nguUbB5cxVxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673501, "uuid": "62abba6c-0dca-4c48-b3f7-312eff954279", "value": 878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673501, "uuid": "3fda8d6f-70a0-4d19-8a04-6ac8269930f7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673501, "uuid": "59f07dd2-b50a-4199-8a07-8b3e0011a578", "value": "JDQFGRXBYUZ(9-3-2021).xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b18b88-0c7d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1630649458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649458, "uuid": "be93f19c-3458-484e-94ec-98909ee7be2c", "comment": "Malware payload (Gafgyt)", "value": "061f61857a5c523a1252e989a6700096", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649458, "uuid": "f3206987-a624-4c6b-8b16-8f9a1dd4701f", "comment": "Malware payload (Gafgyt)", "value": "a7d90da1aa7ea20efb9c68a66e1d138fb52651f5884ec8d8f24577d5a2f298fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649458, "uuid": "658c342f-8031-4e3d-9697-62660ea2d467", "comment": "Malware payload (Gafgyt)", "value": "011ef17a0a3f99b8884776e048b307b853398d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630649458, "uuid": "432858f8-f81f-40c9-9647-b586e4802ab4", "comment": "Malware payload (Gafgyt)", "value": "c4c227d82fcd66366c6e5974534937bc19d8a373a080933e89265e111a1e163baa499fa234578b812f37cc5845ae0323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649458, "uuid": "e57b8528-ca52-4f1e-9498-c797f1264413", "value": "T138A33B92B808EFBAF40F963B84634502763273F3AAD45B71A2136877DD761C11D6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649458, "uuid": "03681953-f0e5-4662-aebc-c93ce831b89f", "value": "1536:Eu7Obyj7HUQK5ebK08OV+4pXn8imwPT+lEMNLESg2yoj3TJ9:ibi7HUQnbKW+4nF7UdESg2yoj3TJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630649458, "uuid": "696b2e33-6b3c-481d-81e2-88a1e35b0fc9", "value": 98404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630649458, "uuid": "119210e9-3c77-451f-bda6-95714c442450", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630649458, "uuid": "bd6075ac-1837-4462-8d4c-ea622ae5351a", "value": "061f61857a5c523a1252e989a6700096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93071981-0c6b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630641670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641670, "uuid": "d1dee2fa-ce63-4415-beb2-6b051fd717b9", "comment": "Malware payload (RaccoonStealer)", "value": "d2d89e3321e6de67a70e4fc90314574c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641670, "uuid": "7c33a812-0833-47a1-abc2-89da92ae6992", "comment": "Malware payload (RaccoonStealer)", "value": "a83e2d5fd3612419754f48063005ef8f512010bbd83237163bd8d783bdec7446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641670, "uuid": "f1aab3cc-6359-4a7b-b275-70ae47633ddd", "comment": "Malware payload (RaccoonStealer)", "value": "e3ef17793f11fe47ca3caf82b401f4ea1ac8376e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641670, "uuid": "ed3cba77-ffd0-4157-9154-3379f2a19125", "comment": "Malware payload (RaccoonStealer)", "value": "c977e633cb15b34be39b44b31895d40d47e6b9ce91fea9336460f6e330b06dc96d8e65e73dc358c4f66381c9eaae9e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641670, "uuid": "bc928743-2a79-450b-8fab-45fa7866dbaa", "value": "T184A4F171BE90F133D0E6C5B05926CFA52E3EBC21D92041977675BE1B2E613D18A6232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641670, "uuid": "9d8e6f66-38ea-4416-9a5a-086b30d0f6bd", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641670, "uuid": "7ef4f4fd-284d-47c1-b91c-9f965ad3c188", "value": "12288:fVSQ56Y6GSR5ruFpVxfI9PahinY0LWidQ57T:NR6Y6GSR96LG9SZ0LbOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630641670, "uuid": "b7a01abe-f6a4-4d87-9b6f-8a5f801aca3d", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630641670, "uuid": "cb487634-d375-47fa-aecd-55fb5560b276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641670, "uuid": "7e91e7d7-f1cf-4ab9-a531-d5e2d52eaa33", "value": "d2d89e3321e6de67a70e4fc90314574c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03da7d4-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655947, "uuid": "3a357dcf-2060-47e7-9975-12868d4573be", "comment": "Malware payload (Mirai)", "value": "05bf8431ae56f87dd0bd9bdf1374bccc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655947, "uuid": "4f59b0d3-bbce-430f-9e8c-509c81bc34a5", "comment": "Malware payload (Mirai)", "value": "a922cff101eb17307b12442ab6f76324e643dd628fa5abed84ae1d975818cf58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655947, "uuid": "5cdf07a9-4d4f-47cb-9004-1b63e7d51376", "comment": "Malware payload (Mirai)", "value": "b2c543154b5a8b9dae49784819170ee248f1075e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655947, "uuid": "291a4f04-c36d-4e34-9261-72b9da379f6d", "comment": "Malware payload (Mirai)", "value": "5610cd720c61118f170b0e95ff59791c1ffad6c48cbe2b25cb325ef1135fd305c8d6d52b4364ceb590b0a51dc2c82b84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655947, "uuid": "59370d66-0e99-40fe-8c6b-1ea8740dd2ce", "value": "T15143F862B8D26A2AC6D053BAF9AF558D332527E8D2EF3117CD211F117BC910B1DA3E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655947, "uuid": "0f807a29-e58e-43eb-ad7a-47caded4e2e6", "value": "1536:AmEYgmsSlhiQo3Wz+JUzJzhhjoXg4mOoh+zCtNqCL:AmEDmEpeGXlmrhUtCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655947, "uuid": "d1990b80-2bcb-4629-8676-406513c0d27a", "value": 59580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655947, "uuid": "d1cbd6a4-090b-4b6c-86cf-34d9c34b224e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655947, "uuid": "68021063-954b-48ea-a02b-83010aca9f91", "value": "05bf8431ae56f87dd0bd9bdf1374bccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16cd01d-0caf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630671035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671035, "uuid": "5d757d37-63cc-4560-9300-af60bda1d0fc", "comment": "Malware payload (AveMariaRAT)", "value": "7cdbaac6ce5de3023ac8b8ebf17cbb1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671035, "uuid": "346c248a-af89-48a9-8022-3a2c99fe567b", "comment": "Malware payload (AveMariaRAT)", "value": "a98237e2ebf6a05173e905842d88a2fa8e721b1cff76942ff3bd99176a35c18f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671035, "uuid": "d3754298-20a8-4c48-8348-b9cec7636e2c", "comment": "Malware payload (AveMariaRAT)", "value": "6afb2bcf49cdca85a4781ffe7816a2551329e41e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671035, "uuid": "5c5a1de8-2f4f-4119-a809-2acbab91e0d7", "comment": "Malware payload (AveMariaRAT)", "value": "25769a421006eba1d7eb5b8bf9d6badac281b68aebf306eaf0c4a2a138288f01625b84c2eb86e2022b8f82ce0ac0f7b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671035, "uuid": "fb419b7f-df61-4010-8dd2-2e39f712681f", "value": "T102D41548E240BD9EC5B6AF3187943E5C55242E212BEE96CF60C2FDEE553AC9B7E10071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671035, "uuid": "941c224c-b1f7-4221-bdae-bf5e39d2c5fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671035, "uuid": "194e1138-1331-4aad-8441-1857062a8a41", "value": "12288:tGHDaMeQpcG3QqawUHpaUPZmCS6QfDLEILJuw0WV/K475xQD:t41eQpcGgqgaUPZmFxf8I1ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671035, "uuid": "57a4313e-a586-4d1b-a786-4712e83a9abf", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671035, "uuid": "50a8a8a8-39af-4984-adeb-0ad5b3a905e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671035, "uuid": "90fabf01-9a57-4ca6-86fa-7fe02a840e29", "value": "7cdbaac6ce5de3023ac8b8ebf17cbb1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "212c306a-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659948, "uuid": "afca9408-1f53-4c31-a9a4-64af66c84807", "comment": "Malware payload (Stop)", "value": "411d4192777c0619c25e663fdba7c157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659948, "uuid": "9ec93415-0046-44cb-bc2a-968604da976c", "comment": "Malware payload (Stop)", "value": "aa1af1f3b5f18d87340a9af9d253e296982e4fb1b11d88c7151c81cae86689c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659948, "uuid": "f3e9d18f-15d4-42f3-8881-48ef726b0ca1", "comment": "Malware payload (Stop)", "value": "38fb9bc961f5121ea41c09a0cdfa1c9613b8c83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659948, "uuid": "4bf8a4f9-71e3-48fc-8773-7d99ade8d6b2", "comment": "Malware payload (Stop)", "value": "de96a5e29be74d86968d79ed2de5063a5c241b31da6ac9e05174704feee7f9aee6c92b5cfc68e8aeba810a57ae4f21d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659948, "uuid": "ab18ccbf-f6ae-473f-a884-f61e89f68810", "value": "T1540512613261FDAED49452344710DAF7EB26B8B0A8A0D3573696774A1F7C2903F22FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659948, "uuid": "d6d19276-0f39-4f09-8650-f3bc0e385366", "value": "41ae3a1dcdcc3462598a2d3012d6e252", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659948, "uuid": "fa4ae041-344c-4340-9b67-1ede69ce246b", "value": "12288:7PH1/RsQXjeuRgD+l6udVfD3l/gkYvEHeLvKK8gpP+x1IRPhB:79FXKx8dp3l/MQeLvR86aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659948, "uuid": "45a23b8a-6531-4c37-872c-a498a170238d", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659948, "uuid": "9b481a0e-2a81-4f7f-9ca1-9f68ff54120c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659948, "uuid": "6680cc59-1c20-4a8c-819d-eb806925a5d4", "value": "aa1af1f3b5f18d87340a9af9d253e296982e4fb1b11d88c7151c81cae86689c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1d6ce6-0c63-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1630638354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638354, "uuid": "96188ddd-f28c-4e11-980a-d4a32651cba2", "comment": "Malware payload (DiamondFox)", "value": "c304acbf327cdb8f30afb29220277d51", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638354, "uuid": "6e7c8278-0bcf-416b-a776-dfa49eacf65f", "comment": "Malware payload (DiamondFox)", "value": "acdc44f3c8b2b8b12a3e396a3d9f5d353d17dab46b0e7d7cf39113e2e91d66a1", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638354, "uuid": "ae0756ed-3895-490c-9f44-478b55e8bdb6", "comment": "Malware payload (DiamondFox)", "value": "1f33fe2bb3d14061865f3c9fc46be2d1ddf99730", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638354, "uuid": "436ef033-eec2-463b-871c-12cece68fa72", "comment": "Malware payload (DiamondFox)", "value": "d5cb2bb3cf60401f6426b13c04164786d25bbf2075aff997f5abd122ada926085d9003e93c80130928497c0ef0fd66fe", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638354, "uuid": "01354df6-0fb0-4e83-a191-8ec8e8acb48f", "value": "T1B7F533A1B2E650B1E9C2207459587BF275FFC38C1A344DD733229D4E0EB6E24D12A97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638354, "uuid": "641a65cc-3ef9-40aa-a785-88ca0c6c0b8a", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638354, "uuid": "5fddec71-4b8d-4dfd-a81f-7aeec382a88a", "value": "98304:x3KFYBw54QPyO1MZS+LLsECvLUBsKLA/V:x3KFx5gO1sS+LSLUCK0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630638354, "uuid": "8fe88295-5daa-49c6-a47d-a74b0ffe49a7", "value": 3359206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630638354, "uuid": "e802add8-8e37-4adb-8202-d514ef7e292f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638354, "uuid": "80a2af14-79ff-4192-9426-7ebe274e89b2", "value": "ACDC44F3C8B2B8B12A3E396A3D9F5D353D17DAB46B0E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9d81c3-0caf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1630671027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671027, "uuid": "8bbeb041-7e72-4a0e-9e40-b25a3391f872", "comment": "Malware payload (AveMariaRAT)", "value": "40641703573ab3ccb1fafcb7f996b06a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671027, "uuid": "f4c9c366-f0f6-4aef-9168-f0e17178c136", "comment": "Malware payload (AveMariaRAT)", "value": "ada2977bf0938ac20058cad60ed4349ffd46b504637ceeee8fd66c1cf3bee6ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671027, "uuid": "7e1a2883-170e-4611-99c4-622df5a68d35", "comment": "Malware payload (AveMariaRAT)", "value": "d3c0f6c6c7118f759093f5594dd102275b6aa964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671027, "uuid": "a1ac2964-a5b1-4e00-a083-489c62e7b0fa", "comment": "Malware payload (AveMariaRAT)", "value": "39c27b37201ec8ef71f4a6b676553f041c0c7aaba269f68e6c155bd8e99aa639f2293aa018cabc0137969e3518ec93a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671027, "uuid": "68a76746-edb7-4aef-a8bc-f00c8d86b747", "value": "T1F5C48DA721002F7ECFEBC6B96A56CC28B5D06C3E4216960A52033159D53F67DB906FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671027, "uuid": "ae74ed11-379e-48bf-b67a-097ad8054279", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671027, "uuid": "2d33a0ae-c781-4f42-8a06-38e4fef7f655", "value": "12288:9oNAzi+13NUXLQVoJT9ec8bTlFrLS3Otkn6X2X+90OS:90A7WXMkhL8b5FrL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671027, "uuid": "e583fb08-30f9-4019-ba33-edf35a940912", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671027, "uuid": "8dc181a0-26b0-402f-a391-b8d24d951ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671027, "uuid": "47cb0d46-1c2c-4568-8efc-ecaaa0c303a7", "value": "40641703573ab3ccb1fafcb7f996b06a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65305dab-0c84-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630652331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630652331, "uuid": "03daa803-f1a9-4922-b452-1e357b7fd5a1", "comment": "Malware payload (AgentTesla)", "value": "da44b9da0c0ab27cbdbad4d8d492306e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630652331, "uuid": "67248448-ead4-4821-a92f-b4116924db18", "comment": "Malware payload (AgentTesla)", "value": "ae414e4663ba5b7b9a993fcdf7929db7521fa8261bbcd975f4ccb2e07d07eaa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630652331, "uuid": "e650240f-ff7a-4e6c-8312-42699b3783cd", "comment": "Malware payload (AgentTesla)", "value": "7a05178d78c500dfa133435414f644965e71bd37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630652331, "uuid": "2e3286b3-2388-4d93-8c66-683b0a39a306", "comment": "Malware payload (AgentTesla)", "value": "fe7a1f65757dc5aecda7d1e744d5728ba86d3fd0f11ad6be2e12a7415be4672a0296924c198a92ea00a4831110247335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630652331, "uuid": "deaea653-b1c6-401a-8cbf-909a7773d69d", "value": "T1C4E42C3E18FE23279176C6D5CBE18827F6C098AF3233A96567D747264316A4674C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630652331, "uuid": "740cffbe-ab45-4bc9-90e0-a823af29e3ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630652331, "uuid": "17a0e2ef-4dec-45d6-b5f4-a8d97c609cf5", "value": "6144:l8FJLgGrFQwl6wweeeQ2POM1P2ivQy6GErmVjwBdiPnZrO+XQjPBUIW6kkhtdqbp:1HUeeQ2mgwGXeenlObUIW6h99HE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630652331, "uuid": "df5cdc98-fbff-4412-b919-89ea47aff05c", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630652331, "uuid": "4534fd94-6938-4723-91d0-a6a0db999be2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630652331, "uuid": "897fa09d-795b-4ff5-9a4d-f36a2072a084", "value": "#RFQ September 2021 Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29f7379-0c5a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1630634529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634529, "uuid": "c56b2e9d-b28f-47d8-b92c-ac375cdf5e56", "comment": "Malware payload (RemcosRAT)", "value": "ce5d381161004cbbd80eaf1f37089cb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634529, "uuid": "df7243dd-c7c6-4ecb-ad12-60e2b552e2f7", "comment": "Malware payload (RemcosRAT)", "value": "b0f43b627353f91afa5e4a9c5eea655f5375e497933a6e37c3c0f8a5a29a2889", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634529, "uuid": "9745d698-bbd9-44c9-a2fe-c8f7761a1e2f", "comment": "Malware payload (RemcosRAT)", "value": "b9005e605fac55df470cde2b1ab0a1441fb1527f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634529, "uuid": "698be040-791f-483c-ad79-689d081c06b3", "comment": "Malware payload (RemcosRAT)", "value": "0ee199ce88459fcad135f8bf3fb3da346d905976ada62c49068fda1c3e8c8ee2b93fc0c3c1c6ec469a3fd75a08b8bf96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634529, "uuid": "39ffe4c5-9f39-4b86-87a0-373ba5d424ef", "value": "T151F47D22B640497AE0AB5AF44C0E72A9DC2ABD50367858E94BF07D0C5F7E3937726533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634529, "uuid": "898cc060-af12-4fcc-973b-d80ccf333bae", "value": "ee4f103a4bbb8328057c2211d7594d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634529, "uuid": "5d1cb1a1-5c37-4a3a-8a92-ce7818927669", "value": "12288:uEkuPF5S618CS6qkVdQOHvDc9aGKqa/yAXKQcj2SKI:uE/HS61uyswGKqXAzcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630634529, "uuid": "f62c0d87-bee1-4a21-80a1-f5b069ea2f3c", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630634529, "uuid": "d9f690b8-f00e-4ba2-800e-14dfd2e96481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634529, "uuid": "8563c14a-0447-49cc-ae9a-1188d042268d", "value": "ce5d381161004cbbd80eaf1f37089cb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e59564-0cb6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630674045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674045, "uuid": "511477b4-6ee8-4cf0-be69-c68682c31c4a", "comment": "Malware payload (AgentTesla)", "value": "ea22fa4a0451023ab06a36f45a971256", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674045, "uuid": "4a5bb5e0-7832-4309-8fad-bf5a03b15c94", "comment": "Malware payload (AgentTesla)", "value": "b122d1a85caab7c2037543205a66aa5e6e8bbbb36c4b62a7d143809c5e89f52f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674045, "uuid": "d5cf1059-050b-4a8e-bf4e-93b54a2849a2", "comment": "Malware payload (AgentTesla)", "value": "cd5523d5630690dd0ec8b35748588d0635bf80a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674045, "uuid": "08de4484-b79c-4ef9-aba0-b2b1ecbff3b1", "comment": "Malware payload (AgentTesla)", "value": "662387a6520d8de99f013e7edebbad4e869abe8bdba56411127cb399fa113591f977f7fab21bd38f4f07bf6e1b39df2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674045, "uuid": "e5e9c243-0cd6-4f38-ac6a-001e6235acde", "value": "T167D40C3E18FE23279176C7D6CBE58927F6C498AF3233A96467D747254306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674045, "uuid": "714eaded-716a-4ec4-8dc2-d61fad0adcd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674045, "uuid": "6d2ae8c0-d9e1-4a0e-a30d-f9659d487920", "value": "6144:LFJLgGRFU5Y+APYY65IVNO8mfJByhElG4rfWQapKDXK9jME1A7VxqLaPsRD4:65rOSUwbJBOElGcfWTSIMEmJ8Li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674045, "uuid": "68ecda2d-037f-4f6a-b15c-9cddd93baf0d", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674045, "uuid": "16377fa1-f6db-4686-9d93-b525244b9aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674045, "uuid": "a4bf8ec6-676e-4b50-a64e-4b618bd31ad8", "value": "NEW_ORDER_PP03-09-2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403c7ff5-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DarkComet)", "timestamp": 1630660000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660000, "uuid": "552ee6ec-0755-4c34-9dac-84f9ffa402d1", "comment": "Malware payload (DarkComet)", "value": "0bb1cb742eaddbad11d9e96993fb23d7", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660000, "uuid": "6c3202bb-72d0-4965-acce-e79469013cff", "comment": "Malware payload (DarkComet)", "value": "b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660000, "uuid": "355a0b65-6f04-4896-8a1b-5ab9bcbdeaaa", "comment": "Malware payload (DarkComet)", "value": "07437ed6538dfebb78a0367d002cd9212c68f6f0", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660000, "uuid": "b9ef14d3-a2b0-4b8b-af39-e38f83811ff9", "comment": "Malware payload (DarkComet)", "value": "89149e1f0809ec103e5b70ac24d3a561281049f7fabd8a6d33aef2898c620b7698761800c041a9e29eeab88938e01657", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660000, "uuid": "2fe47d10-a001-40c5-b462-4c6246dd44ae", "value": "T1DFF47D31F5808837D93219B89C5B92F5582A7E202E29754B3BF63F4C5E391837D1A2DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660000, "uuid": "7a6850a0-114e-41e6-b4c9-f8ffed69e538", "value": "009023b6b22e202aa54365d2270f6f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660000, "uuid": "217f398f-d21c-4fb5-8de5-3124d755faa0", "value": "12288:f9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hRW:JZ1xuVVjfFoynPaVBUR8f+kN10EBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660000, "uuid": "35c28e12-94f3-4014-a66f-9352e726604d", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660000, "uuid": "ef0940b0-b242-4808-ae93-54161bd19c0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660000, "uuid": "f751f212-063c-400d-a54c-8a348fa0e6d8", "value": "b13b73296a76348fa21f9d6120e93b0e6788dd1e0ffe245c23313384db089fd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc10ed9-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630684073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684073, "uuid": "ee6da06a-9f17-4ddf-85c9-ece547d387cb", "comment": "Malware payload (QuasarRAT)", "value": "4f40077f28e307d451afb27281494cef", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684073, "uuid": "3d1294a4-f327-49d0-a6d5-39d849e748ab", "comment": "Malware payload (QuasarRAT)", "value": "b16a75f0a6abb1b652aa6f48cf2e08d874305685797782981949e4b6ba496c2b", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684073, "uuid": "f35c7fd9-8ae1-4349-8229-62caa167c51a", "comment": "Malware payload (QuasarRAT)", "value": "bf49f8dca49687f671e62fa5766026d714565141", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684073, "uuid": "8f229091-8f45-4bc8-a902-96e8cf1e5fce", "comment": "Malware payload (QuasarRAT)", "value": "264ebbe0d3376e9175b1d30777d13df4402ef9fed17347d0650bc782bf00d7915f9c1786be1604f8b04573344cdbfb79", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684073, "uuid": "e0de38a1-4be5-4297-b58f-500b14edcb30", "value": "T12D31E2877A4A41A10656E2F0D6DEB263A1434BDA38FE3D730D93410CD5105A82B436FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684073, "uuid": "9cd161ff-13f8-4da2-abeb-a0195db3a38f", "value": "24:1SZ9ifdyYegAY2bWGYtxu5WY5OYWsKYBYjY37Q/GzoXaYgYfY55TB857Pn2bZZRm:lfRb92gjuv3BDukLZzoXTdwHT07wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684073, "uuid": "dbf2efb8-52d9-47aa-b74c-1c00d5f70785", "value": 1587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684073, "uuid": "548a1f25-c3fc-41c4-b367-1c54f6a02bda", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684073, "uuid": "7acf8f3c-6b3c-4131-a4a0-7b542acbaeed", "value": "Invoice #60122.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca7bbc5-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630660638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660638, "uuid": "eba1c5cd-ce81-43fa-8e56-f921c4205aac", "comment": "Malware payload (AgentTesla)", "value": "2024e2c86242cb9d85eed391638b5bf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660638, "uuid": "d845a267-87ee-48cd-890f-f90c00f8005d", "comment": "Malware payload (AgentTesla)", "value": "b1b878bdbd6ae390efbb3d9ab026ad02a3ff1fe95786b814f494a967415215ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660638, "uuid": "5e663a23-5b4a-4767-b253-d098705baae3", "comment": "Malware payload (AgentTesla)", "value": "385430041bcba65afbe23cf93df094488898305e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660638, "uuid": "46bd256e-06a8-4819-bd55-7de1353bf557", "comment": "Malware payload (AgentTesla)", "value": "7d0df01f8d9a6fdefbe77ddd5dfd268d5713a84b318d422648ee434e7e4862452d53c89e4e3e654def37d696690d9db7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660638, "uuid": "1550a126-3911-4d42-885b-85c03f05cc46", "value": "T16EA4D09D365076EFC857D9768D981C60EA61A47B431BE203A05722ADDE0E6CBCF120F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660638, "uuid": "2d9fa097-87b5-448f-85b1-90289e4e213b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660638, "uuid": "ba37bbe1-01c7-4d3d-be17-eb248bc06959", "value": "12288:Ll+jt8uKSzpvlQTDTd72u7Szddgent0faqDydAP:LItHv0r7Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660638, "uuid": "0032b5eb-eacb-4112-9144-b8bdf034506c", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660638, "uuid": "9c1e3f40-708e-4d4e-aaa3-3a45638bc9a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660638, "uuid": "6f0da51d-8c89-4e71-bf76-84fe444c8b95", "value": "Payment confirmation copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b1e9c3-0d05-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630707572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707572, "uuid": "045f4b92-c402-4846-a58d-0706e191797e", "comment": "Malware payload (Mirai)", "value": "2ed222446bc0a82b72a4df7911c4f8ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707572, "uuid": "d12204ee-acba-4539-8c93-4888d44cc2ec", "comment": "Malware payload (Mirai)", "value": "b1ffe51bea7b6d69c34ac644184252fb963426396ae7059f07a19b0a7eb3e351", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707572, "uuid": "d5dcacc3-0d83-4599-97a5-f4b6de2ff4ba", "comment": "Malware payload (Mirai)", "value": "e652504e7f9f54a90a46d839106cb1cc864b1d3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630707572, "uuid": "66223bd7-d1fa-433a-8e49-f65721f7c12d", "comment": "Malware payload (Mirai)", "value": "40a7dbb9724967796e6a98e590553e3a856c7903aafe2c595eccf4252a0c258fb0c0ab53c892f9715cc6220a7f7cfff7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707572, "uuid": "13008a71-d396-4344-8b56-c90b94e7012f", "value": "T19A64F1CAEF01AE35E9C00675BA5F034DB3768BA9D3C3F111F650C6293ADA1899F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707572, "uuid": "d82145c3-3d1f-44cd-b2b5-86c7df20cad8", "value": "6144:p3lOYoaja8xzx/0wsxzSiIoNsKqqfPqOJ:p1CG/jsxzXIHKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630707572, "uuid": "6552a1a4-41f7-479e-83c9-ce0d04e564a8", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630707572, "uuid": "468b5ecf-710b-4ed8-b1d1-7e9fa3239210", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630707572, "uuid": "52e001cd-0a60-4e04-b45e-5260abc5880a", "value": "2ed222446bc0a82b72a4df7911c4f8ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c9ac15-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630654162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654162, "uuid": "1dac10fb-abf0-471b-a784-d3bdd4ab9b50", "comment": "Malware payload (Loki)", "value": "192a537a70e7293c8a7684d280466864", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654162, "uuid": "be1da8c7-411d-448c-a91c-1b7ec59042e6", "comment": "Malware payload (Loki)", "value": "b3ac6ebdcc3bfe58a6ad6d3c0f99c2ea9d70616167da27a108601b73a3730b0c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654162, "uuid": "bbe1f831-af27-4775-b816-c79556c31683", "comment": "Malware payload (Loki)", "value": "7e751ff57301728df23c8c6eb0c424a862d13b8c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654162, "uuid": "e8e40fd8-98d4-440b-bd32-78591b4ca680", "comment": "Malware payload (Loki)", "value": "2d7de822d2b4dc182df4b2a537f58ce06979aba69e2fafab0e9b633b63929d43c84c3507ffebf28d5d6fc7ff4df7cb5e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654162, "uuid": "6e721be2-fbeb-416f-956e-40650a584c0c", "value": "T150D4F1B835D3B630D8F78A3968DE253D514DDEC15179ABC84182FE0C867B2A5B29F0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654162, "uuid": "0e0c7c96-6581-4cd8-8503-056ae396b3da", "value": "12288:gQsCgC7jS39OqOS7FlJQHkjJ8SSK0BGNnQ5K8CuM6JjD4h:gdCNE97OS7LOHk9pRznQC6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654162, "uuid": "c519d96a-d69d-4b97-9440-732ae09cb13c", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654162, "uuid": "9c2e2b45-cc6b-4693-a18b-a161c3315f14", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654162, "uuid": "d283780e-e782-4fa8-ace4-2038f5825180", "value": "BankReport.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e80fc05-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659943, "uuid": "10a12857-5286-4084-a563-5bf4cbe96c4d", "comment": "Malware payload (Stop)", "value": "1722ac41d4716258e295807cda56d9bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659943, "uuid": "b22957cd-ab4d-4a42-9b2c-eb4c1a6346c0", "comment": "Malware payload (Stop)", "value": "b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659943, "uuid": "ca9e19ff-c8cc-4a06-ba3f-35ee6c1b4d40", "comment": "Malware payload (Stop)", "value": "aac532018ca8c9f9d6f34de4e82f9f45d00ca8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659943, "uuid": "d0899bba-6c39-49ec-88bc-2de44d6383ba", "comment": "Malware payload (Stop)", "value": "bb21201281b801883f25638c86c05f610d58da914c0e7f5ab5671b8640bafb758c95ae64e45d2c9cdef3a3cf9469bcf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659943, "uuid": "a517ddd2-d7ec-4c21-8080-5bf4a09e9915", "value": "T140050121B6C1C835F7B712F445B9927D642CB9716F6850CB62C636FE6A342E89C3036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659943, "uuid": "1bff6dee-65c6-49f8-8a23-f9c2aafb4a4d", "value": "7bb5fa0b8cc629bb852d76174c2fb878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659943, "uuid": "ba8f0252-28ec-48d0-a29e-953ab0ecb227", "value": "24576:8iIXTR4IDHqbannC1+RTJJvJnDm0JwO3NP/B:kBDIannCQR9Jhn1J7nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659943, "uuid": "e879c542-bb2b-4758-a723-d11558338f57", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659943, "uuid": "08bb5fa3-c679-437a-98c1-af19350976ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659943, "uuid": "d0ac7d61-b1ed-46c3-a33d-30ee2ce9571b", "value": "b3ad13f776f60df12ef17cf20772f823a78941ba1d7ccd7e32d290ac7b3f9e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253e5ec7-0cb2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630671981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671981, "uuid": "6a8cd8be-61c6-42b5-b660-8b1612f0b1af", "comment": "Malware payload (RaccoonStealer)", "value": "8d171fddcab2701212a4c00f906b6bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671981, "uuid": "80c02a49-8f18-4b1a-8ba1-43bd7900306c", "comment": "Malware payload (RaccoonStealer)", "value": "b53d4fee341a7c2fd940d1cf91905582df822ca78c30fdda686f1df792dd6608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671981, "uuid": "58b1e7e6-d11c-4282-bd64-0ec0464fd6ae", "comment": "Malware payload (RaccoonStealer)", "value": "7014945151503e39b2cfee1c65cd459a10e69830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671981, "uuid": "6a162419-ddbd-464a-8c81-886977517344", "comment": "Malware payload (RaccoonStealer)", "value": "a3eb02b6e88df8f8ddd3f564ad25509b4fa18d45823fc60f3e56f868a15643e33c7b1fd53b4ebb83413c7ae5668d9e4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671981, "uuid": "bfbe5dd2-1c4c-4204-8a27-9f894245a610", "value": "T16BB40170B958D876C49BC2B00572CE801A3FFE2159684743FAE46A1B1F71FA07626B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671981, "uuid": "cdef3dd3-6cd5-4478-9a01-aa3d4c11f23d", "value": "ada85a27d4871af00cb9537ea487168a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671981, "uuid": "abab3284-1ce2-449b-b3c0-81c20029ec08", "value": "12288:UJp/mvpx2plZWmE7Hxm9sMzSG4PsVHKaQ7THlS:SapxklQ6pP4PUkJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671981, "uuid": "fced4225-4b51-4753-b427-91fc960b03a5", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671981, "uuid": "24ac8684-8b86-46aa-81f7-464aaf04fd56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671981, "uuid": "2fd8b7dc-8966-46cd-a1ac-97fc3e8462bc", "value": "8d171fddcab2701212a4c00f906b6bc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ca1ff0-0cc9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630682214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682214, "uuid": "018caa08-3311-4c65-9781-51ea499a4bad", "comment": "Malware payload", "value": "fdb50d89154e18f68af589fde8d70aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682214, "uuid": "4bba7b2d-d2d7-47c1-a442-f77e08a06b19", "comment": "Malware payload", "value": "b59110439d0c5bd66db6df8d56d55034e2cad7cdee54a3f99b19ade35f4797a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682214, "uuid": "894635cb-e09a-4619-86be-05d82b9ae420", "comment": "Malware payload", "value": "4b09bc75079afde519c76445145561b9fa569655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682214, "uuid": "4f02ed5c-e17a-4737-867f-e543604fc587", "comment": "Malware payload", "value": "bd7349f5349ed51a6d821694c4130ff9ac1cc5707aebfd1da2eb367741d43be130299ce091a3becad49ff8125a7edd05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682214, "uuid": "b3773355-75f2-422d-8c80-6a73c52bb389", "value": "T1CEA4E15C77507A9EC5BBC833CD982C34B734A8774B07D217A55721AC9A0EB9BCE210E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682214, "uuid": "4e99ef08-88bd-4d2b-9486-8d3ee5049e20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682214, "uuid": "67931db9-f9b6-485e-8772-5dd30766464e", "value": "12288:1OTvky3jLqbhjHcB+CcRtE7Ph5e43Nc9sG9xvwRgy+voKsc4+o5j:nhjHg9gtELe43qXny+vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630682214, "uuid": "1acf27da-42d7-4a74-aa51-3a3df3f862c2", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630682214, "uuid": "3e370eed-ac18-483c-b35f-9c0940ed2b28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682214, "uuid": "82aacb3b-cd3b-4626-996a-ec23c6bdafdb", "value": "Pending DHL Shipment Notification REF 9-2-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd86b67-0c77-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630646762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646762, "uuid": "458cbbd3-7dab-44ce-b135-f906b4ab565a", "comment": "Malware payload", "value": "581be4cd1b7309166041a0791360240e", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646762, "uuid": "c2b8fb0b-6387-4722-92f1-2a486060a8f7", "comment": "Malware payload", "value": "b64d866e1ec33c4be6c27c5e84b6f8fa31006d5e84cb64a50d62fb89aa7425f8", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646762, "uuid": "c2431b77-85a8-4243-bc8b-8f9a8b0b78ba", "comment": "Malware payload", "value": "387a3e0d66ec5385c2ceda53f0db9e320c4a898a", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646762, "uuid": "cca4ea3c-0c09-481f-b699-0d5a21792021", "comment": "Malware payload", "value": "cf5f2586626ab245b69c857b9f5402360c6885eb4a0b7650db33a7c0fe7d7b54e3864050b391d9c8aff056e340e444ae", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646762, "uuid": "987aa24b-1f62-43f3-bdd6-1366b686d4ff", "value": "T10B24E00B2680A25137FEC1B6ECFF08D60288CF4556D6E6490259EA37DBAC10557FBF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646762, "uuid": "c9502174-6932-4b8c-986e-3b556ba40202", "value": "3072:gzSofq4mzvwVv+oKPva0m34+X16wOgk70gNSNrG15NEdV6YewtPEMh3HnpMMZl6F:gzYxA+oX16SSbCoYewHZB44g4a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646762, "uuid": "ee83571b-d10e-4eb5-a5e6-a8666cfa27a8", "value": 210015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646762, "uuid": "fcb8d560-1992-476e-8e8e-bd86fc5bf92f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646762, "uuid": "459f58b1-e0b1-4021-8e80-b5dd5be191cf", "value": "x86_beacon_https", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f669bb-0cb0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630671178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671178, "uuid": "ead133e1-ba86-499c-8c2d-de45e898f48f", "comment": "Malware payload (AgentTesla)", "value": "253bbbd9b608230a2394632eeac1ac87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671178, "uuid": "124da8ed-0f1c-4bf1-af6c-289866ee43ad", "comment": "Malware payload (AgentTesla)", "value": "b6c583b40c702cc26027e1a7bf9aa7df8859c93cc27b6f9f6263b8c5b429f50f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671178, "uuid": "48c14227-0899-4a47-b5ee-fc105a8b29c2", "comment": "Malware payload (AgentTesla)", "value": "8bc26bd9dd91f0bc5ea5d0bd5c8d14b53e80e299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671178, "uuid": "52a357f1-55d6-46f1-8c28-cff7d16c3272", "comment": "Malware payload (AgentTesla)", "value": "7fc12da94dac1911b9018f7491cae3c4ace94858ded9fa048cf84636313e2974277089ed55aa2ea04fbdd6b82384a36a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671178, "uuid": "eba6e8ee-51c7-48ba-a954-df7f9b31324a", "value": "T121B423881317BC4BE0307AA4DD8749B6D56F9A41C30EE9338D2ECE48615339F59926FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671178, "uuid": "2ecc596f-fb2a-41c1-8926-78b7489fd09e", "value": "12288:g/z2uU14e/+ppMauv6I+hW0uij6xd+aRzTr0V0t6KIb:I2EemEauSI+oNimHdRzTeVKIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671178, "uuid": "3e2dc118-6a1b-42a1-9a30-205b888ef6c2", "value": 536276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671178, "uuid": "49c432b6-bf3f-401c-9f92-d86ee57305ee", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671178, "uuid": "60af10bf-0630-4f03-b3e6-1604cda70b07", "value": "Dresser China Open Invoice Report.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3dfaf4-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630655750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655750, "uuid": "08a54a1f-4c52-4f06-9f6b-1887a8bc6801", "comment": "Malware payload (Formbook)", "value": "7053ea4000ade30ca6a3d6ba1228c581", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655750, "uuid": "3e1636e4-af0b-4e40-83d0-7a708a7e69b4", "comment": "Malware payload (Formbook)", "value": "b6f6868af49729ca38d24bae34efc0fb3025b7947b5cbda60251d96755e01725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655750, "uuid": "78bfff3d-78a4-4ee8-a3ca-70fc5790b95a", "comment": "Malware payload (Formbook)", "value": "444a0ac2ecfa8c9ffab31d35143cb7ab463e114d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655750, "uuid": "78225c7c-b56c-48d7-8f92-a478456cbb7a", "comment": "Malware payload (Formbook)", "value": "d76caaea9e910c4675aefc3054238211b94ca420850023429a8f68286f1f5c1cc6d4d8841251dac885cf42f7900fc19e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655750, "uuid": "b9c461c8-d26c-4fd4-a906-4ba5f0e31424", "value": "T142D4093E19FE23279176C7D5CBE08823F6C498AF3233A96567D747264316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655750, "uuid": "c768d833-99cb-47f9-b0e0-d34931354006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655750, "uuid": "8acbf9a3-641a-4c95-a3b2-93002c96809f", "value": "6144:IFJLgGyFnciNoE3vAlyLSDHJyNhskAcl9zkZuFnZDs5laAAE/0kS:rci/AyL4Izsi4QFWLtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655750, "uuid": "f99946d3-6334-4867-9e50-13a8fa7c4fc2", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655750, "uuid": "329d5dd7-2c2f-466c-937f-9710b2391b95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655750, "uuid": "bf4bc045-1ef0-4bec-ba45-28e2a32bd24a", "value": "0039234_00533MXS2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e96fd43-0ca2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FluBot)", "timestamp": 1630665312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665312, "uuid": "bfd9c337-3cca-45e7-b021-69bdf72db140", "comment": "Malware payload (FluBot)", "value": "a7c8ad14f45770ee7890ebcf327a85f3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665312, "uuid": "6e9ac6a8-e5d8-4439-8a20-337293973e1a", "comment": "Malware payload (FluBot)", "value": "b711fce602d19f10c34650842f610eeefb848e0d12e69d040db45bec67652bf6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665312, "uuid": "0874c6b0-1084-43f7-bd96-97d9d45bf8fd", "comment": "Malware payload (FluBot)", "value": "5891fe3d91d2e9c7ad4141b54776ca86d0650218", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630665312, "uuid": "5f211291-ed61-4ec8-beea-2aa39b19a262", "comment": "Malware payload (FluBot)", "value": "f1ff40377e9ce4612b8ea782ae7856c4c808528e63e8f96116cef570c04e289dbd9dacc48d1eafdf861987195a143f4d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665312, "uuid": "f691dd78-6d76-42aa-a505-29234fdb3425", "value": "T17DE51209FEADE626D107E138A139ECD6DC0844494F09FA5F2AA5918C4EFAC44974BFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665312, "uuid": "ecbae624-fe2c-40ed-92fc-aa1dc173765e", "value": "49152:axHruWjsJTBVAnZ7Yc0UavlSLz+Cq1z6SYsQ97MqKE2WhOhzOeNw1AIRyFc1KEOJ:axXyQZU5Sex68QLKVyh1ZcQ/O0A78GL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630665312, "uuid": "2877c296-9967-42f8-b337-4847b730c8db", "value": 3273664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630665312, "uuid": "1702e016-9364-4478-a54f-6b40cb978623", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630665312, "uuid": "e44f11aa-5073-40d0-a54e-9d9bbedcf05e", "value": "b711fce602d19f10c34650842f610eeefb848e0d12e69d040db45bec67652bf6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c54090-0cf7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630701729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630701729, "uuid": "a2b040da-8e2f-4856-b8eb-df9dcc673139", "comment": "Malware payload", "value": "e3b3a95ef03de0de77cca7a54ea22c94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630701729, "uuid": "65de0c52-589a-4233-a9e0-d76363224a3c", "comment": "Malware payload", "value": "baa381f572d293636b6e48cacd2cd6a6f4f9e5f71c583873260f6ac01f0f5e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630701729, "uuid": "4b77fca0-bbe3-4147-a6e8-3f2d2a57b7fc", "comment": "Malware payload", "value": "d318d234f8f27f25de660d9881113df9d11c24ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630701729, "uuid": "117e2e90-3e85-4725-82b7-43be3fad2a59", "comment": "Malware payload", "value": "1e5237b81d3235fd1bd4388d3c115843631686e1615daacb12df1f2979bb10712f42e1752dfba2246b2dae6b1b8f5a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630701729, "uuid": "77e5294d-fa0e-434c-b8ae-00a799724197", "value": "T188B53304D9A20E5FC232DDF06E216D12CDEDD420032663AD7F5C1B2764471BEA5AFBA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630701729, "uuid": "2238aa63-6fbf-48b5-a4d9-fe0e486c1ecb", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630701729, "uuid": "d3bae791-3e72-4f3f-bef2-02ca3177c29b", "value": "49152:9gFjE2KdbN1Mr7egOThhHP8Hw6RWemieudKc62LFJXck2lMvXImAt:yFjEndbmg9BWW0hKc62LFJX/2s4mAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630701729, "uuid": "9434e23a-efba-4b60-8317-dd1cc24ba8a1", "value": 2300968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630701729, "uuid": "64a1497b-ca9b-4ab9-a27c-7513f05ea0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630701729, "uuid": "c86aeac4-f273-4c90-a868-a2a4254b0a19", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c6a576-0cbf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630677884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677884, "uuid": "2a7ec0ce-8682-4abe-8877-514daadc157b", "comment": "Malware payload (RedLineStealer)", "value": "37122f5ff981754fb694b86871aad316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677884, "uuid": "9dfbfe47-add0-42cc-94b8-be186b9bd35d", "comment": "Malware payload (RedLineStealer)", "value": "bbaf7ca0c6485b5fb9bbe829c040c3787cff702d8481e38aa9e5791e197c3a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677884, "uuid": "0b6ed93b-9216-48ef-ab4f-232850760560", "comment": "Malware payload (RedLineStealer)", "value": "5676b195fd5df1d81d6bc187fec41010041d8f72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630677884, "uuid": "ee13aa64-c61b-4fce-ac32-497ceee26c19", "comment": "Malware payload (RedLineStealer)", "value": "7952d78d345f72fb84962988035f8504268b9bb431cfc9cd1310706b8c2f6b2c717451148fee497b27783ce1466e326f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677884, "uuid": "058604f7-e02d-40d4-9361-f66bc2283da3", "value": "T14613D846378B0721C858E5F585FB093003E5AFC63773EA593E8936494B923A3AD52B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677884, "uuid": "9cc7f42d-b083-46e3-9354-45588e77f9da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677884, "uuid": "02d27961-c29e-4467-af03-4fa78b95665a", "value": "768:PfRHrFucrwOIO7zkHMdlpa1RnmkSapjpgXHA/2GnT:RLzrZHwk61J7Sap8HA3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630677884, "uuid": "ba781504-5722-4841-b12f-aca7f578fcf5", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630677884, "uuid": "b953c8d5-b09d-4d24-bf96-42dd565d7c9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630677884, "uuid": "06668e35-1b7c-4988-920a-6ee729acee19", "value": "NewVape v4.05 [Crack].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05bae4f-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MyDoom)", "timestamp": 1630674871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674871, "uuid": "5385fb31-9b42-438f-80c5-0ff1929b87b5", "comment": "Malware payload (MyDoom)", "value": "db049297bdbbde0fd1a61a4c34f1ff52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674871, "uuid": "06891b3b-7aa2-4520-b7d3-879cbaf2a4b3", "comment": "Malware payload (MyDoom)", "value": "bc6062cbb58a6c337d1b14602bdcd90dc9cbf678ca8c6e0a90f5422bff601a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674871, "uuid": "901bd406-b8de-4e71-a775-d5e4db0a51ee", "comment": "Malware payload (MyDoom)", "value": "8385e52aed288f9da8b4e91d63192f5dc6376d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674871, "uuid": "405662b3-0321-4830-8d69-3bb5ad2968b3", "comment": "Malware payload (MyDoom)", "value": "86a97c8aedf5fc8d9d85c809b6b1de5d912b89b3b23110ed1ae1af755b98d08d26327c669a95ecce543f2e5435e89843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674871, "uuid": "f5c59ca9-5fc8-41d4-9c16-822360ca15ab", "value": "T12833F1073BBED842C180623E5973BD9430B72C3C65E946AF6931B77DB9B2DA80568034", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674871, "uuid": "05609765-6671-463b-b6ae-18fd9c2becef", "value": "5d02f6de12eb07fb22fe87e05e50d6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674871, "uuid": "b356c23e-47f0-41a8-904a-d923881e9738", "value": "1536:SNqaLV8a6z9ahALMsI0xcm6hHAzf7bf/+:SNqMsgWJ5u5h+bfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674871, "uuid": "dd2fa58f-4135-4f96-9376-b9a72cb41e38", "value": 51376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674871, "uuid": "104ed033-644c-4e71-b187-7c0486d709c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674871, "uuid": "623d4b39-514d-425f-a69a-58a2eec7beab", "value": "ATTACHMENT.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce17a35-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654491, "uuid": "b6acf52b-184c-448c-802e-1cec2af728cf", "comment": "Malware payload (FIN7)", "value": "ad4a6a0ddeacdf0fc74c3b45b57a1316", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654491, "uuid": "82f81442-343e-4e34-a887-ed62368d057a", "comment": "Malware payload (FIN7)", "value": "bddcb2e75e414b3a489d53f8cda1a21b043af7e7758998b17659c1938594d2ca", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654491, "uuid": "cf2d6a0c-77c2-49ce-a422-bc10412ec3ed", "comment": "Malware payload (FIN7)", "value": "282c431963a312d65a73ba2147c7980eb493f1ca", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654491, "uuid": "c2ee84d3-e5a4-4564-9a52-0ce315785501", "comment": "Malware payload (FIN7)", "value": "078508fc918fd61585e54d20ec6ac37e901e7aa8c3ba16109f5bcf74e8b5388413eaca824be6a521bab3de3c1833642d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654491, "uuid": "370f161e-f835-496a-b91e-1589a40bbfb6", "value": "T192C51207F7810337C2A21231954EA6D5F3258C3C62358A61359EF53D3A72978B6BB7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654491, "uuid": "73152c68-d47d-4978-b8c8-f474c3dcea82", "value": "49152:ZpHH1j3mpdgRf+us8azmLBVU3p2XR3451TpKPOv05Acvd2HW:ZNxmsRf+u8A+4mtKe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654491, "uuid": "4ab7f90f-2fdc-4750-81b2-89ff49edda38", "value": 2508800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654491, "uuid": "40ec22cf-825e-4d6a-af67-3d0e2e7e1ba2", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654491, "uuid": "0658d507-fa6f-4ae6-99a5-fc3c91fed55e", "value": "Clients-State-072021-4 (2).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9e4603-0c6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630641177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641177, "uuid": "4969ca61-d43c-4363-890b-6e226ae104e9", "comment": "Malware payload (Mirai)", "value": "8c580daeb9d568be5f6573b270b034b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641177, "uuid": "b49765c6-b001-491a-930d-d92a161142fe", "comment": "Malware payload (Mirai)", "value": "be0b492176bb0df90ab8d8e457fa8467b68a52e8bb4112eebe6ca58c6a34f6ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641177, "uuid": "06ac90fe-0c8f-44b8-8cde-9c851b81fb88", "comment": "Malware payload (Mirai)", "value": "e9eaf83659439776c4265f4f44ca3c6354e4cdc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641177, "uuid": "a10ad6b5-b84e-4205-9d76-1ba6c3274b80", "comment": "Malware payload (Mirai)", "value": "2691a109e6b80617d6e69e3c9c19b27c3765269d7509d6f3e5a2b350b2ed63fefee8c92c6367c2c6e5bce15b0d4e313c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641177, "uuid": "6f621483-2e97-40b1-8b96-aa872de15d67", "value": "T165438C938C912E18C4A5D9F1B0708B7EEBA3E40991975FE72857872AE493DDDB4043F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641177, "uuid": "10526b78-de5e-4984-baef-99f293315377", "value": "1536:kCJCFQbOb5bObEbOb5buqhjSZaGLMlKq5e4vnaCChmm6A:NbbO9bO4bO9buqQaqqjnaCs6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630641177, "uuid": "3f37d13c-ae5d-4e3c-ac60-5a1782b6d5b2", "value": 58932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630641177, "uuid": "d5c4301e-9887-42ba-a4dd-57522fe13499", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641177, "uuid": "996cb1ec-d570-4e67-b76e-b10a55bbe226", "value": "8c580daeb9d568be5f6573b270b034b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0821fdbd-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Tinba)", "timestamp": 1630660335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660335, "uuid": "98e5c8c4-f8c4-48a7-88cc-ff0c4a9ad66a", "comment": "Malware payload (Tinba)", "value": "78a6c1cd4988abfbefb689ce6d00f0bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660335, "uuid": "107880c6-fcd0-440b-9575-19fb9391adf8", "comment": "Malware payload (Tinba)", "value": "be2db75e1284c24016ccba39196d71e883b2e13ad6091ac2b56ed62dc199ef11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660335, "uuid": "899c2ebd-e045-450d-b1ea-6167f27cfa0b", "comment": "Malware payload (Tinba)", "value": "194c67f9acb73b3a470ff3f7b99781be36b275b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660335, "uuid": "4f52e5c7-d882-4ccb-93ae-26a2c269e0f8", "comment": "Malware payload (Tinba)", "value": "2c9d1ca0c191b083bb260cc30b20105aa6ca53ee5afa8142c12281d595b2d78065281db331806190186e38167b32ff3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tinba", "colour": "#7ED3D1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660335, "uuid": "9cbadb93-2eb4-4728-937c-90cede0a05f6", "value": "T19484F827A589A2B6F4F34CB2174FA2B2A1719B301714D643B60C5F6AA7703D1E5283DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660335, "uuid": "2ea89273-f98f-474b-8d85-bc12548ff321", "value": "d0faf1f829379ff4f83833223a663610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660335, "uuid": "fc049880-b6b3-49b5-a3d6-c8978a9a858e", "value": "6144:FCE6/mUXJ531nIUliViSZbLhaZfvMlLXICgc:n6TOUMBQf0ljWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660335, "uuid": "ed1e02c4-0040-4e09-9929-b01ec02b6bb1", "value": 379858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660335, "uuid": "66981a53-79f8-4900-93f8-8fbbf2cda7cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660335, "uuid": "624866d3-8385-46e1-8b6b-ddf46862409a", "value": "be2db75e1284c24016ccba39196d71e883b2e13ad6091ac2b56ed62dc199ef11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfd8eba-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654409, "uuid": "27001ea9-0fbf-4ec0-aea9-f7499e41f755", "comment": "Malware payload (FIN7)", "value": "41c48b16a01f0322b4e851aa4e1c4e0e", "object_relation": "md5", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654409, "uuid": "da3548ef-557f-4608-bf49-2a2d88a8eb16", "comment": "Malware payload (FIN7)", "value": "be88e29f703a60a139b2eb5593b5ae22b7afea2469308197505c6c862d5d16c9", "object_relation": "sha256", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654409, "uuid": "905929f7-11ca-45e7-9ce3-da95654902dd", "comment": "Malware payload (FIN7)", "value": "7c8801aa9d43631d25ed5250778d1b4112c4f608", "object_relation": "sha1", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654409, "uuid": "66c50b97-04cb-492f-9913-5c6700e38d62", "comment": "Malware payload (FIN7)", "value": "9dd16a261b4be8fc17e9e9dcf86b61e58d9f6f2af271b511ccf61f5f8fb18abf4c1e88a29cdd7322674881ef9ab4e168", "object_relation": "sha3-384", "Tag": [ { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654409, "uuid": "47a9fa4e-869d-48f2-9283-992d5b334c88", "value": "T129E3E707E381033606A19265A50E66E6F71AC13CA376CA70A89DD43D3316C7DB67E7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654409, "uuid": "1c7da9c1-fb0d-4a36-b94b-fc4342611aec", "value": "3072:INxoHXpQFECEtxB50GLWvXlT+bQc+PtxFy0D16vZLZ:I8wECEN5ZWpoTinYvZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654409, "uuid": "85eaaa59-82e2-4e67-8176-2556d749f463", "value": 146233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654409, "uuid": "265548c8-3f38-4767-96be-9d9b02740fa9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654409, "uuid": "2581253a-8d68-4634-9414-30510307cf78", "value": "word_data (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c0f983-0cd3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630686457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686457, "uuid": "e85fcf71-1555-44e4-8231-c62a79c82182", "comment": "Malware payload (Mirai)", "value": "eb381a1a71da968d20645bb87c64c0d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686457, "uuid": "b01d1554-bc0a-40e5-852b-ec5b7bf1bc28", "comment": "Malware payload (Mirai)", "value": "bf5ce5639b0ea9d0096a52d6cdf3379d5b249da431503ba77504b1e2fb5373d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686457, "uuid": "fd311f25-1e66-4ff6-93b6-bdaebf5f712f", "comment": "Malware payload (Mirai)", "value": "3e59546190a1dfbf4a76f476d8e0fe919d5fa12d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630686457, "uuid": "cde77143-18d5-44cb-ba44-4bc086f95c08", "comment": "Malware payload (Mirai)", "value": "f8e1661d560ed1433ed55c55f8d9dc14e28f243dc9d1136eaa83abe1b0f93bd8e852f37b5180c08933a7695da750d38d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686457, "uuid": "ec9b1a29-e14e-41d3-8dd3-c4c63b975c4c", "value": "T1A243199178D19A16C6E423BBFA6E40CD332563E8D1DF32179D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686457, "uuid": "dbdd92bf-101a-47f3-8c75-dd064a8d48ce", "value": "1536:EaDIpuRZhJRAAMA+xVZtWaWhK3+y6MdD:EaIe6ZtWhhQ1dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630686457, "uuid": "f6fa4951-8fee-4f86-9332-4d3b2a68ce6b", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630686457, "uuid": "f169d79e-f40e-45c9-b7a3-c4c10d13bbed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630686457, "uuid": "173bf90d-8c22-42ad-b739-305ba2521367", "value": "eb381a1a71da968d20645bb87c64c0d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5302890-0c73-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630645217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645217, "uuid": "36b35c7b-bfb6-4bb8-8fb8-e824ac0f0548", "comment": "Malware payload", "value": "206509e0cf8524990022455a4d0472cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645217, "uuid": "0a2b378d-a839-44f6-ada8-c5c80f0a0328", "comment": "Malware payload", "value": "bfd697f79d5ba0cc18ad0984894fde1d65d33714475dd9c9606738689013e51f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645217, "uuid": "995e15c3-71ed-446c-b127-9876a3611a2b", "comment": "Malware payload", "value": "d9ae78cff106d88cbc78b91579a640ab9a40e5bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630645217, "uuid": "5a9aad1e-699c-4ce1-9ea7-7d2add536279", "comment": "Malware payload", "value": "5b635c04d7150bc00b0c4b9bb03056dd53b7760389a464204ae174b8c99f8deba6c41d203a107f8949abe3e146e213f3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645217, "uuid": "85a168cf-76fc-4fbe-919c-4445247a761d", "value": "T1835302B24E4772EFD41BCC34D675090CA2F29E39973A992B633C617157D2906AAF1C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645217, "uuid": "886fae7b-13b5-475f-bc03-bc3c4201444d", "value": "1536:IcLDNYJgd7cT2uN3KR99WHSFhRdQ9A1WwpE9Pf:XLDMgdYT2uY9gSrRmZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630645217, "uuid": "fcf3f9b0-9ddb-478b-be92-e8fa950cdcb4", "value": 64152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630645217, "uuid": "a6867561-6d6e-4f0c-ae84-fe33d8677c1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630645217, "uuid": "0984438f-151a-45be-862d-318d99c3c706", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48fa95e-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630654585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654585, "uuid": "fd9f753b-dd5f-41d0-a49e-074ee667f9f8", "comment": "Malware payload (ArkeiStealer)", "value": "e51699a67179fb4839bc309d467fa5ae", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654585, "uuid": "9541e04f-5649-4f10-bc0b-04d8b696a86f", "comment": "Malware payload (ArkeiStealer)", "value": "bfe420ea0760974bdb7f76c5c95f8694e70255b9cfbf5ff19c1be2cec5c76a50", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654585, "uuid": "d38d76a1-a213-4b90-aad5-3608b5538e97", "comment": "Malware payload (ArkeiStealer)", "value": "588a448e5c770938baaa328f72f7037224bf0095", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654585, "uuid": "4504a0b8-9d11-4611-ae0d-07a79858b760", "comment": "Malware payload (ArkeiStealer)", "value": "aa772ce5c82cb9d618a5a6ba3e8abc50474144bb3ec26f46941057534156a6a50059f53e5b3a8193b90f3fc30f493555", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654585, "uuid": "34e86f6c-94cb-4a9a-ac89-955479fe4b1c", "value": "T190E412316598C9F3C5F29CB096368FE4123FB8266A244056B5B5BF0F1D726E09A7231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654585, "uuid": "81624a39-fe76-4ec7-8d45-23de58bd5416", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654585, "uuid": "7e15fd3d-8d22-4822-82c8-2b84b13ab32c", "value": "12288:/wC0UQCzBN/L8Hq38a+TbvGxAoEKAebDFxtE+NRIDmr7T:YzC1NYHqM1EAoZAevFxtE6bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654585, "uuid": "f6a95939-7e66-4dbd-8552-b26698480f0c", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654585, "uuid": "0adb740a-9afa-4ad6-b695-67c297610d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654585, "uuid": "dea09a00-ec50-4fe5-ba8d-093c96eded11", "value": "e51699a67179fb4839bc309d467fa5ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e713c5b5-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630659850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659850, "uuid": "7c5d386d-fa46-4c38-8186-a3052f0a7d52", "comment": "Malware payload (njrat)", "value": "31348748d95c1b5c4b490c7b1ecc3c5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659850, "uuid": "05ef9bbb-0928-49a7-8bd5-02a4f19caa0f", "comment": "Malware payload (njrat)", "value": "c05b6dcb40df19f76a65865141c54f8f84321d18507549606f3dee56b2acb4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659850, "uuid": "66acc9d3-0342-4c01-812b-484a3c7c8d26", "comment": "Malware payload (njrat)", "value": "8defaa8e174c73d09e38fec5d062bd98e2e2a660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659850, "uuid": "6a9a7e1f-7360-4e43-84d9-14d45f36990a", "comment": "Malware payload (njrat)", "value": "4802f5fa9fe37f38fa04bca86a64e7bad8939f351de952438d816f4d7b14f7addd907411090008bac4c060c8cd735344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659850, "uuid": "dde8e5e9-fd40-4f4d-aaad-f8d64497f600", "value": "T156159E0373DD83A1C3725173BA66BB01AEBB7C2506A1F59B2FD5093DF920162921E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659850, "uuid": "3abded77-7eb4-4cb8-b7dc-84aaa0305521", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659850, "uuid": "465a1ab1-ba33-4560-b83f-9b86bdf68591", "value": "12288:f4lsXvtCcmVVXzzn4PJAahPl/QEdIMiVbHydEIJnJWUgaR77yFq9MmCS:f4lavt0LkLL9IMixoEgeaN7yFq9MmCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659850, "uuid": "b5d28f64-569e-4258-bec7-321a4c65e00b", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659850, "uuid": "a3f16624-c07d-40e3-a188-39be7c2f12c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659850, "uuid": "15e1a7ee-6365-47cc-b563-67a1fd9f4c8f", "value": "c05b6dcb40df19f76a65865141c54f8f84321d18507549606f3dee56b2acb4a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c7aeaa-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630660283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660283, "uuid": "b239acc9-8fb6-47ad-831a-f8d35b0658a0", "comment": "Malware payload", "value": "6cc3ba08b816797bb59b31e56bd35622", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660283, "uuid": "4c5bc0c2-c22a-4904-9628-a3a48952fadb", "comment": "Malware payload", "value": "c169648f64dbc4afe88e456611452572f191f33dcfbf3412d43efcc8a36bf261", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660283, "uuid": "02f8d71a-4c6a-4ed1-8eeb-0038a8595642", "comment": "Malware payload", "value": "b5e97a30e8d8a98020b72ae35780ccc7bde1d98b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660283, "uuid": "45c65123-6c51-4157-9186-328b76971f74", "comment": "Malware payload", "value": "59ea967ba38cefb2c996367cdc748b00202fafe3b7951be5b7443459e5c880751ea935dc4afc6b3a59ff94ee16204b76", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660283, "uuid": "5b75173d-f5f0-43c8-a39a-883e6413e730", "value": "T143F3D7E49C32E994B40971B3FDC0A88605D33CEC716ECE855A28FE7738625949AD48DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660283, "uuid": "ca0341ce-5210-4f85-b205-2db0129bc579", "value": "1536:nmyqYDi1UqP3NUUSr9GOFIYOLKpS39fkOcZQ:nmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660283, "uuid": "6f2f6914-ba7e-4486-bc46-c0cdcc966ce3", "value": 167439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660283, "uuid": "28c128f8-0ba2-4639-952f-e5e8afe878c2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660283, "uuid": "df9c4c07-c9cc-494e-82de-9e7ab27a60fd", "value": "Trabal S. De R.L. de C.V. ( Solicitar cotizaci\u00f3n ). jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c96cef1-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1630655618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655618, "uuid": "19439978-a67f-49ec-86fb-71a79d1b3953", "comment": "Malware payload (CobaltStrike)", "value": "27ffcce37974b87c94406f1669b0b0c0", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655618, "uuid": "ae37c892-5f8f-42cb-9d2d-5ba346c077c3", "comment": "Malware payload (CobaltStrike)", "value": "c1dd2c50a5ca07f1664a0950bcc93b2999bf32b5d11848f368130a43a364cf82", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655618, "uuid": "7ec1a3c8-c72d-4807-9f75-724398439e6b", "comment": "Malware payload (CobaltStrike)", "value": "35ca40f146f1d941325f12356a00e7864ae5ad6c", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655618, "uuid": "62a5cdac-a81e-49b2-9ed1-dbe603582527", "comment": "Malware payload (CobaltStrike)", "value": "f776ce997bb8e263242314b9ef5b83f2028687b430d1d4743d72892a51a3ba7e413680c7eac0d6d92e31a866ce5ea4d4", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655618, "uuid": "7b72a745-ec4a-4b12-a608-c79abd4858bb", "value": "T13224E0BD550EECFDF062ED391B82ABF64E1998074730F9948BD9880FC27B1C926C9525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655618, "uuid": "8c3690a5-abb3-42e8-b6c3-0210a0a6d415", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655618, "uuid": "d788a6bc-891b-4175-9e13-cd1e12e1a7ca", "value": "3072:w+GftvAuJFYuLYzAR6Sx/+5XDTF39PP7Bzr/A8Iu4pTqnfRIB3haFRx5PSr:IFb4uLI4Wd53BlzucfR230FRx5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655618, "uuid": "951a07b5-0d41-4153-a72d-b4eee90dceba", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655618, "uuid": "4afd83f0-8577-440c-b36d-1340ec84fe1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655618, "uuid": "d3ebbc1a-6bab-419e-b2df-c02e67975acc", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a915f4c-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630650085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650085, "uuid": "bf107b3a-099c-4e9f-b843-054458221b18", "comment": "Malware payload (Formbook)", "value": "28c9f08c441d28e1b49c8aa7b40131ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650085, "uuid": "e7447904-68de-453b-bbc3-cac155599867", "comment": "Malware payload (Formbook)", "value": "c221c9dcc6e6a5c53181b072958ebe173ac1781861fb1d95ed1734def6322972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650085, "uuid": "29fe4f72-3a3f-41b8-aa86-7da787dd31bb", "comment": "Malware payload (Formbook)", "value": "5f88268dc7b92d844d3d3f147e1632d7ea38bd45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650085, "uuid": "f8c331aa-2a7b-4022-bc04-2afa3718a536", "comment": "Malware payload (Formbook)", "value": "4375abfb4b6d4c5055a875ad97d5b3597642d9c71674ed10162fc44a0f6f7c08c91aaef61e2f8e0492983181750d5d9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650085, "uuid": "81224fcb-3fdf-48f2-b0a6-af3fb1bfbc57", "value": "T129E42D3E18FE23279176C7E6CBE48823F6C498AF3133A96567D747254316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650085, "uuid": "7459b12f-20d5-4aaa-8bf3-54eb860743a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650085, "uuid": "b9419522-1695-4b20-aceb-53590061ad9e", "value": "6144:PD3PMZNcwvzPoMIxg4mS4Z9U/6dwSIZCs4ZazbDMMQ3MTRSW+ZFJLgGM:PbSNcsoMiguoq/++QszbrQ3MT/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650085, "uuid": "af840aaa-832b-4b99-aca8-b348562e1d2d", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650085, "uuid": "a854e72a-7332-4f8d-94ea-d49f9aaa5ddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650085, "uuid": "748922dc-ca66-44c0-a257-f517396a55b7", "value": "Pending DHL Shipment Notification REF 9-02-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a8f434-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630655169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655169, "uuid": "4673fdaf-126f-4b76-b330-5fbfe1dcfabc", "comment": "Malware payload (RaccoonStealer)", "value": "f3f96bb7e6b3f2574109351a35bec6ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655169, "uuid": "a50b9f2a-c05e-4c6f-b155-d6b301efe9a6", "comment": "Malware payload (RaccoonStealer)", "value": "c23f7427ef397ef00212583329e993347165a21aa8b06e4162844f89b0dc3b23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655169, "uuid": "036e723a-8299-4814-a57f-5470da97712c", "comment": "Malware payload (RaccoonStealer)", "value": "541e876f6b406abd4e6b045d063a7cfea9e48cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655169, "uuid": "19c4cf92-cd71-4705-ad3f-9a1697d37471", "comment": "Malware payload (RaccoonStealer)", "value": "d78b34844319a1b81b2935f311925bf4e540dcdcb6a952aa6998b2afe0c50f0aacade81f3144e47819aca18991315d0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655169, "uuid": "60895acd-4d95-4502-8c91-720801155e03", "value": "T196773337736AA039C0791F3503A25512DEB7E6689D976F1A29B0C09DCF390D30D3AA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655169, "uuid": "cc19bf2b-a88b-4e71-b080-c361f0d6c7b2", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655169, "uuid": "2b935beb-3330-4113-b285-e07d5b064621", "value": "786432:IN3V9hSTeLihOkpSTkNJIp2YSXQbrhZe7NKUiw0elKZn6Je/i:IFV9hSTOiXpSuIpLzrGxKE1Jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655169, "uuid": "58b1e9b0-8671-4a54-969e-df75ccd6ef1a", "value": 35246092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655169, "uuid": "7be07765-4dee-4376-abbc-d152c493e5a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655169, "uuid": "83fde687-b4a1-43ad-8ff5-9d0dfab2d084", "value": "C23F7427EF397EF00212583329E993347165A21AA8B06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135846b4-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mercurial)", "timestamp": 1630654341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654341, "uuid": "e8347395-e482-45d5-b690-05bc1ee5f95f", "comment": "Malware payload (Mercurial)", "value": "e9a07674a035bb2a1e4f233c41269edd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654341, "uuid": "ceb60588-798d-4413-bf5c-97195f16e3b7", "comment": "Malware payload (Mercurial)", "value": "c2603d684ad273865985ea6e7ce27c9236e173d7633a72f2378a1309d9ec77ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654341, "uuid": "3f31d14c-0838-40bb-97c6-8eccfe86101d", "comment": "Malware payload (Mercurial)", "value": "503908c418187bfc8f48533338aed01e667bf5fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654341, "uuid": "e2688a64-3f7a-4596-9b18-3bf216e678c4", "comment": "Malware payload (Mercurial)", "value": "19009e239166e5c47900dd16017f3d52886c761c60a03c68758e6b8a434ff58671a746290e6f9024aa7629a13abc2a01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654341, "uuid": "21099770-d4bb-493f-9ff3-ec2d4d031850", "value": "T1F11317487BEC5608F3FF4B7A6CB291244676B4A6AC35DB4E1D88589D0873B808D50FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654341, "uuid": "98cd060a-8316-4375-8be7-7cb88e3da9bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654341, "uuid": "f138da96-c1f2-4f1b-8d1f-7a89621721be", "value": "768:fpIa5EMf4LB//4MouZgLL5TjoWKZKfgm3Ehdw:pE04L9D6LL5TcWF7Erw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654341, "uuid": "6e19ec41-e05e-48ec-a52b-bf709482d6c9", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654341, "uuid": "bdf96133-3ac8-4d36-af68-dd19c170f0ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654341, "uuid": "65f1d5a6-07c3-4cfd-b185-76f1887a968a", "value": "e9a07674a035bb2a1e4f233c41269edd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4241daf1-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630673318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673318, "uuid": "14facf80-769d-4b61-ba97-81c27913d0e7", "comment": "Malware payload (Formbook)", "value": "3657b2f21cfdc84bc53eee638ccef99c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673318, "uuid": "9dce2d46-a404-4759-9d88-938fd01602f8", "comment": "Malware payload (Formbook)", "value": "c474dc9d81e08842f527487d032551b0d86e95a0f32fa2ebc7375fdb740c7e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673318, "uuid": "bcb83d82-d311-4426-a80f-4aced4693d9b", "comment": "Malware payload (Formbook)", "value": "9b2e08c889a2d86ef3625e80855e551e7221c5e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673318, "uuid": "04d9ae8e-157b-4ebd-9e31-d2df89994889", "comment": "Malware payload (Formbook)", "value": "38b771cf9a39e2316f7ae08653e9eb2943c3d38f669831596822bd73f784a6e37dd97d347e4fa922c144e51ef3e4a9c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673318, "uuid": "230df3ec-100d-4f4a-9be5-acf2f2e090f9", "value": "T183E42C3E58FE23279176C7D5CBE58823F6C498AF3233A96567D747264306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673318, "uuid": "b9c42b08-2157-4b35-b82b-05f05155a86c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673318, "uuid": "425fe031-3928-4211-842e-d5a604276508", "value": "6144:JFJLgGZFchKjFsJZHHqHH++vNNveb7/+LObBQ+UuH/fLCPboVmcmCDQ6+3l83Osl:MoFGCHv7WvYOFQ+UYO0VmHCD9gl8fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673318, "uuid": "57da8cd5-aab8-443a-83fa-715100212d8e", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673318, "uuid": "f8b93b5e-d8c6-4e50-ad93-849bb5e06bfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673318, "uuid": "6543e0ee-e8a2-4950-a871-a1c21c15d23b", "value": "3657b2f21cfdc84bc53eee638ccef99c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128b7d01-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655628, "uuid": "2a26b394-9d76-4d44-906a-931f49e9fdb1", "comment": "Malware payload (Mirai)", "value": "2c151f49829e4e0fa94086c278a51500", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655628, "uuid": "bde4c401-74e4-4241-9488-5f69479ec80c", "comment": "Malware payload (Mirai)", "value": "c7510edcac8321b08d45658110203f44026bf424187dce6850fb12e0b6f94237", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655628, "uuid": "8e4efd04-7c9a-495f-a9e4-5d21a686c22a", "comment": "Malware payload (Mirai)", "value": "1b6bc33c2b90d88e47be4dcfff83dc11525b9a5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655628, "uuid": "09cde930-d353-41ab-b6c5-b634fba6c5ae", "comment": "Malware payload (Mirai)", "value": "a1e480e1a9394e0a9da56ec253e0f1054fc76f1599a430ffd9ad55d7b9f7adb027b41fa0a4731d988abfeaa434a24f40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655628, "uuid": "a3a68b04-e348-4fc7-9428-c20b9874aa9f", "value": "T197735C99B8029D3CF84BE5B964160E0ABD71639847830F2BA6EAFDE37C73154BE01D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655628, "uuid": "e75183b7-0819-41f9-b096-f0dbf9837533", "value": "768:PReFF0KirPNpDD6V74X1EG6UBlP3hvH928DgQIAek8uH8zk/WwBj4UUnPLYlnv0v:59rDD662UVf0QN1H8zk/X4UUnklnxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655628, "uuid": "240b80e4-a89b-4173-ac73-4bbe625b2d82", "value": 77208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655628, "uuid": "7e5e4640-cb02-45e7-b7d5-b1e879af8b37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655628, "uuid": "04e404cf-4395-4e49-b50f-764a138b9a62", "value": "2c151f49829e4e0fa94086c278a51500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b0223e-0c4b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630627856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627856, "uuid": "4037c2a4-3125-4648-8036-5382ede88968", "comment": "Malware payload (RaccoonStealer)", "value": "e103369bf7a75d93a310422d7ba76cb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627856, "uuid": "7ef08423-88de-4894-8a85-2d17d39ca107", "comment": "Malware payload (RaccoonStealer)", "value": "c757fbc1ff6501717999dfe95833d3a34f214472a881e957db62192c1ce22fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627856, "uuid": "1f497b52-8758-4dee-868d-de9e9b92b6aa", "comment": "Malware payload (RaccoonStealer)", "value": "50a59857928b84cf0040bf17e47c1b65e2250be4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630627856, "uuid": "23b42d5e-f1fd-41b5-b46c-b6387c955f97", "comment": "Malware payload (RaccoonStealer)", "value": "e4df00876fa91d068f35b256ab95d800b76158b7c0034b626aa9fbcf6c0f881fb4aa65b8ebecbe96937975e2732fb331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627856, "uuid": "dfca1856-8131-4e11-87ed-8b7ec3e91658", "value": "T1DAB4E020B7A0C035F8B752F89AB993B9693D7E725B6090CF62D11AEE16346E4DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627856, "uuid": "b5ee68d0-e172-4889-bd24-e94f40c4422f", "value": "e1eb14d2b9b63299ef24644e625b9baf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627856, "uuid": "b2a6d0d2-c1d8-4917-b16e-0263f3e7f665", "value": "12288:oy+In6PbAhhyQywMS2wRUenspyP6SrYuNW8KiFTg65Q:9b6vLwMSVnspyyOQyFTg65Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630627856, "uuid": "93d0037f-0fd1-4f63-a5c9-8eaeac4b2787", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630627856, "uuid": "7c9ec495-bf86-4ab5-80a1-59a5c0ce8f56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630627856, "uuid": "5807a911-7438-495a-ae0e-1a6570899bfd", "value": "e103369bf7a75d93a310422d7ba76cb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb0616c9-0cb9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630675265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675265, "uuid": "ec484ace-27e7-4e52-bd3b-17fa24972574", "comment": "Malware payload", "value": "4630a13c8a6c4d5c39b97c28126dff9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675265, "uuid": "83adffbd-31b0-4b93-977a-2653a5c0c31d", "comment": "Malware payload", "value": "c7e28f0a0bfd22ba30414be8ecd3a48f9a0453693570994a88c5e50d67b8f492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675265, "uuid": "e0fc3820-4af0-49a6-87d4-88be2e2913e9", "comment": "Malware payload", "value": "2455140656cf1ad10c9d5c8c889fd3fe2f1cb5bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630675265, "uuid": "598c9bf2-2987-49a2-b5ee-c834ddde417d", "comment": "Malware payload", "value": "8517d622153e6045561c32f99d2fa8b409cd143600c009de151be62e73d3df549909da3200e530ff4c69336ae96fc7c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675265, "uuid": "63f5b37f-1cac-4073-9532-e6e0ade0eaf6", "value": "T1AAE4AF57F3D7F6B4E6BE827A86B1C92C5277745602B0938E774075892D22392893CB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675265, "uuid": "b158a524-f422-4a77-a512-3dec25112eb4", "value": "946c7b5f0ac6d3a47863eb46459f9075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675265, "uuid": "da84b099-cba3-4a5d-b772-977b81ea2d00", "value": "12288:CHGqRJHO4pMetgC8bzbBSregUnVgFK/UqWgemFVb:CZRJHvkJX1VcLgeyVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630675265, "uuid": "6075ef9c-ff78-403e-b368-f261e9a25168", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630675265, "uuid": "70a0bdd8-be6e-4164-987a-a12d77783215", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630675265, "uuid": "e35b8a86-d718-47c4-9d34-fa890d9bce4c", "value": "SecuriteInfo.com.Variant.Bulz.664852.8718.27643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1656ce6b-0c90-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630657353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657353, "uuid": "7afabe19-780e-4f69-9815-7ce1a441f317", "comment": "Malware payload (Mirai)", "value": "669ba440e87e5018559bc3805ba02d0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657353, "uuid": "cf72a073-5dee-4e95-9b2a-f28385d79189", "comment": "Malware payload (Mirai)", "value": "c86bf97a70f67357e524c40f4528b5be608a1029668d5c5b9d3e6496ef47d052", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657353, "uuid": "88970621-69ae-4a1f-9309-46df86b57896", "comment": "Malware payload (Mirai)", "value": "68da81ec89155960b79b16a9e4c649ae1ed22c22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657353, "uuid": "5ce58bee-84bf-4dbd-8e2f-87edc7c67258", "comment": "Malware payload (Mirai)", "value": "edc28d3c797cd1ca5365ed6e8a020d130d0ff11700bc720b95f98707bdccd9d2e8eda90d5463110da0e6c47c4b052214", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657353, "uuid": "069793ec-1945-4a4b-a98f-210e05cb2683", "value": "T1DC731752B8829A22C6D013BBFA6E158D372567E8D2DF3213DD212F2437CA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657353, "uuid": "f48f94c4-e77a-44f3-905c-aa6dd1cd1dcf", "value": "1536:ITVCBeWxELBQ180Sf5WVGLPvvTRjX5iahW0orA6iM5fT7E351dO:UVCIW25Rnv9X5thrU6MS31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630657353, "uuid": "b85eb982-e42f-452c-b95b-88c5d432e66b", "value": 79652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630657353, "uuid": "9fb18005-d437-48c3-a448-a2d98ba80750", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657353, "uuid": "1c671e94-12e5-4f81-a310-681c3c105532", "value": "669ba440e87e5018559bc3805ba02d0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1520da60-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630650049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650049, "uuid": "2dd2ecf8-3ba7-46d8-9edf-d3d57e5392f0", "comment": "Malware payload (QuasarRAT)", "value": "df3de39ce7d9c7c7cb1fca65ef4fb6d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650049, "uuid": "45ebd1b3-c069-4bbe-81b3-71419bc62126", "comment": "Malware payload (QuasarRAT)", "value": "c8d68c59e8f4cf194e50766e00d0fa72bba828a43ce4405fc195e3d27d9e4b6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650049, "uuid": "6163537b-f2fb-4aae-8afa-80cd178b5fc3", "comment": "Malware payload (QuasarRAT)", "value": "f8dfffbf857a583f4d24cddbf741120a080cef71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650049, "uuid": "b60e015d-ef85-4c1d-803b-0d2517fa9c34", "comment": "Malware payload (QuasarRAT)", "value": "fb7d144831cb4e435b43538ac8351a20ab63d1fee2635e4171c282638f373c828868ba4cefe2aaaa4d96564728616a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650049, "uuid": "398aeb14-9b20-45b9-9cd7-e96282f183fd", "value": "T10C84AE5D1A72D2CFD82A503CA8C6E7A0C8A699D12C730BC77D2239A9D43D34BF5C54A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650049, "uuid": "10cc8690-7e69-4e86-a6a5-476e614f8fdd", "value": "76cb49957629b5fe0d40d13588a8762e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650049, "uuid": "bb067721-82de-4c32-adb2-3d0edeb96b1c", "value": "6144:EQyrJT+PAlo8Q/mrns7j54twQWgGho4B2G6/GgcJ4LYbg7ayLWs:K6jme0WowC/D/8c7ayLWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650049, "uuid": "3d623f9a-c380-4fe5-b786-dff5e06e0f30", "value": 392875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650049, "uuid": "d57ae7c2-0804-4de7-9407-b2ab73a04507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650049, "uuid": "8aa7dc4a-3b79-4a4f-ae4f-753447958ff0", "value": "9088890000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5106631b-0c65-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1630638983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638983, "uuid": "1e300bc8-5c19-4936-b9cb-400b47c6c658", "comment": "Malware payload (AsyncRAT)", "value": "ec5f4f296db46e34b3b93e029259ac48", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638983, "uuid": "c80f89af-fcb4-4753-b918-d98568103050", "comment": "Malware payload (AsyncRAT)", "value": "c92748428af1806d4ecc702bce8ad9abcac6b738e7208d3586450cb4944a87a9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638983, "uuid": "2ed68e83-cdfb-4071-852d-8f3ee6b434b1", "comment": "Malware payload (AsyncRAT)", "value": "20c065acae20ea619ede0d2c5e47b4caef93851f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638983, "uuid": "034bbff8-1349-40e0-98ce-5677c9481cc2", "comment": "Malware payload (AsyncRAT)", "value": "955646864c6ef9189b9eb2e2936f9284d257690d506c5a08029f6d9bdf501adfe2b70f279742d549fd763eeca6bb9633", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638983, "uuid": "4a68069c-477f-4fd8-a04e-2ad6f18728af", "value": "T15C94399E7E098663ED0D9072969D0F6CAB521B03B6A35B8127AB1EC4774DDB53C0DCC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638983, "uuid": "cce1e92e-4bbb-49b1-a94c-1dd593360b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638983, "uuid": "788c4d1e-e846-4ef2-bc04-27c6412dec58", "value": "12288:DLhAVu9S6dF/ruOgIyrBkWAPnqVHC5iKqFJg2rcSLDnffLhgb:Dt2rcSLDnf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630638983, "uuid": "4c389f77-f721-48a0-8add-14ab1a5d4c16", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630638983, "uuid": "2e319b92-33be-4b76-9466-7fd9ac9220ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638983, "uuid": "5c98fd12-5f3f-4460-9bab-d6899839d621", "value": "NewProject-9072551776254517715425441524255614.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1696477-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630654714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654714, "uuid": "f0549d9c-6cd0-4e94-b629-f39e15b55bc8", "comment": "Malware payload (ArkeiStealer)", "value": "2a2ec59e9b27855bb8cbf49aee6bec42", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654714, "uuid": "8b5ca315-efce-4030-bb74-56ecd06566bd", "comment": "Malware payload (ArkeiStealer)", "value": "ca3291276c2ca7e712a191660b9c19eee9395d4d5f5851a5c7fadae04cabc4d4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654714, "uuid": "192bfec9-489b-4ce2-9f00-7f6a0fe79629", "comment": "Malware payload (ArkeiStealer)", "value": "ed27309ea4f36b31ac6ffce0bf673a01caec57e5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654714, "uuid": "4686ced5-791f-4d16-b26e-dde7ef8a3270", "comment": "Malware payload (ArkeiStealer)", "value": "4797d8d197a06808c8e6d6e4d0441a07461b4a9ece8dc8af4ce03811710d45b38c8a419ff858c6d534b796ec1cf8cbeb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654714, "uuid": "d90118ad-6d89-495b-941a-06a346ddfed3", "value": "T1B7E401707650C273E7A2CA7065368ED0252EB86D1B2840B779747F5F2D326A19B2335F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654714, "uuid": "293b6f20-6790-45b3-8572-044acf59a1bc", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654714, "uuid": "f1664399-c345-4c65-8ad3-9cbeb29054ed", "value": "12288:vgStEva/q/uQ3Owv7WJsVXTZq1+YTCpfSFYRXOTse407T:4sYnO2WJ4c1+KnF0ss7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654714, "uuid": "dc1e3b4b-c312-4af6-83e6-4b2f8fad984d", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654714, "uuid": "6cf4fcd9-10f8-439a-aa9b-a8889e1c46e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654714, "uuid": "6dfe9cf4-7edc-443e-8ade-38721275d5c1", "value": "2a2ec59e9b27855bb8cbf49aee6bec42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9d1e1f-0c92-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630658281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630658281, "uuid": "44794ef9-29d9-4394-a91c-d10c59414da4", "comment": "Malware payload (RaccoonStealer)", "value": "b36a3763a6213f88c322671ac617d9ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630658281, "uuid": "1a6d753d-3c4d-474e-96ef-6e07a5175018", "comment": "Malware payload (RaccoonStealer)", "value": "ca4c6b0f3eb1ea5120e751d5a94e6152b81a3f0eb6b1de5ea77ee0b0ad253c40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630658281, "uuid": "ee9ea474-ba1d-4993-a879-d434f25d6d50", "comment": "Malware payload (RaccoonStealer)", "value": "3ca9556fbda44a3ef86952decee166e03bb63d3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630658281, "uuid": "71cda5da-6599-4dd7-9c31-4312e4c0f426", "comment": "Malware payload (RaccoonStealer)", "value": "bee8d2fd52220bda95c58ca9f737e7b269713d2d74f7670a6c4d112a968195f86975c8aca758f7f6a8704acb0ae90a42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630658281, "uuid": "35a2da22-89dc-45f2-ba26-c36565b4fd6e", "value": "T127A40174AA80C033C4D6C57D4925CFA4693FBCA159A08A53BAB83F1B1EB13C19A1775F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630658281, "uuid": "b6f77dea-8b15-48a2-ac2c-12364ad03c94", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630658281, "uuid": "c9ccf03f-e7c4-4427-a91f-00a5325bb826", "value": "6144:oVSLRetYcfzjJic8ZDbZmypiiuNAN8TufLfmvLYYkqjCpTjSGxDRSvmMGd7TuK:oVSQpzjv8hbZHKTufrm9zzEDRSc7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630658281, "uuid": "1ac9ef04-2db6-49d9-a69f-637efddfad99", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630658281, "uuid": "bdf4d414-f134-41ae-aafe-88ddebfe820f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630658281, "uuid": "fe1607b2-798c-46e3-b134-6b94a18bd2fa", "value": "b36a3763a6213f88c322671ac617d9ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60ba136-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630659741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659741, "uuid": "81366bad-1746-4ff3-a51b-6652e650d5c3", "comment": "Malware payload (Formbook)", "value": "e2e2b1bd1df8d460c9b1d11097429d16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659741, "uuid": "1959a348-96cf-47d7-9d3f-17ae395acf31", "comment": "Malware payload (Formbook)", "value": "ca9d13706dad307a2021d1fa1683e46b5b9670b92ad0ee5e474cbea0620d6299", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659741, "uuid": "b874814d-edc5-448f-8734-24a6b92f8ba1", "comment": "Malware payload (Formbook)", "value": "4958e9f636a2c75aa9f6ad46ad12a4a36513e482", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659741, "uuid": "844b902b-aa62-4f6e-8696-7b54041c2498", "comment": "Malware payload (Formbook)", "value": "ef56002ceaa88911111a10f4e84f646ac0573961f88af308e1896ce1abf135c51cfb11d155defd752d4ad9e9b84ccc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659741, "uuid": "8af7e850-8f9e-4679-92f0-c4e8bcad661c", "value": "T1EC64BE30BBA1C035F5B712F465B687BCA42A7A701B3050CBA2D52AEE16347E4DD3179B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659741, "uuid": "eae87540-72d9-4860-9797-9f2484b77ba0", "value": "a5f1519af792c7c894446b2b7f883ca8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659741, "uuid": "806b4a98-03fc-4c84-a0e0-f55b157e5750", "value": "6144:qBIRwnGF/wPiDHwUT5ssghL4lvNqRzeCIj6l6+ky+NjKyOS/2qV4:DNwPiDHN57ghLuvMUj6Y+khhKfS/R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659741, "uuid": "c72bd9d3-baa5-46f9-975b-4b8b218eb0c0", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659741, "uuid": "a83130b6-25e6-4ab2-9fc2-c48da7c6f4ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659741, "uuid": "82bf6709-323e-4793-850f-3b5bd326c500", "value": "e2e2b1bd1df8d460c9b1d11097429d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31ca2d0-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655951, "uuid": "ece44f2a-6a22-478d-8fc0-795149434385", "comment": "Malware payload (Mirai)", "value": "1c93b68b5d16a6100a82950b46a5d116", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655951, "uuid": "d056c9e1-4d03-455b-9323-83e74b814027", "comment": "Malware payload (Mirai)", "value": "cae56f574bc30d97b65d8d8d8c900ee0ac94098c0d424722893b47b886e52353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655951, "uuid": "dd2d93bd-b961-43b1-8985-b4fc79dfd90c", "comment": "Malware payload (Mirai)", "value": "b6ac29a519342641a0e1351760c6319553aec795", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655951, "uuid": "94baf925-96dc-4c77-b211-9f784f26f2b0", "comment": "Malware payload (Mirai)", "value": "9121ee43864217d0670114449f034bc45b3e57b2a9bce33912b32fa3e930bd3e6fcfb7253311516040c26febd70681e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655951, "uuid": "9d6b8b0b-7b15-44c5-a65f-f09136983700", "value": "T1B243D695B8C3892AC5D913BBBA6E11CD332477E9E1CF7223C8105B647ACA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655951, "uuid": "ffbf5598-4434-4663-988c-9031e7ca8ea8", "value": "1536:EZL733vX29g/OC06AaP6k4h3rxennJiikzHNyl1XfFknn:C3vX29OO36xCkUbxenJii+IlBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655951, "uuid": "b36737a3-2e74-4ef5-bfc7-58502830a9ec", "value": 55312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655951, "uuid": "7a47583b-3f40-4e5b-b24a-79609cee6c1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655951, "uuid": "82fc12db-a3dc-4ba1-a124-50ef4f389a61", "value": "1c93b68b5d16a6100a82950b46a5d116", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c9ea87-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cambot)", "timestamp": 1630660365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660365, "uuid": "59c92dc2-2dd9-4007-ad89-1949c9ca345c", "comment": "Malware payload (Cambot)", "value": "215175e7310531b9e424cb8ad6dc6058", "object_relation": "md5", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660365, "uuid": "c1f8e0c4-73a9-4df0-a15c-4906b7037699", "comment": "Malware payload (Cambot)", "value": "cbfb37aa80241f13219dd80e61ffe320d10609a9eae2a3796586a10e676e3c39", "object_relation": "sha256", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660365, "uuid": "444e841f-ba42-4e91-8d4a-8b634bd38c9f", "comment": "Malware payload (Cambot)", "value": "0de615a9915c77cd6241fa95e7dfa36228ca04cc", "object_relation": "sha1", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660365, "uuid": "9eb3d270-c1b3-4f05-b517-a0b25ed057ce", "comment": "Malware payload (Cambot)", "value": "49b0d05e6cc5ece93d3c5d27008b94d5c388e133b98ba9a3326f88479b11ce3444cb690c322105a01b897945d1dc490e", "object_relation": "sha3-384", "Tag": [ { "name": "Cambot", "colour": "#8B53E7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660365, "uuid": "96520b00-21de-47af-8425-95db64afb5da", "value": "T14924BF33B3D40A45E9AEDB753BB9C9F9622375187F23618A2108677D7C15E204C1AB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660365, "uuid": "85356473-aa09-47a7-b028-62689f5c2ddf", "value": "3e8ae3bc85823ef9afa9731fe8e9fda0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660365, "uuid": "60ebb1c2-4e37-4e92-a182-0e49071fa4e2", "value": "3072:vHjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1jm0+Jm:Po/BHng5HaVG4G/1z+QVMbg1jv+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660365, "uuid": "4d974d35-1fbb-4f7e-908d-75f771ec437c", "value": 224688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660365, "uuid": "cd194e77-e7f2-4d2d-aa53-b62a145bd4fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660365, "uuid": "fb7b7056-93dc-4080-8ba6-8bdbb9dbf4fe", "value": "cbfb37aa80241f13219dd80e61ffe320d10609a9eae2a3796586a10e676e3c39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597ff2d6-0c67-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1630639856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639856, "uuid": "1e183d87-a64b-4d9a-b1b0-18f8149542f7", "comment": "Malware payload (AZORult)", "value": "f0d14517fdc249bdd8f3bd53f8d9c341", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639856, "uuid": "92ee9839-f003-4757-af97-a2e00bac2746", "comment": "Malware payload (AZORult)", "value": "ccd5ab291113bf69fcbccee8ab889c9cf5a0d0240feed43b73785497ace3c467", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639856, "uuid": "2a323eac-6639-4e00-b163-8fd65cda2e9c", "comment": "Malware payload (AZORult)", "value": "b64c49054f5c98211c6c44f48acc33f14eeb9838", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639856, "uuid": "575cae0f-5fd8-4c22-8a2a-4473eafa2dea", "comment": "Malware payload (AZORult)", "value": "ac73cdf2369fdfdb478557bbe8973604b1d24e6b287dffd0d75caf290841fb7a2ef7017f0d6a5cd0be40a9cd837a9342", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639856, "uuid": "0ba46dca-af27-4009-b564-31a92fd721f7", "value": "T167165B236BAFCCCFD9DE5070EDADC279E080AD292657485E5AF18CCFB52160935C94B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639856, "uuid": "281e0610-8826-4ef4-b015-097327586b9e", "value": "ca357d1c9b605d95e9d31e67e1c53033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639856, "uuid": "983c371a-fac2-4256-99c4-9f44ffa8096d", "value": "98304:yBla/SREsGrSQNFLlbSww3QHM/WvqcYvPjZ:yTzk3lbSwDHaWScYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639856, "uuid": "2971ca99-2027-4b23-ac15-5ca5fe51b77b", "value": 4329472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639856, "uuid": "53a31a32-777e-41f0-9a8d-0a1001fc2ad8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639856, "uuid": "b621e97c-6888-42ed-9c96-9d03ed3a9025", "value": "F0D14517FDC249BDD8F3BD53F8D9C341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9c09b5-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630654058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654058, "uuid": "23177f5c-7953-4038-b123-9538f252fdad", "comment": "Malware payload (Formbook)", "value": "c837486396bc7dff80f1c7ed98abd4b6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654058, "uuid": "4f7f7e53-a3b3-41ef-88f5-e7c96bc187b1", "comment": "Malware payload (Formbook)", "value": "ccefd4773a2e34ac1f4f891b4fb947cd398476d663d52462e949c49961083822", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654058, "uuid": "fbc3d6e8-c3fe-42ff-8b8d-68694791aec6", "comment": "Malware payload (Formbook)", "value": "9c8efdf43b884feea36424ded712a5d92d2fceab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654058, "uuid": "d0f1e451-1784-404b-b45b-e5f2f0da38d2", "comment": "Malware payload (Formbook)", "value": "afea6946cac08996b2271c6cb626aeb7f1f2189df5447daf2d7dcbe8a56ff7748962c0ddb52592f1e34c76d426244541", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654058, "uuid": "bf717301-a903-482c-97bc-c1dc2d94b13f", "value": "T10CD4F1C337BABED7F99998714F3E521C60DE8C2A07415225BDFAB0243439BE923A0D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654058, "uuid": "5a032939-6977-4a4a-8a0b-a90e25d4ce04", "value": "12288:vNwxDAJ2CCZVxRRoFrfwg40Ha4lvRF+QmVSuxoMy/jCUlOm:+xfCIefwyH7LLmVSuxfyLXOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654058, "uuid": "23297be7-e666-4db4-aa38-0fb2e3dbe6ae", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654058, "uuid": "6d8e3069-eb42-4311-ab3b-a56cab5c84d7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654058, "uuid": "60d31b93-dc35-4d1e-b777-5dbd08b37174", "value": "RFQ_Hua Joo Success Industry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0776c45-0c77-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630646901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646901, "uuid": "f9fe8413-c093-4375-9aea-c27aeb3ea2f8", "comment": "Malware payload (AgentTesla)", "value": "7383f3764fbe3c58f74c8cf24ecca84a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646901, "uuid": "8298e1dc-9bfb-4ec1-a81e-132643d6b86d", "comment": "Malware payload (AgentTesla)", "value": "cd096873efb37e693eb8c79675c631dfd7688372af070dcd0ec80205a8474f19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646901, "uuid": "1f02d88f-b83d-4ae5-af9b-9a84a99babc5", "comment": "Malware payload (AgentTesla)", "value": "9d1985646fa927b76901aa14f4612df0a35abc6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630646901, "uuid": "3c35065d-bdb2-4ea7-b526-e6d2cb413939", "comment": "Malware payload (AgentTesla)", "value": "bbc54ec033a50926fc47fad9dfa1d3b7a109301ec6b889f55fc2256a099d43b1b986247a9790f76ea67750d9bb839b16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646901, "uuid": "db7c8a60-eb72-4cbb-a638-2bd525256b10", "value": "T1E815E114B780EA0EC27F4F3B48905400ABF5E566470BF7877CC126EE598B3AA465B379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646901, "uuid": "864900fc-3f92-4401-81bc-78f6dcb7f72a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646901, "uuid": "0136e914-520a-44e2-b767-5299a9abc9da", "value": "24576:fpObAchN1inZNCFE6sjLX6d+yvb4ReUV:ErfEZNCFEVnUlbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630646901, "uuid": "f39ff91c-920c-4467-9539-9d37aa97f8f5", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630646901, "uuid": "d9880583-26d1-4a1b-82c5-b1b5cfbcdd90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630646901, "uuid": "bf772a51-913e-41c3-ae9e-77fd91a0bc04", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.21656.28525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b7cbde-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630659920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659920, "uuid": "e8068bd9-781e-4528-ac34-07f9a0d36d2a", "comment": "Malware payload (QuasarRAT)", "value": "4ef1927705d28faf8456c200397d0af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659920, "uuid": "f4bab0e8-4ecf-41cc-898e-e397ed7788f0", "comment": "Malware payload (QuasarRAT)", "value": "cd5a8de963a29d07bb003a8d03fa7ba38e5004641fe8138885c967db46bef0fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659920, "uuid": "8811f024-a7f9-469a-89ea-b273dd52b662", "comment": "Malware payload (QuasarRAT)", "value": "b92ab805e7c2884abcf371179b0d8989c4f90025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659920, "uuid": "eead51a5-22eb-4106-8bb9-35d622b9307d", "comment": "Malware payload (QuasarRAT)", "value": "fac311fcb358e5961cf6d7704c6bde684103cecbd7329cc8687e32eee732d17fa48a752ac09a83d8e58fec887bc0596b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659920, "uuid": "43ad94f6-e2e6-402d-923d-100e80f76bef", "value": "T1E8055B2177E44E5AE1BE57BDE071C9359B72AC4A6722F34B09E5ECAB3C323414C417A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659920, "uuid": "756640e3-3930-41d9-86ad-aa565a8ba11f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659920, "uuid": "420737f3-085a-41e9-b4f6-b4ca7d3231e4", "value": "6144:K8fGABIgrx8kFYLTiMkbmM28mA04ykdBbDqIJluHLmRZXqavbvmGaGy3V8/GV0j1:LPx7FYPiMq2fkdZ9JamPaaDvreg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659920, "uuid": "fdf52839-22ed-4a64-8ab7-1115a7ae9d36", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659920, "uuid": "a572adda-b6f6-401f-8462-6f02fc9c0155", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659920, "uuid": "2e5a078e-0174-430a-a5f3-43dcb8c0dfcd", "value": "cd5a8de963a29d07bb003a8d03fa7ba38e5004641fe8138885c967db46bef0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01927742-0c94-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630659036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659036, "uuid": "933ca285-4d8d-419a-8075-6c342ce1f23f", "comment": "Malware payload (Formbook)", "value": "a2ca6c1cd58c0a1d9889737e102f86f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659036, "uuid": "03c72996-734e-482b-8286-7648595822b8", "comment": "Malware payload (Formbook)", "value": "cdd598ee8d2135460eff108936c0e72faf0e498b42beb4ec45723d9ce2add0b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659036, "uuid": "6d1c908a-7519-48cf-b7b6-30eb251f8195", "comment": "Malware payload (Formbook)", "value": "c62304fc21c19a9b652a01e15e76c8f121a3f3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659036, "uuid": "64f93733-ced3-4334-bb16-7e14bf745216", "comment": "Malware payload (Formbook)", "value": "2e8cd8215af9bd0aed83aab2fb2b0be350ba517b9eebd096b94c8ac67fa2641ac56eb75a5c2f97484f77c0a2aa23382b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659036, "uuid": "4bb0af19-50d3-4115-b72d-3304cefe5a08", "value": "T187742B35B791F41EE4C04838BA5ADB6154287E301AF9C403B7C17B2BAC715DEA916F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659036, "uuid": "0ec439be-d7ca-478e-b38f-5ed0e2cb13b5", "value": "aa2b72693aae6a6c6f24564ac3d32728", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659036, "uuid": "0727204b-142f-4732-8aa5-a7af35b40763", "value": "6144:gQEfD/i1lkemVTtuASZNaEz2pjoLlhGiHxrme9:emetufNhLb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659036, "uuid": "8818fa97-7a5e-45c5-80f0-4407e4f27f98", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659036, "uuid": "5e6b4ffb-ca31-4918-beca-ee0c6a89fe81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659036, "uuid": "0b122d4c-25bd-4aff-92f1-fd2c84339ed9", "value": "catalogo campione_0021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8231f350-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1630673425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673425, "uuid": "4fb1a022-8f80-4b0f-b4ac-e84da3b324ce", "comment": "Malware payload (Smoke Loader)", "value": "ac72ce2cb76c67d1d19f025bd32416ad", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673425, "uuid": "8362b285-5449-4a66-a713-ce75c52614f6", "comment": "Malware payload (Smoke Loader)", "value": "ce84b0d17f3e27fac154f644e786e85b03ed617f5114a162791f0ca3c9af8ddb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673425, "uuid": "625f9a62-96aa-446b-a486-b32e12aa499b", "comment": "Malware payload (Smoke Loader)", "value": "2b2da331d7a4b23debd4378adffe6a5c8152b21c", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673425, "uuid": "4a5b50e1-c93c-4f5d-a8c0-782c99df8e69", "comment": "Malware payload (Smoke Loader)", "value": "d80f6752dae7d5eeda5c6dab2698481de3be0c63a9b6024a1a1ce4e333b50dbc645f1d545c0015cb50d6376266a4ca26", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673425, "uuid": "0ab77796-b35c-4cfe-8206-45470a76ff55", "value": "T1A524ADE1769CD833C59BC67045258EE06A3EFE71D9686503B6343A1F0D31FA06622B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673425, "uuid": "d558d1b6-b2d8-4f36-a6af-f13a4b8b57f0", "value": "ada85a27d4871af00cb9537ea487168a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673425, "uuid": "ca4df0eb-1a23-4413-a938-c016fa80fd0b", "value": "6144:K+NztLgZXZBGHlx6vXMi8b0t7THlQz7AK:3NRkZXjAzTi8Qt7THlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673425, "uuid": "79748344-44eb-4b3a-8dde-ab992e4883b1", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673425, "uuid": "7d8660ea-2e06-4485-87c0-f78945262773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673425, "uuid": "392d3fda-95aa-4931-b5bb-f02db8f0060c", "value": "ac72ce2cb76c67d1d19f025bd32416ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01e5c67-0c81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630651222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651222, "uuid": "42bf184d-9f32-4950-9f84-8b08e2b131f8", "comment": "Malware payload (AgentTesla)", "value": "fa1e2a719a6f5cc1413d50ffccc3fa24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651222, "uuid": "40bb2594-0d5a-4fad-b4f3-de99aced5636", "comment": "Malware payload (AgentTesla)", "value": "cf080548e1b18824c38e9def91a70ef2e77114ee9f339d8154ef4f77ae22bbba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651222, "uuid": "b8224759-48a0-4f3b-8ef2-4055707524e2", "comment": "Malware payload (AgentTesla)", "value": "90d5273a882afc7d19648a0dcb488fa885a2502f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651222, "uuid": "17f61194-1126-43e5-ae20-382d7fea75de", "comment": "Malware payload (AgentTesla)", "value": "7c03960480f6f4ffacbc0c3f4e11deb7fda54f8aa83e52ca0a02078150078b26fcab05119ab4b853bac170d7aa88e7f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651222, "uuid": "ed02d37b-de1f-4864-bbb1-5ad7a52df1ab", "value": "T1CCD4234A4B8FCB26DF3A65F4C806F82CF55350BDA2072A716F06B168B5C2451DBE6C27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651222, "uuid": "0201d192-35a6-46ad-b6f9-cc600f029cc4", "value": "12288:4s/vsMUHlpGQfhkZM9B8GxaUYigyYNH4vbUFlc:4sH4lpGekMRlYJR4vKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651222, "uuid": "3520ce25-2f78-4688-838a-066a69f8cbab", "value": 655714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651222, "uuid": "4f67771f-cb0a-4440-890d-dda364c82e7a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651222, "uuid": "13454714-c137-4771-aad1-939b5db2da34", "value": "873762-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e89209a-0c5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630634764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634764, "uuid": "475cab6a-2bb1-4f22-a10f-632eccc64853", "comment": "Malware payload (RaccoonStealer)", "value": "cf16775ae7412187781d1962ff728f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634764, "uuid": "fc1e6c69-f437-42c5-b9e6-03ab58ee305a", "comment": "Malware payload (RaccoonStealer)", "value": "cf9588ac6d9e1e69dad6298a0e1fa89c4930afdb5d522493f3bc56a5dbebd1d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634764, "uuid": "56ae1e2c-32fb-4e54-bf5e-f911e9adf57f", "comment": "Malware payload (RaccoonStealer)", "value": "98a3f62e391e397a183348f6967b5b16b3d7bfb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634764, "uuid": "b44dfc7b-0455-4755-8921-ecb5a56cdc53", "comment": "Malware payload (RaccoonStealer)", "value": "b12106f5a7d78a66b43b1a577059dd82fb0bdacaee372e8b59f23165d80588514b0592efb4d76c4d57ef285ef9409796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634764, "uuid": "c9aa9bce-cb00-48e8-9fed-f0a093585a95", "value": "T15065E0113683C472E4922575D861C2F85F7ABC7189659D4F6AC93F7E3F306D2AB2830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634764, "uuid": "7a9898bb-7215-4356-ac76-de99466be059", "value": "2a645568dd051b660052e7c94260bd20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634764, "uuid": "e69bba6e-fb48-4c77-8b7b-424192b69676", "value": "12288:2RMcCsg2srAQ5RlQMCgnulYgjmrkkmrw:2isgLsQ5Rl5CdFjIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630634764, "uuid": "9ab8a1b3-2f3d-45e8-93df-448e0f54df76", "value": 1540608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630634764, "uuid": "3939266a-6da7-49df-9fea-7cb3194fab24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634764, "uuid": "699a4487-77be-408e-92de-86a3690c36f4", "value": "cf16775ae7412187781d1962ff728f3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5f809c-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1630673256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673256, "uuid": "05a1c1fb-e955-4b83-9706-fda00cf626ef", "comment": "Malware payload (DanaBot)", "value": "c6b304ae4ac2af2a77edb4f0190c2114", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673256, "uuid": "570b6bb5-340a-47c1-8210-8702c35837be", "comment": "Malware payload (DanaBot)", "value": "cfa202fae3ca304f28f99c16ddc981ee48f9fb45535cc9c06c62bca0ab0efbbc", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673256, "uuid": "e902362d-c903-42d9-9a6b-ad7328ffaa0f", "comment": "Malware payload (DanaBot)", "value": "1c0a7c8951585d3767819dbd1886955fd5384376", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673256, "uuid": "ed6ed695-8b95-4910-a37c-3b70f6e720df", "comment": "Malware payload (DanaBot)", "value": "ae360471cf331f9ab251960abdc3a114fea9c95818eaec8a33b7623070afa417b8cabaa337553478e7f857477df08163", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673256, "uuid": "a210176f-f031-477d-b8f5-bdaa0fe1fafb", "value": "T1E9352270361EC233C1DBC630883DFE99263DBEA154585183B6A8357F1A70FA1A467A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673256, "uuid": "44ba9959-f42c-4d56-989f-328905883e87", "value": "b12e7978872b30dc79fb1024bc4610fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673256, "uuid": "20574339-0b05-4c6f-9e9c-d1d8ee65ef50", "value": "24576:8GkCWQUW+nVflCyd08kSQuPypj9n3pXpXcb22ieuJPAnlYj01EsiJS:8GkT7nVflCyunGydX6XLuEIZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673256, "uuid": "d5d6c08b-f59e-4ff9-a998-df39d2c35571", "value": 1160192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673256, "uuid": "7501105c-32b9-40bd-b12f-a84738e06224", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673256, "uuid": "2c76b1ca-433f-41f7-89d9-9248bd30f105", "value": "c6b304ae4ac2af2a77edb4f0190c2114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab7f86a-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630660340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660340, "uuid": "af780996-43a8-49e9-9de3-db3ca7683b2f", "comment": "Malware payload", "value": "5227f6d9afb5e6196e53a0deb6be7639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660340, "uuid": "373d372c-1667-4c14-a4df-0c89d37c4fb4", "comment": "Malware payload", "value": "d066d4763c0540f3359da0f72b5ccced162ddcbc32550568db5319ceadaff58f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660340, "uuid": "53feb180-900e-43a9-91fa-8af15aca2424", "comment": "Malware payload", "value": "e15af6b26ba6d6236e04f40c4f0a24d1f577c99b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660340, "uuid": "afa21f94-a92c-4b90-b4e2-eedd74a35f6e", "comment": "Malware payload", "value": "b6d566428535dd403b8e80b1e114cd1f0c356f39fde4f51ed7e8ee62d59e5116c1c8e0dd091ca7bce4566b8a918a133c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660340, "uuid": "309428c8-526e-4957-9719-55a080047ad2", "value": "T134745B09B7E904B8E5B7923C8D778901D7B2B8560731D6EF1390465E2F73BD0993AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660340, "uuid": "7b0134f6-9a76-4611-86b0-ce9979809534", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660340, "uuid": "a7e3f543-fbce-4d16-96cb-a44cb78a96c9", "value": "6144:3bONgoemM8Bl1e2EmJZGYHLpPNhohowrcchBl:2gSM8FlEuJholrl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660340, "uuid": "8b121fe6-575a-4fb8-8e36-5bb8bf705218", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660340, "uuid": "d74faa78-9476-4277-98a8-3f38cc2195f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660340, "uuid": "8cfd8db4-7ba4-4256-9ef3-a1038f54d3f3", "value": "d066d4763c0540f3359da0f72b5ccced162ddcbc32550568db5319ceadaff58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da9d296-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630653956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653956, "uuid": "45ce578c-67ce-4b9f-af47-5792618be71e", "comment": "Malware payload (AgentTesla)", "value": "0e0541600621c3c0a4fd734339339dd7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653956, "uuid": "d30302a5-0e2b-47e1-be53-3ad23ed5c338", "comment": "Malware payload (AgentTesla)", "value": "d09fdd7a4719ff4630659e5755ae4c69000e1b93075a32d9c92982e5c6b54d45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653956, "uuid": "b771feae-1248-4817-9e0d-a00c517de32e", "comment": "Malware payload (AgentTesla)", "value": "ba02d819232470a792b632964a0edd0d5d60474b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653956, "uuid": "c6099a2d-100d-490f-b861-8c1bddb2cae1", "comment": "Malware payload (AgentTesla)", "value": "147b32f1aab19640b0b650fce543b1dcfc24ca806d3913a2d4a623353733c7cdcfa1f692d7f3ea992697b50e80198a20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653956, "uuid": "98c7a70a-d4ce-478d-94b3-0fc6020fa808", "value": "T101B2F8ACC45B42A9CF86ABB45B1B9F51008CB56EF794E573363C973417E2DBA811283C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653956, "uuid": "aa9fa950-70ff-410a-b90b-0185ce80c440", "value": "384:ToDflLhgBg8QFWErpaf2CxSUHNNy3+Mx2Fl7+7OeAYFwu5Z:+flSBpQtBCgUmtMuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653956, "uuid": "71616211-387e-4563-b003-26c761eb7cec", "value": 25035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653956, "uuid": "e9d3fd60-1668-42dd-8670-2605c341623e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653956, "uuid": "9c489f80-ec28-41cc-974a-b83035e74a66", "value": "Import Custom Duty invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593d5583-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630660042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660042, "uuid": "806c6929-1120-4acf-82d9-579e138f7947", "comment": "Malware payload (Stop)", "value": "ff4e48605aa44baf9e7dd6ade9043cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660042, "uuid": "51cfcd40-79ba-4349-bbf3-2ba5ae2ac3e4", "comment": "Malware payload (Stop)", "value": "d0c4d2a2e6de48c794cb11638fb267a80371833bdb009d31f80440382a2167b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660042, "uuid": "0f471c18-92b2-433f-937b-79ac18eee765", "comment": "Malware payload (Stop)", "value": "e120623ee4bd05df3e478737a742b4cd4a794c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660042, "uuid": "8d9401c8-c4f7-4d5c-b739-a4eff9ae7caf", "comment": "Malware payload (Stop)", "value": "5ccbf09f695464dddee53c34e6a9b13905ca4f70bdc913800da7477071c0e3c12e1fea24078d081a6cfd015bd23e6afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660042, "uuid": "fae3468b-2bb1-425b-be18-2b937fd8610f", "value": "T146E41221B0B9CDB3C6D668F494DC91716B6F7B2767E462872B84034E3D622A0872D377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660042, "uuid": "39c855d5-6927-4908-8e32-20b9249490e5", "value": "6af2f376c26d45636195772a4c22fdda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660042, "uuid": "7dc44577-536f-42f5-9fcc-25cd5c94e41f", "value": "12288:eg4rSVzZAIILcX8pGoo1HH/aJ7Avy8DIx+qKLlvSrbHPRHncczx8AV9UzsVuOTnC:egqiZAIILcwhgn/0A7m+T+rRHNxxusxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660042, "uuid": "1104c49c-7134-4e48-8968-e1e50b94b4fc", "value": 702084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660042, "uuid": "acdc9505-7772-4a4f-8017-94e677dd78cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660042, "uuid": "1c0a2dfb-76e8-4733-ba05-c87c0f6af7eb", "value": "d0c4d2a2e6de48c794cb11638fb267a80371833bdb009d31f80440382a2167b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140bff82-0c81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630650906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650906, "uuid": "89541f84-88f1-4a13-a2fe-e1a6eeb2d7ae", "comment": "Malware payload (Formbook)", "value": "dfe32fc6670aafa3581943c26447bc23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650906, "uuid": "d4b3bf25-a0f4-4c47-83f0-1028bdaa208b", "comment": "Malware payload (Formbook)", "value": "d0c59964531548d9e1ad2711863288280bcb09b936cae8a87e666fff82ee198b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650906, "uuid": "646829f3-00d6-42fa-b850-6dbb96e8d24d", "comment": "Malware payload (Formbook)", "value": "aae69be481faa8d290e37121c0e40e54d0bf12d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650906, "uuid": "78e53e49-2255-4262-86c2-b47e00d3d889", "comment": "Malware payload (Formbook)", "value": "9fe1cdb38494845278217026d153a3dc6c8115e22266c4df363aaaacf53a3135ba805adcbe00888f7a3a8f8002e9aa31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650906, "uuid": "61b57d2a-2fab-4dbf-b54a-b604d6f231a6", "value": "T158E42B3E18FE23279176C7D5CBE48827F6C098AF3233A96467D747264316A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650906, "uuid": "d00813fb-4020-46df-87c3-808497818769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650906, "uuid": "3ba1d53d-d021-4991-9bfd-72973a751709", "value": "12288:NEk4k/7HqJnEFmtAko8RI1dZ8o6KPwxE+kC:NDD+GL1nTPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650906, "uuid": "a75b92aa-d085-4ee1-9c18-15c8b12e53ee", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650906, "uuid": "59427a84-0e95-4ac7-8816-aea6c93842c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650906, "uuid": "6c8ba54c-73f0-488d-a863-06adaca3d6a0", "value": "RE,Re Re purchasing order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822ec22f-0c8d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630656245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656245, "uuid": "b619d51e-8317-4d1c-baf9-4139ea85c4d6", "comment": "Malware payload (Mirai)", "value": "e5c7c8479a868db805e2a6a5112967e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656245, "uuid": "39368ddd-f76d-4660-9742-aab9f41e437d", "comment": "Malware payload (Mirai)", "value": "d10413ad09c32878b3de1b8c76f87366f5e88ef2f4a4046902cbed04c0d507b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656245, "uuid": "322fc9c2-56d5-46af-8b93-8fb46229b097", "comment": "Malware payload (Mirai)", "value": "2c7dbca976b6df92f83443a339e8f281cd23d5fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630656245, "uuid": "04ae8423-e52b-4c75-8f54-fcc50a83278a", "comment": "Malware payload (Mirai)", "value": "a9a21e1c14b63e4ddedec967e15cca44b10e12ecdaf7affa9973ecde4cb4eebad1fee8803222eb306ac11c4f198600c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656245, "uuid": "b06209ea-54ff-4100-825b-05206a56e558", "value": "T12F33F102870CBCF4C55834B6ADA0498E33571B78D0BFA51E8756D658EF91D0A2EB878E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656245, "uuid": "23e5aaf8-aa8b-4f31-a81d-84f895545ccc", "value": "1536:I13lpxpO24K9ZNspO5InLdPbM8ba1z0aMLQ:E3ldO24K9Z6MSnLhbqzKLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630656245, "uuid": "b534c890-922e-41b2-b4dd-95647fbaf5a8", "value": 51820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630656245, "uuid": "b13c74bd-62f6-4723-9ee5-abe80ee642c7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630656245, "uuid": "7117d3f7-931e-4868-8f97-c2edbd97f150", "value": "e5c7c8479a868db805e2a6a5112967e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c0d034-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1630660326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660326, "uuid": "15626f8b-113c-4d44-a4cc-eb5eb61a55d1", "comment": "Malware payload (Loki)", "value": "af41d0f2f9311ac158a8af8f6a5a53e2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660326, "uuid": "cd9f704e-1460-4468-a2fe-07b27c960187", "comment": "Malware payload (Loki)", "value": "d19df25c7acfd0fbd5ab489bd7c96c256854610ce13b81de4a1a6e4c972ef96e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660326, "uuid": "8e74d50f-3096-4850-8e29-d87ebb6fd870", "comment": "Malware payload (Loki)", "value": "1b94a540772dae2a4025a8e79c1a7d62b9302571", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660326, "uuid": "e4300185-0bfa-40ac-8f7e-b60c0d789db5", "comment": "Malware payload (Loki)", "value": "56f11145a404c773b1e9e0d9ad18458c4043400a60c3ed8c18c47e6991241672c94325578c9ad7a803093cd1a4725481", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660326, "uuid": "719bf42e-ae9c-44e0-a27a-d1fc7af19c07", "value": "T1EEC423FB3438EDAC3D462078407BE5C668A74DE2EDD44AF953B9410DE9A5ACCC0852F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660326, "uuid": "3c1625b6-6e5d-4176-aa98-ea3a1d1aa911", "value": "12288:mK0RudGEtQxfkaaWXRoTrqtCGRH8q7Ui9Omp5EmSh+24Cfi:p0gdGEGxfaWXR9UicqQi9OI5EmShFfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660326, "uuid": "c1dc1c28-1d56-4b04-bd2d-e010ab96319d", "value": 559714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660326, "uuid": "61098ad1-c4a2-4ded-bfdd-d816c7ab2843", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660326, "uuid": "9f3ea307-d20c-4bbe-94b1-585a515956b9", "value": "Swift copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4858f2ce-0cc5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630680200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680200, "uuid": "5b35add1-a198-4984-bba8-c57633396fdb", "comment": "Malware payload", "value": "712934879040d73ae92bbb716592577b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680200, "uuid": "6e58a99d-3562-4e11-81d2-a7f8c2ace11f", "comment": "Malware payload", "value": "d23fd414c5791db1cbd89644b3f0e88e1589d998181e08f9df1a6a9d388cb8d9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680200, "uuid": "55d258b6-8017-441f-94e1-7c1697f73770", "comment": "Malware payload", "value": "be4336e49225ae3769b31c196e2e0b7602a7c74a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630680200, "uuid": "060438c8-3e76-4898-a392-b624c8d82008", "comment": "Malware payload", "value": "444e8f93bb6e186030f04272fa1452eb32a5ef923a8f2c4f1295a6dcbf02c288e60ef1040f474985cd0528ec07d421bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680200, "uuid": "47e06568-f338-4186-9bf9-ac0a3c545fd8", "value": "T1E5C51242F3A4E827D533C13256355276612A8D44DE07FB97290AB36C6DFFE98CE84AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680200, "uuid": "104d7cbf-0cc5-4dd8-9824-bb1d7641e19a", "value": "49152:NmTY2UCrp8dJ0jGebYtkkoBjrUoKx0G0OpLv4tmef0:NSrrp8dJ06eYtNoBjrbKCS8tJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630680200, "uuid": "c2174736-bb10-456c-858f-489b09d24d16", "value": 2678154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630680200, "uuid": "65cbba17-8851-483a-bf89-c2f948d65374", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630680200, "uuid": "7cecfa25-cb0c-4ecb-8a91-59da50ca42ba", "value": "install.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135ff1c2-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659925, "uuid": "7a780666-ba89-43a1-8e3a-c5f774ea1cd3", "comment": "Malware payload (Stop)", "value": "936031c6342b86af5b3f10bf009daf7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659925, "uuid": "56b8262a-0322-4957-a005-3d1d1bce02e0", "comment": "Malware payload (Stop)", "value": "d36c662c5b89a27132d06871d9d7d1f397769a4642a6ae6fab860c4bcce0ee41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659925, "uuid": "78612fd4-0056-40e8-8f32-a4bc2494d19c", "comment": "Malware payload (Stop)", "value": "a9edc8db89a4eefb4af6b0c8b700ae51a72212a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659925, "uuid": "b92354c6-75cc-46ab-9723-dc3aae4649b3", "comment": "Malware payload (Stop)", "value": "ff4f9af0603b6404a94b4da9ba5f441d981fa285cf645a41f057592a283c6031a2852fb3cc5106e76e45d49f47e6dca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659925, "uuid": "f360350e-d26a-406d-b126-28a8754eeffb", "value": "T195050120B690C035E4F311F459BA93B8B9387EB1A73450CB62C63AEE5A342F5AD31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659925, "uuid": "7b0741ee-425b-4ff5-8338-bc5cdc3e02e7", "value": "8bccdad7743fdd57e0a7b3bec87ab2cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659925, "uuid": "2610d26b-2a1d-4cbe-85e5-f270629e64b3", "value": "12288:LQFhXQw116BxcXakrM9beas5Hm7fGcAdFpkLwIeBPlzXoYs9oBNCLPk:kFhvhXvGssfGcsv3b3lNCLPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659925, "uuid": "2c65fb6a-f588-4f11-bbed-5a8b0394f67f", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659925, "uuid": "1f64ec31-67c9-47dc-9c01-89eff523a696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659925, "uuid": "a44a1a7a-50ed-4580-8196-bb5507c55859", "value": "d36c662c5b89a27132d06871d9d7d1f397769a4642a6ae6fab860c4bcce0ee41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b76481-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630650042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650042, "uuid": "65675434-cf21-4c7a-b3ed-f798f9a3fdc4", "comment": "Malware payload (QuasarRAT)", "value": "a7f8c6294f20979796ad0f3171dbee25", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650042, "uuid": "dc127edc-9ccd-4088-a040-11f789e5966f", "comment": "Malware payload (QuasarRAT)", "value": "d3f85046f847f466e6685aa45d13aca62b163e5bcdf3a8a81beee0b819761af8", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650042, "uuid": "29fdde64-a4fe-4de0-90d0-b4ca714f7e51", "comment": "Malware payload (QuasarRAT)", "value": "62c024646929d469f2b6794d480daa519c49e719", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650042, "uuid": "595aba21-ff57-47fe-a14d-4930b20bce6a", "comment": "Malware payload (QuasarRAT)", "value": "da4a6242eb1b3618fb74b3f01799656cfd826797da0b9306904b45611303426918c84257f85ec0bf9efc6cb6cc37d91c", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650042, "uuid": "36fc6f33-9b00-434d-91de-71a0783b8709", "value": "T19E34231E6E2337878A689C533B893A4510DC81CC15622452F77779EB8D1EBFA68F3709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650042, "uuid": "80819e25-6e26-40d2-8596-d8b251e2b5ed", "value": "6144:VzJRbhDW/YmSW3Lx31hfD81C6GscJ4Labg7ECAcjqWY:VzDkY2313bD4C6J/Gc7ECAcuWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650042, "uuid": "605dc878-9398-4edc-b9ae-429ed3fdc411", "value": 249855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650042, "uuid": "83b28808-dd97-47d6-9af1-6cf15497c010", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650042, "uuid": "1308804a-f6db-4fdf-b843-8ed56e78e935", "value": "9088890000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70b1bae-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630650401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650401, "uuid": "5a105116-7a94-4858-b19a-b6ef39a4969c", "comment": "Malware payload (AgentTesla)", "value": "2c834f26179a8fae3c6a59be089fd470", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650401, "uuid": "7c77148f-4586-4143-b47d-82f2dd9e8f52", "comment": "Malware payload (AgentTesla)", "value": "d4d1c2d99806803ca94e2287f7d0bef61b77d673a2aca04130e7afd82a737aec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650401, "uuid": "0960e90b-ecd5-42b6-babe-eee87ff363bb", "comment": "Malware payload (AgentTesla)", "value": "909bfafa30c76ff9fbb476787b3bbec3867d8108", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650401, "uuid": "fad8ca49-dd9c-4aab-85c6-6191466e2a91", "comment": "Malware payload (AgentTesla)", "value": "5cdd652200313b421d8ee241222a4e555fad2dcb2918a6cf5f3b2d558e281a194ebb623c4bdcff0eb8aaaf2a59c47bb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650401, "uuid": "22e3ef16-569f-4522-b030-208fe9ff1bc0", "value": "T16B9423B519D82BA02765BD039D23253784B6BFD3A765E1B3B2F01891E2BD5180E4CBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650401, "uuid": "dc6491c0-0557-405c-ba70-5c4f5cbf6731", "value": "12288:JfaHlTsmEi6OnyPHb0FqwGAgifjEWRLFPh0aGF:JyJEi6OnyP60R6RLF50a8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650401, "uuid": "987dabb0-9fc7-4d34-a5ca-d8bcf1a90e3d", "value": 440296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650401, "uuid": "744fa0e3-f600-410d-a43d-1f059a089dae", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650401, "uuid": "baa6c928-a745-4598-921f-daf6fa8f0ad6", "value": "DL-PR-0721-2021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf9366e-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630673443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673443, "uuid": "9390327f-a3c2-41a2-9770-4ea84d616071", "comment": "Malware payload (Formbook)", "value": "396e48ab8ea9e0d607ff13b16cf5477d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673443, "uuid": "cd1fca43-c894-4aee-a7e5-83cf0cbe0194", "comment": "Malware payload (Formbook)", "value": "d53fe06c8384e535b2dcf3c96a7fd724ecf48ee3f3b9060750ff309ddea39758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673443, "uuid": "bd4b6653-1cda-467f-b41a-2d536cfae2ce", "comment": "Malware payload (Formbook)", "value": "300b25190439b5a8f865350bc5c72cd2d1b790df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673443, "uuid": "2a511313-8c3f-469a-9732-afcd5f1483a0", "comment": "Malware payload (Formbook)", "value": "fb2a5851ec2e269391817e247e510d15d632979b316326e29e2b46ba4492f2d5835c176a636134b198d2f775050d0a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673443, "uuid": "f4e5e03f-5f0a-4d71-827f-42e593468bcd", "value": "T19574E00627D60778D5BC9B706778A0A403F8F22B9632F7AE2D8452EACF51F099641773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673443, "uuid": "2a22f72e-264d-4e9a-8e98-eca829a91aa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673443, "uuid": "391f6022-19e2-403e-b68a-1345ae466f42", "value": "6144:U6mw8sOboroe9xWpo3VVERiDgCAEAJynendhjQf+NA:WwSkP9Upo34VTQne/UmNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673443, "uuid": "8f8ab6ef-d868-47ed-818c-6613e9237820", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673443, "uuid": "46f6c5d3-e34f-4a4d-aa10-579f03c01b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673443, "uuid": "fe016950-7c6a-46a1-a1e3-9b138a4aaf66", "value": "396e48ab8ea9e0d607ff13b16cf5477d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b266f2-0cca-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630682422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682422, "uuid": "7171bd24-c2b1-4429-b5ce-b382f1271a17", "comment": "Malware payload", "value": "250e548c641a259913efe572efa37914", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682422, "uuid": "1e6396d1-7ef1-4375-a7b3-152a0b9c353c", "comment": "Malware payload", "value": "d59cc2a48ae66096aadcf1ea1b7ae46fb0f56fe19ac5d82320a7ff68bc982d49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682422, "uuid": "15cf8672-73a0-46eb-abcd-4bb83b20790a", "comment": "Malware payload", "value": "71c590d95f61bbc686d7bf40acd3cd53ffc11ab7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630682422, "uuid": "c409a162-0c5f-4279-a845-06752a2ababf", "comment": "Malware payload", "value": "24e93b1d9c89528eb6e0d297caafc4e09b1fdfee767cdb035b53b4821c7d1a1b9a31de35e64661fc4e4256e3b8028b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682422, "uuid": "605aea88-2086-41fa-b4b3-4bdf7ff0672a", "value": "T186C4F232B5D280B3C647243144FCFB3EAA75EA494B2957C797C8EF6E2C226D19933215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682422, "uuid": "2707a18a-7e23-4f75-b61d-2d02822e3d45", "value": "3d612c553445d229cba686dbcaab8a7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682422, "uuid": "a4341a62-a7a0-442b-a979-5e2ca1e9aa88", "value": "12288:QWxI5X0kR9LqnuATDxM2PDeejWr8ivlNvhA01rWzHpN3plMCb:ZI0kRR+uaDLdjWgISHp/6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630682422, "uuid": "aa552243-806f-43b5-b886-4bf3535e4bae", "value": 577800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630682422, "uuid": "b7017f39-f1b9-45b0-9b77-ef9a0e51dd59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630682422, "uuid": "06482ab3-7136-4183-a708-2843ac5c1de0", "value": "250e548c641a259913efe572efa37914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889eff19-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630650243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650243, "uuid": "b76ce568-5f42-4a85-a4db-e53f993f7360", "comment": "Malware payload (AgentTesla)", "value": "5a09fa0d649c4229cf42f8cb2ea70dd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650243, "uuid": "adf9f01b-b80f-4dc5-ba13-e318210d7479", "comment": "Malware payload (AgentTesla)", "value": "d5f6325653a70427c44457dd2776d7c128d6590e921ebd2b4a9b62d46257e15e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650243, "uuid": "e17d9892-6a79-4a14-a911-571456469c8a", "comment": "Malware payload (AgentTesla)", "value": "9f7c38207a4e082c7263e453440d3d0c7cdfd3ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650243, "uuid": "4e7a3372-f3b9-45bd-b148-2eec061b53b1", "comment": "Malware payload (AgentTesla)", "value": "8a6f0137c20c2536a48a8330036b92fc26808f000abd9e76fc8a36984ba4c1008ad9c2feacc9e7c68bb6901245d95f77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650243, "uuid": "d06f0b4d-c87d-44b5-8ecc-61dc774a0d4f", "value": "T1C0E42C3E58FE23279176C7D5CBE48823F6C498AF3233A96467D747264316A4674C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650243, "uuid": "59d6891d-3d67-4734-9080-b6e4f18700ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650243, "uuid": "42703b48-a639-4fb3-9d70-24383d19c0de", "value": "12288:H/R3t3pPAU2Z0OJLq9D5aKgSeRGeEEjh4M2bP:HFt3pPAU2Z0cED5pgSIsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650243, "uuid": "f844616d-afca-4433-8216-73cc208781d2", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650243, "uuid": "285d38d0-e9ed-4dfe-838a-d544efc3fb63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650243, "uuid": "b053c8a4-f87a-409a-b7df-8a377e529ec4", "value": "New_Order_PO#24960780_MT_Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6489733-0c67-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630640092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640092, "uuid": "442c3f9b-0232-4625-96a2-015470f50c9e", "comment": "Malware payload (Formbook)", "value": "0650530c0192eead0466f36564026598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640092, "uuid": "d3dd3d67-282c-418f-ad11-2df3ebbf3441", "comment": "Malware payload (Formbook)", "value": "d62663072daa5bde186f1d0c406225099d7ae372d00969a57016206c099ee1b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640092, "uuid": "beb2eb9d-1321-4240-8a38-0b7b12ab2437", "comment": "Malware payload (Formbook)", "value": "a731bbf3310af1d83119131c0e182e4302062eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640092, "uuid": "c560039f-e54a-4ffe-8a71-4868625ebf51", "comment": "Malware payload (Formbook)", "value": "7f05479a77eb585a6daf4d6f2b8fe77abd20e09c509b23e74663f50f9d6734967d1af6406db659e6c0adc064b04a6393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640092, "uuid": "684845f2-5bf0-4dff-ad5e-2e50a4eb6cc0", "value": "T182B42328EB6C953FCFFA06794486558487B3FE1582C1EB4DAE4D10E5A9C33CA0D15BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640092, "uuid": "4d938386-51bc-47ba-a768-20df10f12c71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640092, "uuid": "e6eeb21a-9688-4f7e-90d3-2244bbf826a2", "value": "6144:oEmZZ3ps81rwzCnSiBn7oxs3gX7gHHxpfFnUTf08QBEF/zzvsH7qriOEGo6RD9GA:olZ3hdnd7oOQcn7uTfUI/3Bp1YZGnPuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630640092, "uuid": "4ded51b3-d373-409b-bbaf-da326d80f027", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630640092, "uuid": "7bb3d53a-3f4f-4ecc-b4ba-cedd82b3a0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640092, "uuid": "6df59d9b-ccc6-4a62-ac79-a68d1f7d0f2f", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b486ec-0c79-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1630647471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647471, "uuid": "a6b3c1a1-d002-4945-9116-6d1e8f022a58", "comment": "Malware payload (a310Logger)", "value": "25b2a9e2861162f3cb6131451508537a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647471, "uuid": "ceb0babb-4b43-4807-b721-5beaa795abc0", "comment": "Malware payload (a310Logger)", "value": "d785b16f811cb9c93968e0e03c88859aac76643ec2b2d2b4cec7a11ed41a6844", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647471, "uuid": "00c7bbc2-12be-4ebd-b39b-f896a8975bde", "comment": "Malware payload (a310Logger)", "value": "80f2a95ef9a3893eb6f43b610f379c01ef05d845", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630647471, "uuid": "85e762c8-757e-4390-ad6b-5c7c7a3b0d7c", "comment": "Malware payload (a310Logger)", "value": "bafcf3bb84ebd56950c432c6d41dfe025e095cee9bb5fc9af5e3260039a6388964a03270e3025d88a083d7ceb1e39b6f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647471, "uuid": "43945802-62e2-4942-815c-4b4f67da5adb", "value": "T14915813E18FE23279176C6D5CBE08923F6C498AF3233A96467D747264356A4674C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647471, "uuid": "78b144e9-7816-4876-9295-9075e63acd24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647471, "uuid": "86114d88-ec64-494c-b899-24e69f25a674", "value": "12288:hAgvTojPDEYH82cRj/WqOH5F2s2bJCried/7LGcofwDyR8b/z:6EojPlH8Pda5F+1CFGcLDyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630647471, "uuid": "e80ea9ab-94e3-4b84-b71b-df782448a384", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630647471, "uuid": "2462cae7-8b5c-40f9-ad9a-3391d64ff678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630647471, "uuid": "e703c58a-db4e-479c-9144-50829ba59cf9", "value": "doc437789042879.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8da17e0-0cb4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630673114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673114, "uuid": "a5c050bd-5ac7-4959-8c36-605464c9178a", "comment": "Malware payload (Formbook)", "value": "9ae21d74282206b97a7e5e4fca2d4b29", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673114, "uuid": "1036d7fc-d83c-481d-957e-5e18f78903e6", "comment": "Malware payload (Formbook)", "value": "d79915989950cf8d091bded976d56a717e4c94325e37d7b076c19b6d0847ac15", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673114, "uuid": "ac5c2279-cb9a-4a86-b303-d3b94711f897", "comment": "Malware payload (Formbook)", "value": "90629f6f1cba8105b4f87f8edfb1c0534a3132bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673114, "uuid": "9a046a92-f17b-443d-a31e-8644c89b88df", "comment": "Malware payload (Formbook)", "value": "2a7cb50fef91dded65e586beedeae9b5da1128a2e7ecc47a548a0bad8c38bdbeb9734a853046b1dec28aba9b19debc2f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673114, "uuid": "db3a6fbf-fac2-45bf-93c7-e6ba17182ac5", "value": "T11FD4F242A2E34F0FF9F4D279FB0A26844F7ADC358621449B2E67BC52D73C2916DCA611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673114, "uuid": "6e29fb6a-dd15-4519-a678-ee2547a2710d", "value": "12288:zY7wmYSpN8ApeZs+5dUNF3vuvTbL6wVY/JiBGkNvaZhUO++M:E7wm/8AL2aFfuvTnYRiBGkNsUO+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673114, "uuid": "fab3525b-f2b0-4fd8-81cb-d3983994d44d", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673114, "uuid": "66b0a928-e37a-4df1-9ff6-03ac70d8e23a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673114, "uuid": "780117b4-4fb4-4ad4-aad7-f18405c30b6e", "value": "PO 60078.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63ae26b-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659876, "uuid": "f2d9d714-5e34-423c-a8a9-54baad662146", "comment": "Malware payload (Stop)", "value": "9fc52180cee96c5480d441498db0d593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659876, "uuid": "3762630f-214f-41f0-8df0-80602592e91b", "comment": "Malware payload (Stop)", "value": "d7bf9c3f9a679bd9c80e455608ef51ea9e91a84031a173c12bb3946050076411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659876, "uuid": "30961ec5-00b1-4ca5-8837-4cea6f45d6fb", "comment": "Malware payload (Stop)", "value": "e4c97d88bfad4589d2c3a7f268e59c249caa7dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659876, "uuid": "0ff10fda-0308-4a71-847e-b18fb9df1953", "comment": "Malware payload (Stop)", "value": "3cbb406f91c6807f9043aa804becd7c365a71812824d4971d2dd6bd47a4a6df03851fb0b89d0df43a12944c9b5af0d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659876, "uuid": "b2b1670c-3cd1-4191-8c0b-ff42e60a721d", "value": "T17E05F1306690DC3DE4E212F465B6827CE729BEB0576050CBB2D63AEE1B306E1AD31757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659876, "uuid": "9c15cbd2-293e-4d77-9726-1de1b5b6c130", "value": "f536c766660697a0f33f0299d3f205dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659876, "uuid": "303621e5-f1a8-447f-acab-c48fd92553fa", "value": "24576:QWvzfbE89I6G3EqmrRFbZ3Ni28Eoq2D1iaEnX78:Noq3G3+dZZ3Ni2yZPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659876, "uuid": "b3e3403a-677c-444b-848b-b03dabaa89ca", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659876, "uuid": "3fb7cb6a-58b1-4544-82bf-c52f76c75fa7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659876, "uuid": "09169b44-9d7c-41c2-b0ea-c059a1cca108", "value": "d7bf9c3f9a679bd9c80e455608ef51ea9e91a84031a173c12bb3946050076411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0ef561-0ca0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630664585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664585, "uuid": "06eadf14-84d4-4cff-aca4-c662e4984886", "comment": "Malware payload (AgentTesla)", "value": "e330bcc574a31071dfb5bd9e7c7895b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664585, "uuid": "bd802248-55e2-4734-9231-9bec107c3a98", "comment": "Malware payload (AgentTesla)", "value": "d83b084a590b9b330fec3934eeb02a3db09368e706fc7bcb163e23b180643f38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664585, "uuid": "b3ba27f9-291f-4784-b10d-5a8d22b1909e", "comment": "Malware payload (AgentTesla)", "value": "87443fa63378ada830b96e2bc25b830af339c41c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630664585, "uuid": "4d2d6a15-1f09-40b2-8c9d-656c5350cfb1", "comment": "Malware payload (AgentTesla)", "value": "49e38ddceb2a43b681feb024d698b214afe326e2faf4cee4557a87a92103224befa40e4513df1d73e76c84f63b13f5e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664585, "uuid": "b0a4bd63-983f-414a-a548-3ff3f650dce2", "value": "T1FCA4CF9D3650B2EFC457C97289A81C20EA61B47B530FD313A55326ACEE4E697CF121F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664585, "uuid": "1dc7cfce-ddc5-43f7-9714-a4ccf416adde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664585, "uuid": "846c52b8-d384-4bfd-84ca-1485167e6965", "value": "12288:Xv45UPxTRXqsnC19OzOU8ZB/sD3NM14NVTLKOCJ65ssmyKbJJ:XCU9RBC197Xv/U4gT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630664585, "uuid": "5c2a953e-8fb4-4772-af08-321676ec3d3b", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630664585, "uuid": "bc8dc72c-3cdb-4b0f-b6c7-3dbbb7c943a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630664585, "uuid": "65f8001b-9bc7-42ae-90d9-edf17314dc6a", "value": "Payment Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5ec1b8-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1630660317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660317, "uuid": "ce571441-3786-402f-842a-e67fe2ae3626", "comment": "Malware payload (BitRAT)", "value": "7b050a99e5066f7496a06d47f2204c6b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660317, "uuid": "77839d49-771c-4854-9fd0-142046b6a816", "comment": "Malware payload (BitRAT)", "value": "d9d4924c771ef5fe952a8e38a23b2a3a64b15855a6d1579af815c7c49968302f", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660317, "uuid": "4a6ca76c-08fd-41e1-918a-82473f2075d4", "comment": "Malware payload (BitRAT)", "value": "ce4362d4898343e18349d06dff5aca1bcf534558", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660317, "uuid": "2c6386d0-5ca8-4399-a3ba-45ed730082a3", "comment": "Malware payload (BitRAT)", "value": "759f9e6877f9b7f0030590d024793ebeace47c4b5a5a061e8918b80c1ee69a61c1ff88d10ea3123180f961db64064888", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660317, "uuid": "7eca3210-5cf7-42d1-b07e-f0ef84a5698f", "value": "T13E841302731A9F8BE7BA06B1A51084950F366D072D9AEADFFFDD3C8554F7B8024819D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660317, "uuid": "e80a9c9c-9a3e-4660-aadb-ef8dac91cd6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660317, "uuid": "317de7a6-781a-44bd-ac65-420f79178987", "value": "6144:k5xR4H95Sj/X4OFLEHv7PJYbhjUPTSGsoSZrSJ4adkk44Err8qPdp+/1uJN:Qa5kDQ9Y9oPfNS4Fkk5qPfsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660317, "uuid": "f68da29b-04c4-473d-a8ec-3ccadef4395c", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660317, "uuid": "27fdbf84-c1b7-465d-9a30-ff4f4658ca3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660317, "uuid": "bbf2089d-1943-49af-bbec-1fc44fe73d82", "value": "d9d4924c771ef5fe952a8e38a23b2a3a64b15855a6d1579af815c7c49968302f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad403f3-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630659749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659749, "uuid": "84a349a6-aa91-43ce-9d7a-cf57962f180f", "comment": "Malware payload (Formbook)", "value": "beccced204a52824d012d6609557be13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659749, "uuid": "ba9a3c01-6d30-4a39-9100-98cefd7a873f", "comment": "Malware payload (Formbook)", "value": "da7eff90633f82c14d128a573e55c95694fa567bd983438f6e4080db739ab55d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659749, "uuid": "44b4d48a-d16c-42c7-9ab7-b5b572c5c6f1", "comment": "Malware payload (Formbook)", "value": "0a19ad4db4a27735c1f2336364592b0da49faffd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659749, "uuid": "f474d665-9edd-4ca0-a2d8-d1f8e6f30aa2", "comment": "Malware payload (Formbook)", "value": "da1f855039cd98988a3912045491e4609cbe0a38aab0816295ef86a427e5d86eee9d1572138d7d9bad18c48b7b899a8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659749, "uuid": "a4435cc8-4a2d-4d7d-b115-6e8df0347472", "value": "T18474E00627DA0374D5BC9B756778A0A403F4F22B9632F7AE2D8492E9CF51F098642773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659749, "uuid": "cad0fd51-ab67-487f-a31d-b887be654665", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659749, "uuid": "f39dc6ce-0749-45ca-b87a-73f849c74637", "value": "6144:i6mw8sOboroe9dWpo3VVERiDgCAEAJynendhjQf+Uv:swSkP9Apo34VTQne/UmUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659749, "uuid": "84b69f9b-02f0-4caf-9a97-cc125805fd3f", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659749, "uuid": "86e09a6f-8ba5-45c2-afc3-b770d8ff507c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659749, "uuid": "679edc31-505c-4e12-86ec-e0e2f14393f4", "value": "beccced204a52824d012d6609557be13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc58bd34-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NetWire)", "timestamp": 1630660235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660235, "uuid": "f41ef00f-9270-4256-ae30-25dc3a693d93", "comment": "Malware payload (NetWire)", "value": "cca05958526ca1b406317bbc8137c6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660235, "uuid": "6b6f8220-7a67-4704-92e5-4af4c3cfee92", "comment": "Malware payload (NetWire)", "value": "dbf616ad9c72def90a363c076c2e66d25831350d2e1ad60b22675e2c0ad95e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660235, "uuid": "6eba7fae-0891-4231-89ff-f1942c019aaa", "comment": "Malware payload (NetWire)", "value": "409794c9962f28780176be4a82b3fdd7d7b41427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660235, "uuid": "093d44fb-2c80-4f11-adbc-9a46dd46f939", "comment": "Malware payload (NetWire)", "value": "af3c86d722f54d0b8f6d7af5a87777ef8e77a64d91967ef57df886eebfd024c69babf81a36db474aa3f059a99dacdfb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660235, "uuid": "bb9479cd-0e20-4ec5-af7d-0b4c6d2a8bb3", "value": "T1D4E4FB7F19BDA2279175C6F58BE78827F0108B6F3110692476D347264322A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660235, "uuid": "50a8eab4-d60c-4dc7-9066-fb79a05d2c18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660235, "uuid": "72a7adb6-df02-4f72-8194-e4ca637d02f1", "value": "6144:g5q/hHhR8NrA1wLVJfhE2GAOenG6AWzT+8TWDGWrFVny1oC6hhTskwIOX4H09cDO:zhLUUChBn3AGT+8yD9Jo1N8hTLC4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660235, "uuid": "69d025e8-3b59-4372-a192-45829921343f", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660235, "uuid": "f2e22079-f7ea-45c8-a018-98553ed127f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660235, "uuid": "74f6e9b2-dcf2-47c4-a9ea-632533f67cb4", "value": "dbf616ad9c72def90a363c076c2e66d25831350d2e1ad60b22675e2c0ad95e56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d5b734-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1630660009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660009, "uuid": "40ed678c-5d52-4d5a-a9b1-cbf63386ddc2", "comment": "Malware payload (njrat)", "value": "132fab98b7a89300b82e286d26d7be90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660009, "uuid": "72b41e55-d564-4e8b-99f7-c4728f0c7546", "comment": "Malware payload (njrat)", "value": "dc64ae4a27e63685b9999c12d6998844df34cac607be3d26c50863daab952a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660009, "uuid": "f0cad85a-6fe8-44a4-992a-4aa1e20e9a31", "comment": "Malware payload (njrat)", "value": "e1174943930a8ee474de3433660f0bb25bf966ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660009, "uuid": "140456f7-f88f-467a-b960-e2bacb4d1196", "comment": "Malware payload (njrat)", "value": "9ae5d6f99aad5da7d200b5096b1314043cdd7e4d85084a875ae9a034b12e1e3e433f530714548f6b7184cce0480e1a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660009, "uuid": "ae099874-d162-4e40-b257-68e6b8d32f61", "value": "T1FAE4E74CB690E175D6FF8BF1B4A2B2890B71A01BA902D30F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660009, "uuid": "f3d7de3d-7fc7-4a0e-a40f-8dd8d53d3b34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660009, "uuid": "c0449b09-c52d-4622-b953-28fa3d37c31f", "value": "3072:enbWx3JnbWx3JnbWx3JnbWx3JnbWx3JnbWx3JnbWx3JnbWx3JnbWx3JnbWx3JnbN:emmmmmmmmmmmmmmmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660009, "uuid": "d22baee1-49d1-4d88-86b5-1b507ec85d86", "value": 704576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660009, "uuid": "ab8dfd1b-a097-4060-81b6-75042ed14015", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660009, "uuid": "fc0fff43-fa0b-485d-8a5a-18422e3496f3", "value": "dc64ae4a27e63685b9999c12d6998844df34cac607be3d26c50863daab952a66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee102976-0c65-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630639246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639246, "uuid": "e03b951d-f7b4-4f59-b48a-7f863e355bbb", "comment": "Malware payload (AgentTesla)", "value": "853b507a084a8a98035b2efd76046f0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639246, "uuid": "a021da73-1805-4110-a37b-8436fb4f6623", "comment": "Malware payload (AgentTesla)", "value": "ddb27dedce37040816b06a70f6375dd10b5fc2f5dbc412ec42b8798fe4240ffa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639246, "uuid": "c8e7cbd7-abef-46a3-9d09-b3ead1557502", "comment": "Malware payload (AgentTesla)", "value": "ca01f0cf95859a08ee3928179b2c3aaebee6e537", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630639246, "uuid": "028c431d-1a86-4106-a264-89a9e56f69fd", "comment": "Malware payload (AgentTesla)", "value": "20b4fa448b71b1f017c3fab580328a672e439ff87c276261be5398b9ebc75474618d818a2c4cf4f79bc016111f898bf1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639246, "uuid": "e43ac3a3-e363-4c47-8a06-6f38942e70d7", "value": "T106D4FA3E58FE23279176C7D5CBE18827F6C498AF3233A96467D747264316A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639246, "uuid": "2f50e20a-d21a-48f8-a502-b041f63d3f3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639246, "uuid": "859ab57a-3688-4a6e-bf55-59197c92ea52", "value": "6144:CFJLgGKF3ult3jci+hL/cvJ+xujRLiD4yUdI5/+scAFSkBCLduWY:lT9EvcARLiD4yV/+uSkud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630639246, "uuid": "91d263f8-96d6-4a88-a475-c5001e3c35fd", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630639246, "uuid": "b3e83a4c-f667-44d4-be7b-c96d15b6f55a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630639246, "uuid": "895e65b4-4803-4af5-a57e-3d4cea01ff5c", "value": "AVX_4145_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d48cd2f-0c54-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630631782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631782, "uuid": "5af2633c-d4fb-45fe-a279-ef5f2ba7276b", "comment": "Malware payload (Cerberus)", "value": "32ec21b1c9db99ce3262978f29fe88cd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631782, "uuid": "525a6edf-2475-4333-90be-ec115f8eaf80", "comment": "Malware payload (Cerberus)", "value": "de024632c0af5653655f9d0304da1273c6f7a9cbaee81add35713557e7a44293", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631782, "uuid": "80516671-b6ae-4c2b-a40a-2def7783a028", "comment": "Malware payload (Cerberus)", "value": "7be7873e33b1d189ea7d991236df545687404e5d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630631782, "uuid": "875c7ea7-af86-496a-98fa-0a6134b02e39", "comment": "Malware payload (Cerberus)", "value": "a4d11ba840f9fdccfb3ff1a1162e6943ee7634b64a3bd899503703e7e96f01c338cb316b64dcc2f9157d6dac8308af24", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631782, "uuid": "07998930-1aca-451d-b063-a04ee205cc8a", "value": "T18EF53336FB8292C9C54B03F2E25F3279FBB510686147B4AEBC34805E5DD6684CA11CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631782, "uuid": "bccdcda1-bb14-4293-aff4-d9f4ad46031e", "value": "98304:PrJ1HhbsTEd1Qs6xYZsLcrPaGC7AHuSwG9:PrLHCTEvQs6xYZc/76uZG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630631782, "uuid": "fcc7d30d-44ec-4568-8589-ec6a32c71a93", "value": 3526328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630631782, "uuid": "45e890c3-cf39-4be4-b06b-d18649961770", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630631782, "uuid": "50610b0f-e8bc-483a-be6d-1bb9faa40c24", "value": "Android G\u00fcncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf103f9-0d0b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630710271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630710271, "uuid": "36925558-5e62-4078-badb-95d11c199b34", "comment": "Malware payload", "value": "01e2803b8a3f7e4d7bfe77e6c6bcdd35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630710271, "uuid": "6b5b469a-2689-446c-8a7b-f49f085aea3d", "comment": "Malware payload", "value": "df0a2b50cba47cba62df3b128948dead529e8ccfbf59225e24bb47eadd2c4a81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630710271, "uuid": "ab70afed-d68b-4e45-b4e9-635f1fb3f759", "comment": "Malware payload", "value": "7f87d1ce78a519667b3f3654c2ed5bd291be29fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630710271, "uuid": "daaba189-0d6a-4553-80c0-7a39d89dc759", "comment": "Malware payload", "value": "c384c6d3ed54be04a4b51b05162f07d62f097a6d8aea22c43bc43f5508874506f6f8398e173eee87b6830d60445a2f2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630710271, "uuid": "cf7999fd-3577-4874-8930-2b040dfdce6f", "value": "T1262633622540C937F5E2E9346038CE45D73E66501E5881A36E383E7F39703A987ADB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630710271, "uuid": "ef64d8b0-ab1a-4528-bb03-c692e212c8b7", "value": "06fbc87344400a3722a88a2791d1fe43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630710271, "uuid": "6354557f-0a24-4fbc-93ee-47c9fbd4b7cc", "value": "98304:PccuZ976e6PtbkO6q2NuNA2Jb7j0guwCmKrKTONHCO3+KJlmcA:kcuZ97YKq2yR0gRnQCOu5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630710271, "uuid": "082d5872-022a-4ba1-bfdc-a7ac37aae78b", "value": 4623912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630710271, "uuid": "5c790464-92cc-4a24-9271-bff3d66dcca3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630710271, "uuid": "f8597ee9-4f76-4f0b-a069-a8552c57f0f2", "value": "01e2803b8a3f7e4d7bfe77e6c6bcdd35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2d995c-0c6c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630642251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642251, "uuid": "6248bb57-e196-439c-8143-a8d38e4488b0", "comment": "Malware payload (RaccoonStealer)", "value": "f1683ed759a2e3058fa3137bcde9522c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642251, "uuid": "c27f1ee6-b2e9-4557-822e-656c1d6f5d23", "comment": "Malware payload (RaccoonStealer)", "value": "df894381206db5cb83860343b60baea0012d0d5535de1339492c121a51b84886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642251, "uuid": "5a1de362-a849-4761-851a-8a339f7e7382", "comment": "Malware payload (RaccoonStealer)", "value": "7f77b5205037eb4c0468015bc2e9caee738ed487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630642251, "uuid": "b4cb2ba4-1066-49f7-8f30-983f2a6b8dca", "comment": "Malware payload (RaccoonStealer)", "value": "210a7be0dac914e9c0161c938b67a5fec8d1948e24351536c78fd8199a461106824b65cab494e436c4308fba134ff1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642251, "uuid": "61f0f3b9-674d-4361-976d-2f56a7a2fed8", "value": "T137061267312640CCE7FCC7BA8627BEB131FE167BCD816878D6A9F9D12D318D0A106646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642251, "uuid": "2cb89c06-0ddf-4acf-8904-2c0410d520a0", "value": "008f94f66b31c7c17b41ee47afe6a600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642251, "uuid": "10452fd9-2cdf-424a-969e-896f0da43f36", "value": "49152:TiQEhK+CPzXkfsfGlPVH7SZgOFFrGxKOLBy0R5BHQElNep3gvc9jSeULIhzjoV8b:8kwOGltbSZPrBOjRbHbNspB1UV8pnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630642251, "uuid": "6a23a5be-0be9-4336-94f1-d7ba321dd16e", "value": 3759104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630642251, "uuid": "5a55a594-2473-4eb0-a523-761481632fc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630642251, "uuid": "d1e5579b-f1c8-4873-aa52-ceb518e187ff", "value": "F1683ED759A2E3058FA3137BCDE9522C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98620dd-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630673598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673598, "uuid": "c7ab8044-7961-43c0-8a41-b5d713af1db0", "comment": "Malware payload (AgentTesla)", "value": "af15aefd177a5ec48f1ec3459cb43788", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673598, "uuid": "396cbc00-dfa5-4530-b13f-bc9af50b642f", "comment": "Malware payload (AgentTesla)", "value": "dfacc19c8296c239cf350a33fc336d43fb4ab7beee2cd7a3817693724347a47f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673598, "uuid": "4d22acd7-6079-44c2-bd74-76dfe9769fbc", "comment": "Malware payload (AgentTesla)", "value": "b806729d3b152fcea9365af6c323bfaf178e4073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673598, "uuid": "aa8e58dd-8560-4e78-b067-f1eaba0c5226", "comment": "Malware payload (AgentTesla)", "value": "723e54f567b9f169e0d2b4640b8e6c3cf541942864a61d8d32ab8d5974bea172c5b5e1c849961b2b7ea4e28676202f05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673598, "uuid": "eac549b3-babd-4126-a750-6cbcadc524b2", "value": "T148E42C3E18FE23279176C7D5CBE58823F6C498AF3233A96467D747264306A4675C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673598, "uuid": "dd0c8d03-1ade-454e-9127-bb9adeccb3e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673598, "uuid": "97fe9d88-88c3-40a4-8826-0ce7ef7f60db", "value": "6144:zE9FJLgGKFHDKzUEdpk3dA0dftBRvznEl/HeSRkvt2Va+7SiI8o2M6vTmAmr2hG8:zND8dpk3dVzRLUhAZCSilnbnhvQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673598, "uuid": "8e67e3b5-20b4-4886-b582-e71e22a63415", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673598, "uuid": "73b125fd-56a1-4931-82f0-76c2b9c0d477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673598, "uuid": "8491c5a2-bcc6-4e48-b233-13abdced590b", "value": "CI77470831080.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177a636d-0cb5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630673246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673246, "uuid": "c9982836-c030-441f-b97f-74cbf5072626", "comment": "Malware payload (AgentTesla)", "value": "7f9a5a012b7ad438165dd2c2cc4522e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673246, "uuid": "0bb37982-10dc-4977-b41e-d6afda900f93", "comment": "Malware payload (AgentTesla)", "value": "dfb100697371119ee4e093d73c7c71a0a07c14bdc913f906f0f3cb57b287bbb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673246, "uuid": "1d743a99-15a7-4e01-95c9-ccab21be3ccb", "comment": "Malware payload (AgentTesla)", "value": "64a187795b6aff901c923a2e762c1bd8b2a62ca4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630673246, "uuid": "d676f55b-9b8f-4747-a822-a06e271f8b2f", "comment": "Malware payload (AgentTesla)", "value": "e2778c03e4bf842c4a424d94e8d5f962dec141bd446ce3cdd070012edd7bba349b39e740831b90475d3c500d4962aebc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673246, "uuid": "9537a070-c2e1-4b01-9c29-d8adc4e0e87a", "value": "T1EAA4CF9C7250B6EFC867C972DDA42C64EA61A47B530BD203A45722ED9D0D6DBCF120F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673246, "uuid": "455abf02-113f-4999-aee0-1b034581c971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673246, "uuid": "49237f84-983a-49ed-972b-83c15530b29c", "value": "12288:pY2cgP4BBo0++ye+yvHK5QcsH31Wi3Sw9s6IX67C9jYaLMLuLl:pYrBiL/yC58X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630673246, "uuid": "84ea893f-265a-420c-8bb4-81f69ae357f5", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630673246, "uuid": "3f78f426-8f71-4fce-b42a-eba5e510fce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630673246, "uuid": "fe364275-52a0-4e8f-be37-409311e66566", "value": "7f9a5a012b7ad438165dd2c2cc4522e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ab9250-0c7c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630648810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648810, "uuid": "c0049f71-1d33-40bf-891b-e65b54028f5b", "comment": "Malware payload", "value": "994f976355d932b5501b28ba2389a1f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648810, "uuid": "13faa0bf-0273-4154-9b98-6626230d5979", "comment": "Malware payload", "value": "e1470a0c9fb6cdcc5219de1b70ac51ed5c97c56b3f02310bdc7410ae5d38212d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648810, "uuid": "b0ee8184-fc37-4a7d-b8e7-dbaab92b2d7a", "comment": "Malware payload", "value": "e547b18f08236ff71d900d40f7ad4aedc6e485ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630648810, "uuid": "8859fc8b-be81-4829-b8c9-704cf70001a0", "comment": "Malware payload", "value": "fdc32f42cfcf90aef58e395d19f4408162e879180a5e2c421f5c1c0c4f904526e606988c62c16b13ce490344abad276a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648810, "uuid": "b56fdc9f-a30c-480c-80ea-77ecfda41c2b", "value": "T1FAF2E0343266E5ECE43254F256A4474C3E700FF8D2E3FC139153A2939F9456EA893AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648810, "uuid": "1df341db-a8aa-4ed2-a7ad-9324f429f10a", "value": "768:yHkmWBWfJ1WnzqzmH81AnYgq2XLJba0W33c8JgGlzDpxYs2:yHz1OGmH81AYgY3c0VrYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630648810, "uuid": "67f35a3c-fbae-4458-a8f9-33e7e98f0ec3", "value": 37280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630648810, "uuid": "63994114-14a3-41b4-968c-1a0d39c9906a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630648810, "uuid": "0bf895e2-2646-4e06-8ad8-6ebe2b974a75", "value": "994f976355d932b5501b28ba2389a1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894e0e2e-0c64-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630638648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638648, "uuid": "dad5003b-70b5-4500-9068-270494bb2c0e", "comment": "Malware payload (RaccoonStealer)", "value": "f0726e5729f924ac73584d1f886492a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638648, "uuid": "09ad08b9-4414-46d8-833a-1fac82be2616", "comment": "Malware payload (RaccoonStealer)", "value": "e1c502cf0606d96119b00772bbaf5cd66c0f084a284c2b3b9162de9574f5ee0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638648, "uuid": "e32a5616-8901-47b1-83a2-8094ba4467fe", "comment": "Malware payload (RaccoonStealer)", "value": "cd04c8ba559c0aa6b93d466408806d7d845565f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630638648, "uuid": "297b80de-0b99-4c22-986c-b6b1de68a46d", "comment": "Malware payload (RaccoonStealer)", "value": "96c0433517a85d76779ad26532642862547e4812d887947998a81591871fca8210d4a762288296d3c173a10bdc82d2cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638648, "uuid": "e108c3ad-12a6-45fc-bc86-2b4b8fc6e3a6", "value": "T11765613DAD252633E7BE86F8D4960D4EE69450CB22335DDF46D6A3882007617B6FA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638648, "uuid": "8ad4876c-858a-4e15-8a8d-e4932323f26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638648, "uuid": "ddac4366-a78f-4afc-b0d3-d6c9fc572f8e", "value": "24576:RHnchKutbVuIarHwjvY1S6c0YEf8tML+b09Z4A:dnCKW8QjAhb+Keu4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630638648, "uuid": "ceaac422-4c9d-4f2f-bee2-14404ef2d29c", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630638648, "uuid": "723cf7ad-4cbc-49ce-aacb-f6b7e196757b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630638648, "uuid": "5b39451a-7935-4da1-bbf8-95f2f5c5f4c2", "value": "F0726E5729F924AC73584D1F886492A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f32097-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1630659984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659984, "uuid": "55e0b762-889b-4d13-b26d-076102465b71", "comment": "Malware payload (NanoCore)", "value": "4f1b290eaa131a0e1d436492929d19fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659984, "uuid": "73d86718-7151-4f84-b4f4-d8e78b101091", "comment": "Malware payload (NanoCore)", "value": "e24520318204710af7aaa92c56aac6a52df5bde8f176926542cc3dd2f24156ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659984, "uuid": "2a5eaf5c-0d39-4880-a8b4-e58740b32303", "comment": "Malware payload (NanoCore)", "value": "f5707c2985381c56514ca6d8a8bb26b9af371626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659984, "uuid": "2e98c05e-f900-4fad-92d2-d6d8c5a635dd", "comment": "Malware payload (NanoCore)", "value": "2ac1e71ee4be1ef653383dcac9f28f3218145ddd6be4842a70fa3ca7db1ad2fbfd5c80ab0b456f7e32ad9b67b38cbd26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659984, "uuid": "d0a48cf1-4875-4848-a4f8-95e630a62761", "value": "T19AF42C7F19BDA2279175C6F58BE78827F0008B6F3110696476D743264322A7AB4F336E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659984, "uuid": "3dac2f26-175f-4ed1-8f25-bf2d12083b19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659984, "uuid": "57292f9e-a91d-4429-9117-7c4b362f2840", "value": "6144:7Ku7/LhnpUkHkTtfxI5hqiuSrq/wN/0t8bzEOSf8k0oh7OEiuygk2Ora1Q6dYW:njNpUkOtfxI5PuS+9xOU4i7+uAO1pdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659984, "uuid": "90d8e05a-5451-42b1-86fa-cdf5e8bdadac", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659984, "uuid": "de785c31-294e-4ebd-9f7b-5d9b32f46962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659984, "uuid": "194b8294-4ae7-43ad-9b41-f68334c2a97d", "value": "e24520318204710af7aaa92c56aac6a52df5bde8f176926542cc3dd2f24156ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1459f036-0c81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630650907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650907, "uuid": "6897e01f-d891-491c-a985-93aab52cc1c2", "comment": "Malware payload (Formbook)", "value": "eeb21f96e0076da082f3739f649133b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650907, "uuid": "b5c27024-208f-4f78-8bc9-bca05df49660", "comment": "Malware payload (Formbook)", "value": "e255f15f5259558788630152afacc7dc83c6c3967c14ee3e41319c9c9816aed9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650907, "uuid": "b9f7c5cc-a03a-4c08-8d9c-4907ca333268", "comment": "Malware payload (Formbook)", "value": "c05b58cb71249361af3e3ca4efb468412cb0d966", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650907, "uuid": "84950573-e302-48c1-b0cb-6f73655aa2c1", "comment": "Malware payload (Formbook)", "value": "ac2b97681c9f63dcb1d02ed4448cb4fb497585ada45de2c2e147a253af8611b278445303058b47b8b2d1505a5bf7a517", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650907, "uuid": "f931940a-4fb5-4443-bee2-4896427aa78c", "value": "T1ABE4239A636F7F9A4B0C9811797B33A0BDECFF979768DCBC61A834171B045C02958827", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650907, "uuid": "64fd1211-f3f3-481e-82b3-f5f6e334fe47", "value": "12288:QEFnY/C/ENpYKu98t4wCGWAsWMIrzASN1+vAM+xZgp2Gjm7ec+:QqnQCENrW8t4xGlsWdFH+vmZkVjog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650907, "uuid": "e6d982b4-271c-4743-8c8e-4c3cee304820", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650907, "uuid": "d0507832-8be1-4e9d-a640-9f380144b783", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650907, "uuid": "da465a82-be3d-47af-af2f-20ad6621d969", "value": "PO#4500491796.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e16d161-0c8a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1630654762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654762, "uuid": "8121b287-a833-4ba5-b1a6-3051f6407a11", "comment": "Malware payload (ArkeiStealer)", "value": "62cdb224b348817ae76ff23b18ad7e73", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654762, "uuid": "6645bb8c-6e80-4318-a982-f14752184ccc", "comment": "Malware payload (ArkeiStealer)", "value": "e292a0c2b116fc037f1203ada6d8bc9c1a8b4ea9caa6fda072c36a28f6ce6332", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654762, "uuid": "b49a2d4f-4bdb-4ede-aa6d-05fd37b24eb9", "comment": "Malware payload (ArkeiStealer)", "value": "1855a31e1b0e45836b920b41ba65fca158b37963", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654762, "uuid": "21c05ebd-710e-4dab-86f9-10de3a4ad0ff", "comment": "Malware payload (ArkeiStealer)", "value": "015e01b8da2bd20bfe09186485f5533b0b761d174b9f61adf4fd14999ab3d286f24c197028c37cbd887edccb72b91679", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654762, "uuid": "4bfa9a2d-c242-4fd1-846f-d60519036373", "value": "T1A5D412313680C037D6F6C6B49B798D942A3FB9725A25C68AB6703F0B1E31255A93335F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654762, "uuid": "914660b6-2f08-4a83-b691-bce31b10a26a", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654762, "uuid": "33f93f6c-2272-4591-90cd-448ba79d8e58", "value": "12288:ywCcNwSZAAREEfLfmWff+ikXZHtebyVJva9lVtFikmRt:hkYA8bmWOHXZH0y+9d4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654762, "uuid": "08a4a8d7-4845-497a-954b-5a93a094b052", "value": 649216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654762, "uuid": "462e76ac-b634-4b21-8080-6ebb1c0a583d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654762, "uuid": "a3e154fc-dd0e-4a75-957c-a74bab8cdccd", "value": "62cdb224b348817ae76ff23b18ad7e73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a41ddb-0c9c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630662873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630662873, "uuid": "6183d0a1-9986-4167-abce-29f37f70be66", "comment": "Malware payload (AgentTesla)", "value": "6cb80f096a767f94dc1140322578ad01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630662873, "uuid": "0371fe3a-0c7d-40d8-ac03-c2b1b8f07bec", "comment": "Malware payload (AgentTesla)", "value": "e2eda84997c633e9448a5ecc23d21c3f20f8c9919530bd4468b52b029469472c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630662873, "uuid": "4cc61f88-0125-45f6-b8ac-26e67f2c40cb", "comment": "Malware payload (AgentTesla)", "value": "f9a5e5883423e01abfee20f2ad6e2b91cca2e8dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630662873, "uuid": "dfe6d00d-1b72-47b5-915a-d83bba3e2dcd", "comment": "Malware payload (AgentTesla)", "value": "750ab7a0d7368c8fd68c7948d1dfa3593dba88b4abd4b2e65e971cd1859a8cc2306e1ab0d9a7bee81459ebc37251c1ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630662873, "uuid": "3deeba74-ffd8-4048-ace7-781999a4fb5c", "value": "T119B423881317BC4BE0307AA4DD8349B6D56F9A41C20EE9338D2ECE48605339F59926FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630662873, "uuid": "1e6cee73-5fd6-4358-a57e-59aeb58b8273", "value": "12288:X/z2uU14e/+ppMauv6I+hW0uij6xd+aRzTr0V0t6KIK:L2EemEauSI+oNimHdRzTeVKIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630662873, "uuid": "ae781dc6-3ce2-49fb-b40f-807af6c20f04", "value": 536224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630662873, "uuid": "23aad3f1-3c9e-422d-a8d8-6603f63c4f51", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630662873, "uuid": "4e62387f-f8b0-4c3d-8e3c-edf53b0da7ce", "value": "inquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabf7cc0-0c86-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630653441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653441, "uuid": "8f7e04c4-6b2e-470e-89b4-79235c49d638", "comment": "Malware payload (AgentTesla)", "value": "066fb598ec86cd6be14355ffebe1bc65", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653441, "uuid": "e56753e4-6401-4c97-a76f-0d3ddb1cdd99", "comment": "Malware payload (AgentTesla)", "value": "e2f4428edbba3c7a8e3389c968a1200c76289fd271f0469c436838d1d52194c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653441, "uuid": "d3313929-d52c-4880-af9f-9dd55a4428c3", "comment": "Malware payload (AgentTesla)", "value": "fc656f3aae188d01d16dee6a4524eda49efa0144", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653441, "uuid": "65a464ac-bbd1-4675-b79a-0d433cb1ca05", "comment": "Malware payload (AgentTesla)", "value": "71bed08acbc7114177e869f7de0eacddda511158b3b5c374f16ab63caa40a60aff7b174e9b1be854122d383bde48083c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653441, "uuid": "289dc3fd-a7fb-4683-867a-4b9dbffb241a", "value": "T1A5E4FB3E58FE23279176C6D5CBE48823F5C09CAF3132A96567D767264336A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653441, "uuid": "9aa47f71-b0db-49e4-a12e-c899eab2be1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653441, "uuid": "e3c5a75a-871b-4140-b906-939d8d75d786", "value": "6144:QEFJLgGSFShefCkuvrWXFPTH0QXOSbe+yX4+2ft0xfGL4B2ewHhNe5HsfefMmtF1:QFHuvqXw+f+uK9DJwBI5H1Us1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653441, "uuid": "236222b3-61b4-40e2-99e1-5dee9135361a", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653441, "uuid": "b7ff1b0c-46b4-4020-83ba-304ab1ae88ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653441, "uuid": "50a5923b-04ca-479d-ab93-5a1c4c94e74f", "value": "PO copys.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f74316b-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630653932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653932, "uuid": "c07a8746-4b98-4398-bb0e-6a9fcfe8ae93", "comment": "Malware payload (Formbook)", "value": "c45efe7060ffc0b34333ecd99549473b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653932, "uuid": "0d6b1f39-2cb4-4682-8ac1-b2922ab56c9c", "comment": "Malware payload (Formbook)", "value": "e435e460c21ac727c03916ceb13621d6b879fcfa07d162b620cf1673e73bd7c3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653932, "uuid": "bc989fdb-8424-4c43-a969-b50d1f92f7b4", "comment": "Malware payload (Formbook)", "value": "1eebd4437bed897ee9829f0944c8bfdb02198597", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630653932, "uuid": "1af58f1c-66cf-4989-bb22-5cd97d96e38c", "comment": "Malware payload (Formbook)", "value": "7f92be2da05e4f072138b7685e7e4f3d36e5294c5c39841e60c411244f3e16bb1211e8b7b2257acc7f9ab2bc6badb048", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653932, "uuid": "2136dd44-03a6-44f2-bbeb-95ce8d785616", "value": "T10CC2D59CD9630198CF85ABB86B1B2E48008C776DF7869932727CA73827D2D3E511393D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653932, "uuid": "408f49c9-ab3c-4492-802e-7a85d4cec1ff", "value": "384:wCrX9J599obyz+WZthffgGJyAw3KQIhzVTV7SYPBbtcM:bzj59u4thwGUOQIpBSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630653932, "uuid": "fef5fa40-3287-4298-a805-f8209e2c6db6", "value": 25803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630653932, "uuid": "0cb0807c-b01f-47e9-8035-67162854b917", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630653932, "uuid": "bd917072-446b-42ab-ac2e-eff0d9993c70", "value": "P.OInvoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bd17f9-0ceb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630696510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696510, "uuid": "28c2e9dc-acaa-4bd9-b8ef-07575ab760e5", "comment": "Malware payload (RedLineStealer)", "value": "7ce7a93a0ccddeae523707bef245d4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696510, "uuid": "8c7fa04e-7689-4292-9537-bf602f121530", "comment": "Malware payload (RedLineStealer)", "value": "e463abd6719107c76861a49c45e46f7183f0038264f2e31f328bf4eb3554c8a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696510, "uuid": "00196f22-dd19-4e54-9fef-7a1421a645b1", "comment": "Malware payload (RedLineStealer)", "value": "eb37c01d39617e4a0714e32d6ac965ce80038d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630696510, "uuid": "c5bf0e88-2862-47ef-8529-547142b4a2e4", "comment": "Malware payload (RedLineStealer)", "value": "02da5456887980f72a37f13efb1fd811a2abd1a38f0227f0cf2f4e611756e73bcb01d8b982e690d3a7c32645af7ad42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696510, "uuid": "fe99a44c-2d65-4cbb-9430-a9c5b68e1ee2", "value": "T10064E0F1359ED83FC59BC5704865CEE4163EFB2169AA8007B6242A2F1D31EA146DDB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696510, "uuid": "403edf48-58d8-42a8-ae16-e23921bf0ce1", "value": "c4966332d8b4d65c8c07803cb5fb54a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696510, "uuid": "50516e60-02cb-4505-a674-86da1a6e575e", "value": "6144:D7WLxpsjAE4SZBkQX3EUocparuU9sS7THlQz7AK:D7WVKArZeEdcpTU9F7THlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630696510, "uuid": "28929c44-7ceb-4b6b-b8c6-ec45a5c7c7f5", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630696510, "uuid": "21e2b225-ad3b-448a-941d-5b771a0a0586", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630696510, "uuid": "6f7ce030-772c-4ca1-ab2c-65b35627c872", "value": "7ce7a93a0ccddeae523707bef245d4a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df15cfc9-0c8c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655971, "uuid": "9921646c-4676-4074-86b1-22e0ea27ed23", "comment": "Malware payload (Mirai)", "value": "a50e0e1e6c2eb4849842dcf49a640373", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655971, "uuid": "191c8c09-0c58-4048-a77f-c9ccf8daf602", "comment": "Malware payload (Mirai)", "value": "e56882a17b56fe8537fd1c8a2684f73463c305ba87cdd2273e7bf5d8477170bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655971, "uuid": "b08adccc-2cce-4621-8e29-904f945f9567", "comment": "Malware payload (Mirai)", "value": "daead0a63761bef4891ba21574671446be4ac4b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655971, "uuid": "aebea64a-0a7b-47dd-86d1-d10231eb0cea", "comment": "Malware payload (Mirai)", "value": "04388b005b2cf5adf5164f1f76a8f2b1f9b9762d2b4050940b4641edf75dbe10bb516276e23438c3dfec21b6594df240", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655971, "uuid": "706cfc6f-a4bb-4333-825a-7e9ebae30dc7", "value": "T171639D29E49A9DE0C0C14A34B0E5DE761F23A9C492672DF6EEC081F55847DACF605FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655971, "uuid": "89d36493-a5e7-43c1-a2d8-2fc5f1dac1b7", "value": "1536:naeQ62rJ4wtCotEQZmO8/NuDI1vt36PxLCQn:n0xrJ4uQB1VqPxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655971, "uuid": "00423cc7-76d9-4fbc-bec1-3c3614e79ff6", "value": 71236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655971, "uuid": "ba47b7f2-dc44-49f9-a022-a615906d71d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655971, "uuid": "eac7ed01-f8b8-4758-b1d5-87bd9bd3b822", "value": "a50e0e1e6c2eb4849842dcf49a640373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8898be2-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Macoute)", "timestamp": 1630660309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660309, "uuid": "338841e6-3573-4d66-9545-7d4c014dca90", "comment": "Malware payload (Macoute)", "value": "553178b6f61fd3b69c589f4c920fd338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660309, "uuid": "09f6f3c8-3f5f-4e13-909a-1b1522aa81c4", "comment": "Malware payload (Macoute)", "value": "e5cc5b7eb4330498f7b1fdf9abc817ac058c9879c5d84cfdfb0d510870b8a15f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660309, "uuid": "596c4d3a-e6d1-45e8-a4bf-bbfe81355677", "comment": "Malware payload (Macoute)", "value": "c5d5f0c9224f77428950898db7e9be3bcfa4e955", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660309, "uuid": "6aad8e8d-c29d-4ee1-97f5-f6ef0dd725d8", "comment": "Malware payload (Macoute)", "value": "e8378912717893c9cc9179ba5a9eebfee2123d7b9af9e637a4d13b0eb0168eaa67d714c5d635bcb1f07dd9cf90cd5156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Macoute", "colour": "#C87D68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660309, "uuid": "cb1d040a-4760-408c-abae-ac7d291aab9a", "value": "T18894AE82EBD340F1D8970BB15067B77F9B724B0E502CDD9AD3942E56AC33223992E794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660309, "uuid": "cdffbec3-4c79-4940-8e92-2b3f1d67c5df", "value": "23b7a2ad6dd5722f5566eaa0d8a348bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660309, "uuid": "12446e47-2323-419b-9cce-416ce84ec713", "value": "6144:CafsiuvAQ+tTm6cyERSiytj71cVE4jKS6v:/CvAQ+q6ctRt636VfjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660309, "uuid": "d5fb1062-a60c-4379-86a6-2da189e6104f", "value": 436736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660309, "uuid": "02c53e35-b5c8-4183-b1e0-13ff3c522cce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660309, "uuid": "8550f2f1-be90-4544-86e4-d5cfb367595d", "value": "e5cc5b7eb4330498f7b1fdf9abc817ac058c9879c5d84cfdfb0d510870b8a15f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d667cefe-0c8f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630657245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657245, "uuid": "8d7cf4d9-505a-4551-9879-41c1ce728af9", "comment": "Malware payload (AgentTesla)", "value": "f02a12ad0d9a60a9cae47004810125f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657245, "uuid": "10282467-92b3-4401-a99c-d78b3a9a765e", "comment": "Malware payload (AgentTesla)", "value": "e6337a7fb5d157e893b94b6c3c93b145c8f043fdf4ea2bacab8dfab7c3b30c2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657245, "uuid": "96e46c1c-cea3-48d7-bd25-cb55943d05b3", "comment": "Malware payload (AgentTesla)", "value": "c8a54c1419192dbea4886c7e832a225c902b03c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630657245, "uuid": "f77191a4-9135-4911-bb32-b068fa401926", "comment": "Malware payload (AgentTesla)", "value": "7558fc267021497f88eb3a8c96053097aabf94e28ae3c102e9e000e1bb2cb8f3469d97bcb5dd7207c97cb36adeeeea29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657245, "uuid": "14ea6623-24e4-4a2e-b225-e4063f861ebe", "value": "T133E42C3E59FE23279176C7D5CBE48923F6C498AF3233A96467D747264306A4634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657245, "uuid": "fa674615-204d-47a7-b619-e244a9367f93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657245, "uuid": "372db30e-d94a-4508-a7dc-6d5c676391b2", "value": "12288:T2oNGlbfZXgm+wAFwUi/sDEyumu+djBFz010Lm:T2ocbfr+wWwUi/6rdjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630657245, "uuid": "d8de7a6d-55f3-45d8-b6ff-dd8d8899be48", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630657245, "uuid": "5e358676-1661-4abc-917b-787c65adc05e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630657245, "uuid": "738c708f-bcdd-45f5-b021-f2a293ab360f", "value": "TT MT103_copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b501b58f-0c68-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630640439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640439, "uuid": "f5254c54-1e9f-4ca6-af4a-f455f5f29257", "comment": "Malware payload (RaccoonStealer)", "value": "a9c3992162cac921edf3ed00aae47d94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640439, "uuid": "8e88f3d2-41dc-4bbc-96c5-ee8c26523718", "comment": "Malware payload (RaccoonStealer)", "value": "e8eb04d0bf8f0b72e2528a5b7de31e1eed169325d5f40ddc9c96bce1e973a5cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640439, "uuid": "d1bbf6a0-ab75-4a12-8347-622390521a17", "comment": "Malware payload (RaccoonStealer)", "value": "88dd9e53c316abeb18ff1df9176f222412257a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630640439, "uuid": "c08050dc-92a0-4f7b-84e8-31331c820b95", "comment": "Malware payload (RaccoonStealer)", "value": "48963b72bd4ef8794587514098e7a49a1dbbc0639d4a5d165f7941872f48e7bb843cdcc0e48dfc6f5453981f68c4b429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640439, "uuid": "1ff7834e-ecf5-4967-821f-f5a05410fe22", "value": "T1EDA40230B693D033E596C5718A39CE91292FBC7A59649187FAB43F4B1E723D1922231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640439, "uuid": "4dcb046d-e9a1-4704-8a15-134e4970c26a", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640439, "uuid": "e9af8534-1672-425d-9674-04ace73e215d", "value": "6144:eV+LNf99CcsEwFkg59xFuNXr5b2ic06SNuWD5xJ2BWF1rt/cyRRTyRuvKftVvMGV:eV+pwztBeXtb2ic6Nttx0BiyCRTyg4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630640439, "uuid": "cba3586e-426d-417c-8e25-a638749daf50", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630640439, "uuid": "749eb9a6-1431-4cbf-9ceb-21ec55d8fe70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630640439, "uuid": "c9a7081c-4f1d-4a58-9a74-12d154bba1aa", "value": "a9c3992162cac921edf3ed00aae47d94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426f7335-0cf3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630699947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699947, "uuid": "c3ca8223-8518-4d9d-af9c-6aa4dc210224", "comment": "Malware payload", "value": "3386ae032f6d373ca53c4cdd9f2d8071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699947, "uuid": "732a5672-f46e-4f71-9cbd-696ba76b22d9", "comment": "Malware payload", "value": "e8fd9fa558e765a0a6273a0ba98195347c8c388491e4e6186fccf4d8a69baf84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699947, "uuid": "39821172-8b13-477e-b5cc-3badf9eb51fa", "comment": "Malware payload", "value": "ce6df9cc36b0049e01bbd72b00f92f42fdf7f990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630699947, "uuid": "8c61f767-67c0-4d22-b438-030191d582d4", "comment": "Malware payload", "value": "9f890df94b35497062c3ba643246b5bf99babc4aefbd7a1c0cabd1aa791adf10e9d52d91968193ff57bb0169d6e4055a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699947, "uuid": "26b5c29e-cf68-4470-b72e-51b251fd4ad9", "value": "T162F4AE02B6A1113FE1BB473DED8B7FA6CA21EE15393190562FF428148FB7745913A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699947, "uuid": "caf82d35-af1f-4f57-b0a4-0a671c76e475", "value": "683e36fe1155994747e39b9f335ec7e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699947, "uuid": "08caf010-859b-4a51-988c-a8053ff9a665", "value": "12288:KAQ4TXPbFLYhC0MPsgGsXxItImX/m/zOOMH9L9T5kLvRJ:KZaZUhJOskXOt/vmb6kLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630699947, "uuid": "d507516d-5976-4376-a078-695d76008793", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630699947, "uuid": "d71f721f-4c93-4653-ab42-fb4fec33dad5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630699947, "uuid": "ed9f6de4-b8a2-458f-8639-0ce80d1eb44d", "value": "3386ae032f6d373ca53c4cdd9f2d8071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c0809b-0c97-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630660356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "fef54388-df1a-4b96-a55c-27d8e01803b9", "comment": "Malware payload (AgentTesla)", "value": "5389da81a09c70fcfb821b071321aba2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "8086d3d0-0446-4ac2-9f12-53bad65f7a0f", "comment": "Malware payload (AgentTesla)", "value": "e9460daf9086e570fd62a9e4f96a5e97939739787c7ce27303c8aca4067a0e07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "f19bbe41-f888-4914-b24a-44b435986ef7", "comment": "Malware payload (AgentTesla)", "value": "a7ece721f1a2c1e78fd645db4ce306777a0613af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660356, "uuid": "12bb3be9-4a93-462a-9733-7c2e2bfbd3b4", "comment": "Malware payload (AgentTesla)", "value": "45dc01b60d86895966b3a018a71db7fc62a0d32d99a01e09724326f50f3182b277f81b2bebdfeb886b9d2d394f9540d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "5b965bb3-b4a0-45c6-85b4-d529e61df4e0", "value": "T1561412D02EA7A3945106C7937DCABD794625FB2F9C500C6F5DDA0BB35CEA88A9418D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "a4948d0c-81c5-4d33-82a5-5a5682700d13", "value": "3072:TpF8mkD5+jNnmBRMl2RKrYms+jm+FoKub6qhCaWz7hF1m4CU7oU/ZMvW5/d1Osi3:Neh54NG2l20rYd+jCGRd7hF1AU71auPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660356, "uuid": "13b3a4d5-a4da-4761-b1b3-a4e43a0945e1", "value": 196273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660356, "uuid": "33add73b-647e-40d2-95f1-eb1fd42c7b2d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660356, "uuid": "426ab27d-410e-4c55-b8e4-396659531e68", "value": "Quote 992829929.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeb6882-0cfc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630704021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704021, "uuid": "f14e4543-3ba6-4b46-85e6-5b5831149dfe", "comment": "Malware payload", "value": "f910fd2fef3f086c5c3b93ae20f4580e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704021, "uuid": "6ffe2232-f68f-434f-a4ae-63dfcb729722", "comment": "Malware payload", "value": "e95fd4b1c20d7547466b404f5a9f00940e40e3c8421c3838b619adfa6bbcb4cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704021, "uuid": "14b7062c-a92f-47de-8006-fadeab6b6c76", "comment": "Malware payload", "value": "1198c81c038d6ca87a2eb73a8c0008f3158eefd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630704021, "uuid": "dcb89860-3be3-4c5d-8dd6-0442400934d9", "comment": "Malware payload", "value": "17c7d87cb9287ad2557db34baefe83d86235b4397f6f8deb129548fdb960743389159c815e3a8271709427912b71eae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704021, "uuid": "94b1f3cb-ab45-4afa-af8d-fec2e7b9b985", "value": "T1EC54CF712B91D533C0A7D5304975AFA46A3EBFA2A960C687B6343F2B5E313C05621B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704021, "uuid": "640d19f6-a200-4d17-b89b-825f0baeaff9", "value": "06fbc87344400a3722a88a2791d1fe43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704021, "uuid": "a865d411-c4f9-4d9b-8321-0eea8eed0c84", "value": "6144:1u6vMG5L2fo6pR0hkaD5+aGlMGt7T5zk7mq:TM4KHVaMaGp7T54t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630704021, "uuid": "764b40be-e594-4505-a1f5-d1c81b62533d", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630704021, "uuid": "70863eb4-3a50-4c9a-8f4c-34dc3a34d8f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630704021, "uuid": "50fd5136-2fd2-42a0-819b-004ee37af954", "value": "f910fd2fef3f086c5c3b93ae20f4580e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d8970b-0c96-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630660004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660004, "uuid": "e0ca5fc6-d325-4ed0-97fe-27b73c9a45af", "comment": "Malware payload (QuasarRAT)", "value": "5ae534c3d752a1a958d1eaeff5a5c283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660004, "uuid": "301230f5-c4bb-46ea-903b-6a509cb129fb", "comment": "Malware payload (QuasarRAT)", "value": "ea04e1c9f1de856c0a0023309410a758b26bdff39e4afbfe329a9b6a805cf23e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660004, "uuid": "e9046444-24d7-4f72-94f5-99c1a2e25a81", "comment": "Malware payload (QuasarRAT)", "value": "6ccef8c91a3c1396cbf0fe0f93f3f98b11cf8dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630660004, "uuid": "dd17dae5-855f-47e5-bc16-8a48408155b4", "comment": "Malware payload (QuasarRAT)", "value": "de1dbbdbbf3ae73de1f2268b7fc2afaec5cf6aba36ee62157f40f7da33bba9dec5e5e456c1cb31563207bc396c76a4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660004, "uuid": "c908d41e-5099-4b09-af9e-16bc9a35dd99", "value": "T1F2E43A5073A84D1BD43B0BF99430523156B4EC56A227FB5F08B0FCABF8DA3425E906E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660004, "uuid": "c3db3ac6-e9d0-4394-9316-bed4adf9fa53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660004, "uuid": "477b8a8d-b053-4492-95b9-c044b83c2680", "value": "6144:bTEgdc0Y5XAGbgiIN2RSBYtxVoOgRsKbpscEgOb8F9RI5sS1C9cTR3hVQkSBzlFD:bTEgdfYVbgs/KsQp7+Ucd9SplF1/WE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630660004, "uuid": "1e4352e9-c9f0-4976-990b-e276c19e4722", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630660004, "uuid": "09d7d739-897d-4fb5-ace1-fa5ea04c0171", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630660004, "uuid": "cbe8a10a-1c69-4755-be03-11bdb1c4dbad", "value": "ea04e1c9f1de856c0a0023309410a758b26bdff39e4afbfe329a9b6a805cf23e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faf0c78-0c81-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630651060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651060, "uuid": "388280c9-b02d-4029-9682-5771ea875195", "comment": "Malware payload (AgentTesla)", "value": "912bdd2fca2209cec1e9ec58a6017e01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651060, "uuid": "053a008b-aa18-4d37-a028-21c08e63c36f", "comment": "Malware payload (AgentTesla)", "value": "eae874ad4727a1ada90f46d6ccc209364ef76bb1d31c3477622a1b31e3161f31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651060, "uuid": "25beead5-54dc-4c43-90a2-38fa7bde5677", "comment": "Malware payload (AgentTesla)", "value": "9bddf8391ed5a2160542c98275ddc8a66b62670b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651060, "uuid": "26799a0b-cb35-4607-bfbe-1f7c71ae8f98", "comment": "Malware payload (AgentTesla)", "value": "96a31fe8295b6af3f3d5bd8306452abc36cb2f5bbf85714b5ee9ae252911e83959f6376f7288495433ab2177850a1426", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651060, "uuid": "1dc7974a-75bd-4bfb-80ff-b5f479ec9e57", "value": "T1DDA42374228D21DB6F48AC2B61808B28F331F7B80F5A95D9F49586FB25CDF6C1B72419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651060, "uuid": "2a5f5977-5d9e-4245-b1a4-cdef0890efa1", "value": "12288:keedcXSyiXWtIWCND6xH0/Keao2RoaLdozw5v:ledcXliXWKWG8YahRT8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651060, "uuid": "78e1b6d7-83d7-469a-a202-79c70c13e6c8", "value": 473824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651060, "uuid": "a037a8a0-0a10-44fc-898b-3ccbdd4d5132", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651060, "uuid": "521c6e26-a9bd-4169-bc5b-a3711b3b233f", "value": "TRANSFER SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacb005b-0c95-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Stop)", "timestamp": 1630659857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659857, "uuid": "6534822c-875c-47ed-96a9-1281193385a2", "comment": "Malware payload (Stop)", "value": "8ca55c7e275ec62a7f00573fb3bd7d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659857, "uuid": "83ffa4e4-f908-4d7b-9fac-c9107bdda85c", "comment": "Malware payload (Stop)", "value": "ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659857, "uuid": "66b60f31-1384-4738-827d-39a44d00b6e0", "comment": "Malware payload (Stop)", "value": "f956d1a0f9c9e0434de63d31a8678427602a02a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630659857, "uuid": "dc8df1c9-b7af-4c44-bc25-b512a6b3816d", "comment": "Malware payload (Stop)", "value": "4f66b2d656e8c744fad722874096d71763a1537c4ed6e9147763c33da8df61b6bcb81204ef15e262431c7b730217cf2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659857, "uuid": "ae434148-951e-4305-a49e-af5378920b66", "value": "T16305122F3691843FE9910B308CA5E7F98435BD5959E2D14B71E93A5F2EF0390932237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659857, "uuid": "4b3e320c-2b62-4661-8f7f-e2abb8795fba", "value": "72021c954fb2224cd9089a2e04035b9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659857, "uuid": "b2b5812d-454c-406c-bf81-d2ba9bf48d5c", "value": "24576:oS1mthSC0G1MQogTsR3VJu65/bvA7uo2A1:oS1mtcC0GHTsR3VY65I/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630659857, "uuid": "ff8f3b60-23ce-4f83-97f4-0e6ede6b7557", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630659857, "uuid": "c6fc24c0-624f-45ee-8282-8f68dea63c54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630659857, "uuid": "a29aca40-45b8-4af2-8928-20eea3b79008", "value": "ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5b12cf-0d0e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630711830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711830, "uuid": "b7aa9243-d554-4f10-8c13-20332270c3bf", "comment": "Malware payload", "value": "2aa61f785688c419538fb9f45c598694", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711830, "uuid": "1fc9a51c-c041-4b7a-8180-b52a83f1ca53", "comment": "Malware payload", "value": "ec96e346f38308d306fc0b936cfa535194f0cedc1b28897d2dc3c8ba2bda9f97", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711830, "uuid": "4a93463e-554f-41b0-ba0d-64151f74324e", "comment": "Malware payload", "value": "cb393d3a8a2c03c4576b744b425128d48185e3fa", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630711830, "uuid": "a7d7d120-5722-4f7b-b2b6-36493a5c66e7", "comment": "Malware payload", "value": "e6a580fae84306cb48c0c0c22ceef4a55f612820f955595a54a63d330513d7e2106e185c1fa852c14cf116a80ed94b35", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711830, "uuid": "f6ad11f0-0ede-48c2-9f5a-690b28c55754", "value": "T1F38423F321E141243D2BC997671F7A837A29B5973BFDB0467A4A4A810D31490F35BE78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711830, "uuid": "1593f4c7-4043-4396-968a-272686e80c80", "value": "6144:jXmigYmLpKE/zzkE3y/qizTP3XKw4dbouIVxhNXJmAJxv4bTGHipSK8Q:fkpKE/fkwi3nKwIoz75mrb8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630711830, "uuid": "e7513a66-5c43-4f98-b44e-5641be93f9b1", "value": 377817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630711830, "uuid": "6cfc8baf-617c-442a-99a1-b89f29ea9b34", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630711830, "uuid": "93664298-941b-4a00-a5fd-2b490e152c70", "value": "Quotation.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636b32a8-0cd2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1630685829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685829, "uuid": "f49598e1-cfbd-4cf3-9f12-141876884708", "comment": "Malware payload (Formbook)", "value": "568af775c70dc6789e84a95a7b9cbd0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685829, "uuid": "11eeeb00-5f89-4de0-aca1-27c60cab2594", "comment": "Malware payload (Formbook)", "value": "ecbd46c265b67d75964db9233ccd1f26710d56ab7f649845e44f59d55db4251b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685829, "uuid": "1d88b368-4ce5-442e-9903-d9493578d008", "comment": "Malware payload (Formbook)", "value": "87458784e0b2a171dbef7b5c94c85a5d94596cdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630685829, "uuid": "82072fc3-2e61-4872-ae33-a6055cee608f", "comment": "Malware payload (Formbook)", "value": "5409191318c5dfea0bf14e880dee5141e48e7b109fe88be04b50f4f6571bf9afd4871123aee1bbb40724f5c580ec8d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685829, "uuid": "4e17fc9b-5753-4597-a086-733e802f2051", "value": "T18EB4CF8C7950759FC467CA77C9A92C60AA116C7B930BD303A457369DAD3E6CBCE120B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685829, "uuid": "1ca315f0-d893-4e88-b4a6-1a307625a9cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685829, "uuid": "319255af-7474-4627-9ce7-6d32eacc9fa5", "value": "12288:2+UOMuJLk2Nv9WChRRoYccN+5mVvBG15vckXBWf4mY2im1O:+OMmLk27ROBmVvg7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630685829, "uuid": "6e2528d9-5dab-40f1-b54d-7c4413368406", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630685829, "uuid": "63053946-8f3a-4715-a091-7cc123b0d608", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630685829, "uuid": "a06f81c6-7be4-4f7c-8747-c1c7886ebeb1", "value": "PAYMENT ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb0e984-0c6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630641182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641182, "uuid": "8bd1acbd-0c52-463f-8027-2c86f743f05b", "comment": "Malware payload (Mirai)", "value": "72f361d149037a2a32af8216124f9af1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641182, "uuid": "40b3e3d3-be09-4d53-87fd-b2c187051809", "comment": "Malware payload (Mirai)", "value": "ed93a734f07f14f3c8e761e23e0aab5e51abcbb3785c166a534317bec3e0200b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641182, "uuid": "feee13d6-3302-4f39-af60-987dc8aed38a", "comment": "Malware payload (Mirai)", "value": "513a9038e22898f5a8c3a19eb709ff6f9a3642db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641182, "uuid": "a6a70c9f-ae33-47ed-b6aa-25dc8412367c", "comment": "Malware payload (Mirai)", "value": "5603a4b900cb3b02953559817373201a696bb4f784ecce10e4556f0480466aac410503a05ec9a392d58196c5eb890cae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641182, "uuid": "25de3140-2dcd-4661-aa06-e3545a045cf3", "value": "T18A83D819BFA40FEBE86FCC3701F85B4525CC6A0A12B66F357634C918B65B54B16E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641182, "uuid": "92cbdd06-a624-4c49-85e6-c8cf6b3fe082", "value": "1536:4/Tk8w8tqYnDMsfbNpyYoLgue8QdZvDpPSGoguNh:STXwWnzNF8QdAzNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630641182, "uuid": "f7080c7c-7110-46d6-9c56-690f54be8358", "value": 88740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630641182, "uuid": "3d726a1d-7c31-480f-8654-5f1cc1d2387d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641182, "uuid": "48f8c67a-02be-44c5-8a47-3b742511be75", "value": "72f361d149037a2a32af8216124f9af1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50342647-0c89-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FIN7)", "timestamp": 1630654443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654443, "uuid": "e5b6281c-b58e-433d-828a-bbbd15810aa1", "comment": "Malware payload (FIN7)", "value": "d60b6a8310373c9b84e6760c24185535", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654443, "uuid": "85628550-e31a-4fb3-b908-f5d73ae7aa6c", "comment": "Malware payload (FIN7)", "value": "ef0a68eb3e2998acdd5fdce8acd980ea9077c44fefced848a36805690844ae37", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654443, "uuid": "f0395bcd-222a-4456-96ef-fca8a2016326", "comment": "Malware payload (FIN7)", "value": "6b1da5e0ecda14512369a7201982a6bc13b33700", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654443, "uuid": "81d0df51-9229-4811-b2f7-20d6e9547253", "comment": "Malware payload (FIN7)", "value": "06bee4636720cb0927eddb7ef88b11211edfb9cdbda8caad176fffc1b5acfa6276132a4f60c0dbfaa82feefbd16c2707", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654443, "uuid": "8270378b-4438-4bbe-ac91-1794699f6c41", "value": "T19BC51207F7C10732C2961231954EA7D5B3258C3CA2358A6135ADB53D3A32D78B6BB7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654443, "uuid": "e6144d02-0b5a-45b5-b8ed-d2ef25dee710", "value": "49152:kpHH1j3mpdgRf+us8azmLBVU3p2XR3451TpKPOv05AhEnfsW8:kNxmsRf+u8A+4mtKe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654443, "uuid": "f875e5d9-d05c-4a01-a6dc-22c27f13d1e4", "value": 2499072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654443, "uuid": "2521bff7-fbf7-44a9-9ce9-2f367f8a5fc7", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654443, "uuid": "2ea9f491-4d4b-42f8-b1da-02e3db6ece70", "value": "Users-Progress-072021-1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8dfa88-0c73-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630644966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644966, "uuid": "df6df0ae-729b-428b-a849-e102d8a5e60a", "comment": "Malware payload (AgentTesla)", "value": "72c7b01771ea8cf546b0115ad0c7c9b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644966, "uuid": "3798cd7d-4f55-4d48-87f4-2b4b2755f7b8", "comment": "Malware payload (AgentTesla)", "value": "ef65671c4689130568a3f0fa0b4987787707a037502fbe18c4198ce3cf365da7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644966, "uuid": "58b2a29c-5762-4a49-9db9-f60c64156e1e", "comment": "Malware payload (AgentTesla)", "value": "33a43958802cccb938be6d196b2cd7db9ea11137", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630644966, "uuid": "1ce46ff5-f095-47d1-9435-338516a8ce10", "comment": "Malware payload (AgentTesla)", "value": "372d58a006f9c700002b9042f24d37f50d91531457995f20bc8cbf04df89fa088a78a8d197ca4fe04cd7fc57bf6a0591", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644966, "uuid": "23560e5b-9f18-4b13-8abf-a5e18c25e14b", "value": "T14825EF3DAD6626339FAAB67CD4E6194EE79410EB13714DE9C1E2B38C2007513B6DA31C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644966, "uuid": "bf1b6dc4-e129-490f-9eb4-c7afe766012c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644966, "uuid": "883d3894-08ef-4620-9b32-78a1c1a929dc", "value": "12288:PigPiF84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Me6:DFOVKEMPlcR2IFSmnmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630644966, "uuid": "1c3f52c6-a20f-4b98-a673-2d69ca3a2dc4", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630644966, "uuid": "9e4d94e3-45ed-41be-81b8-72653d06fdc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630644966, "uuid": "92ff1f1a-09e7-485f-bc8d-857bbaf75286", "value": "airwaybill # 6913321715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2204dbf-0c58-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630633643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633643, "uuid": "3303944d-eff5-4161-b4b8-a9b9f819d302", "comment": "Malware payload", "value": "ffdd3eab09281cc6c17288f66e0c6c0f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633643, "uuid": "ef828559-00ad-4a85-ac1a-b41e525b5935", "comment": "Malware payload", "value": "ef983fbb73655b3e7d778a7a08f0732c5ce1f3315ae828f27972c689fd63fd2f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633643, "uuid": "69ecc711-2835-428f-a521-0a4065ab1cde", "comment": "Malware payload", "value": "c2aa1c6e9d1f629e42da65738b21bf8fdd793573", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633643, "uuid": "4e61ba21-b755-4ffc-8e51-1ea303628599", "comment": "Malware payload", "value": "9fdd50e7698d47d0dd2e1b3888edd0f9ff6d20dc395d6104a74820bc932e075f9fe1ce9de876e426631c23e04124bc95", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633643, "uuid": "15693ac0-3255-425e-9b54-613dc40b302f", "value": "T17EC20FE7B6C6AC45CE59033948A787A06717FC215BA7838B3389F7161FB1BC0894365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633643, "uuid": "d9cac0d3-c6ee-4c3a-868e-a635df8e8b78", "value": "768:lPpRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJSWM:Nrk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630633643, "uuid": "b0be2db5-3772-488e-ad1c-1b2b0a025a22", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630633643, "uuid": "a308680c-f056-4ef6-ab93-baa36d2e5ab7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633643, "uuid": "acccd192-d4c9-4e18-b5b3-7a8d1bc2a5e4", "value": "SecuriteInfo.com.Trojan.Malware.121218.susgen.4275.31917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9aa4d0-0c5b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630634761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634761, "uuid": "7f8c6c33-b9f1-4b72-993a-73c3ec3a9324", "comment": "Malware payload (RaccoonStealer)", "value": "936228a78e418dae59af5a74499de109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634761, "uuid": "2b791c7e-2266-4dcc-8077-1a82f1cc7adf", "comment": "Malware payload (RaccoonStealer)", "value": "efe25285ceab63a434c9d45f1e1d0bc8eea628869ddc4615f7f37d3d6377e63e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634761, "uuid": "987bcade-10ba-45d0-b03e-34bd795880e5", "comment": "Malware payload (RaccoonStealer)", "value": "47176e8e95b5ad22957c71d2924934197c767e0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630634761, "uuid": "92558643-10c5-415e-9bde-8ba55a07bacb", "comment": "Malware payload (RaccoonStealer)", "value": "21ab3866d10a3d594cf400b93ec7f590cd01edd646eaf5d7a9f2ebbd8928b8c9f1a8cc3a69dc9856f1a6d80bd7d6f885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634761, "uuid": "9d22fa36-3817-4663-975a-a1e0be303a70", "value": "T101A40236B2D0C077D5D2C67169308EA55EAFBC6298B044877AB93F1F2E31781966231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634761, "uuid": "505f4e58-2738-458d-a724-d94e9bca0b9b", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634761, "uuid": "694a208d-bc23-4463-a8f8-4239358fffd2", "value": "12288:bV+pKwLQj3Dtchx9KezVbgPlkSHUvM+Daht:hxwqTSVpzVilkor+DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630634761, "uuid": "8bc659de-d913-4d1f-a1e1-c4391c85dd54", "value": 471040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630634761, "uuid": "f9c4a918-f684-4c58-8185-f91055adc9b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630634761, "uuid": "5fb2d35d-37e7-4e98-afcc-f08ce67ddeee", "value": "936228a78e418dae59af5a74499de109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075c2ab6-0c7f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (QuasarRAT)", "timestamp": 1630650026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650026, "uuid": "921f53d3-d358-451c-ac63-5d92719f126c", "comment": "Malware payload (QuasarRAT)", "value": "8146345093404dfc79a943b0da184e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650026, "uuid": "c29fb1ba-5c5d-4e41-bc63-2f1f1a8fab1a", "comment": "Malware payload (QuasarRAT)", "value": "f0f118c8bca327b5a4d164509fae627e4bd37b087abc1b7c2e337bfc8e3ff90e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650026, "uuid": "f87786a9-3024-45a7-9df6-939deca58674", "comment": "Malware payload (QuasarRAT)", "value": "1472f04b7d707f523bc98975fc593c78ae5f4710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630650026, "uuid": "c42302b5-fed0-494c-b5a8-9f3ab5c40596", "comment": "Malware payload (QuasarRAT)", "value": "3e8ec713bb0528ed00093a9f3462501aba69f5f5aa507197193f979d64232d246a552bb096cc18de8c0a8bcff5c9250c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650026, "uuid": "467ca775-ebdd-41f1-b67e-58ad3e79bf72", "value": "T180D4CF8433B64F92EBBD8BF86A71211047F6396B656EF74D4DC521DB11E2F004AA2B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650026, "uuid": "287f3535-7ba7-4824-930b-a87b38ef7685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650026, "uuid": "f4fa72b9-a8e8-4318-a2c0-a05459ae4991", "value": "12288:TjxXyjFxBYSk/XE+DF7ruopsW+grfBecYSDE5JVKV6m9E1/E:TjlyZxBAXdZ75CgEcfDE5kKdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630650026, "uuid": "000ac76a-0b92-4c92-b24c-dca1e2c1c84b", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630650026, "uuid": "6e389df0-579b-48bb-8659-93a97858ae14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630650026, "uuid": "0b4a5c35-cdc0-4374-8377-b737ea4193f7", "value": "INVOICE#09090002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1664359-0c58-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1630633641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633641, "uuid": "9a9588d4-b429-4537-8a98-24e332d7ece7", "comment": "Malware payload (RedLineStealer)", "value": "83e6e738876fde792abae146193d4963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633641, "uuid": "0552825a-f967-4201-898c-80cbf1df77f0", "comment": "Malware payload (RedLineStealer)", "value": "f150c064aa08e8d327c99a2edf0811a9bb6e06398d0d846b69a0c321ff6ab259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633641, "uuid": "c90c198d-3846-4ea5-af40-3b0dd80c88d6", "comment": "Malware payload (RedLineStealer)", "value": "a5b3ab13138039b198a3454d99fd9e43a5d10f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630633641, "uuid": "d626e7a6-f182-4ede-a98a-820836b133bb", "comment": "Malware payload (RedLineStealer)", "value": "86ff405216ff94e4cd142d4e023f85ebda48e0bf9292d816d7951f771f3437a9ed3a861165457db268d7b6e7f504b84f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633641, "uuid": "c25d58eb-a2de-46e0-9bc5-2b32e723669d", "value": "T14554E03177A1C433D5E2E9749874CEA02B3FB8A62964828B76753F1B2D712C1963235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633641, "uuid": "c829b2ea-6654-43d7-85e2-0808b91c387c", "value": "b7ebe503aba8ff6fce4b2b89581116dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633641, "uuid": "6b630f96-3cc1-41fb-bb49-6665a0b7afae", "value": "6144:UI7zL718A97H9E5SGCeGDJkaPtVvMG+8K:UI7zHSo7ds1Cv9tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630633641, "uuid": "95bfe674-1e92-4eae-8f98-9ede43ccae17", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630633641, "uuid": "f69056df-0918-41ff-bb57-26d4a2090759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630633641, "uuid": "cea5ff85-60bb-451b-9f54-6919e33f75e5", "value": "SecuriteInfo.com.W32.AIDetect.malware2.24812.11752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78b306d-0cb8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (MyDoom)", "timestamp": 1630674830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674830, "uuid": "4c531348-6d3d-4620-b04d-67931e738477", "comment": "Malware payload (MyDoom)", "value": "4aa3bedae17fd39c2d1c144067c1ca0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674830, "uuid": "68016051-0e11-41cf-bbf4-339e717fa9d6", "comment": "Malware payload (MyDoom)", "value": "f2404d51758aff593e8405e3731390f650a15e1dcdbaa3b6969e7fd196784136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674830, "uuid": "4ac68b1a-0156-40da-8bf0-2e867ddb8718", "comment": "Malware payload (MyDoom)", "value": "41d03d3e9f5afc615c6c1fd58296170bb26a4307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630674830, "uuid": "33e34f48-d65e-46ba-a53b-fbca6a0b480d", "comment": "Malware payload (MyDoom)", "value": "4f58ccf041e4bb62d4d9fad25b83c5f358bc566fb921b669417c10d1c38a663bfa48b84d72d1b86135fd844220e8cc7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mydoom", "colour": "#22EE9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674830, "uuid": "8c91e147-318f-438f-aef3-d6c115429719", "value": "T13C23F1D53AEBD8F6C0808ABB426BF8B834456F3C21FD01976B70BBAEA175C187954131", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674830, "uuid": "74e2cf0c-5d05-4afe-abbc-d69002d833ef", "value": "5d02f6de12eb07fb22fe87e05e50d6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674830, "uuid": "f96124f6-6b0c-438d-ad32-9db2317688b9", "value": "768:SCIqdH/k1ZVcT194jp4mPXk79NmfvBOIPMkDQ2mid3fLAhcL:SNqaLV8a6mPM9YnBOI1d3fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630674830, "uuid": "062aa4f8-6830-4b31-9c57-fddc719f11ac", "value": 48636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630674830, "uuid": "9315a242-873a-4014-b475-772fc3667e5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630674830, "uuid": "ee0ac264-6332-4393-a1e1-298e14baa730", "value": "ihdgexm.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b641df27-0c99-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630661486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661486, "uuid": "6162d6a8-3721-403c-9fea-47f599f41694", "comment": "Malware payload (AgentTesla)", "value": "610591a7ecefecafee2ccdfe2c45c2ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661486, "uuid": "487a331f-9380-403e-9e55-70c95d254a9c", "comment": "Malware payload (AgentTesla)", "value": "f2e119f39baad4780a3ba5680df06456d3fbc1dd04e3b322607582ba98004698", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661486, "uuid": "2b1c5508-bd60-45cf-b821-250f528b3760", "comment": "Malware payload (AgentTesla)", "value": "16c21e440ffff3054d9cb92f3e1cba22e1c9a36a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630661486, "uuid": "a158e662-f68c-42bb-8dc8-c980832b765b", "comment": "Malware payload (AgentTesla)", "value": "015215a2cf4b911ecb814fa017b42b91ee0f87b0705cb31d47987441d8d495b4ed098f2cb6ccc04e71b6459cd4564720", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661486, "uuid": "e9ca80dc-f405-4978-a50f-1633062e20ce", "value": "T1DC1412D02EABA3945106C7937DCABD794725FB2F9C500C6F5DDA0BB35CEA88A9418D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661486, "uuid": "d23c6ea3-9216-43aa-969a-f9c8354cc565", "value": "3072:8pF8mkD5+jNnmBRMl2RKrYms+jm+FoKub6qhCaWz7hF1m4CU7oU/ZMvW5/d1Osi9:Ueh54NG2l20rYd+jCGRd7hF1AU71auPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630661486, "uuid": "ac6721cf-1b1d-401c-b33f-3f3bd7d39140", "value": 196289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630661486, "uuid": "e0fe0e9a-da30-4dae-8042-9f50ecda263d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630661486, "uuid": "f1f1c2e6-997f-4998-8338-c8e3b2ebb86a", "value": "Revised order 006277-12.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340871b7-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655255, "uuid": "7731f795-6467-4bb5-b2d2-7b69ed12ddf6", "comment": "Malware payload (Mirai)", "value": "fc9dff9778761f5bc557d3bdef89158f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655255, "uuid": "9a03df18-0183-47c9-af1d-53795065961f", "comment": "Malware payload (Mirai)", "value": "f498f0e6739af781defcab1893e1fbeb1322cb363bc0fa989c4288fad79a19c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655255, "uuid": "5066b17b-ccd3-46d4-b6d2-0281e597b3b7", "comment": "Malware payload (Mirai)", "value": "ee74e44b3b0d438c75f708d36f3513ed6bfdf851", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655255, "uuid": "bf266379-d032-4e6a-b112-312a61690a6c", "comment": "Malware payload (Mirai)", "value": "3fb3d3725d42a6c9f1629ec65f30adf7465b65e9b646ac034bb9a6125eb0506d4f02c1ca313f9d17e7c20f1405503ab3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655255, "uuid": "236019cd-9ea5-4cf5-9223-b0381173c88c", "value": "T1EE23F19C233184E5D268B0F8F2C657993A410F41A241EF5A576F9AC6AFA96B338D3350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655255, "uuid": "d6ef3b6b-b202-4ce1-accd-5996100e9ff9", "value": "1536:8nBXmM6OCPPSk+YG/ihgILxAWIiK8VJuQ:4BWvOCH+YG7IlAWpPVQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655255, "uuid": "4e3aedf5-bd2d-43ab-a63a-68d2b5088dce", "value": 49640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655255, "uuid": "90af10e9-8db7-429f-8dca-d5d08c9865bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655255, "uuid": "0e9cfd4a-a3c6-4267-b369-88edd53cfbf0", "value": "fc9dff9778761f5bc557d3bdef89158f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe870d7-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655409, "uuid": "08020d07-e5c9-4da9-9c78-08ba5aec5ced", "comment": "Malware payload (Mirai)", "value": "a4f3f7479c1a56371a87141b849b713c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655409, "uuid": "0cab6757-5543-495c-8aac-5be7809f4716", "comment": "Malware payload (Mirai)", "value": "f4f1cdbd8cf106c3aec6c3554cf42454fdeefadaf9507e4752204cbafc429a6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655409, "uuid": "8f19ec88-89a6-4395-b771-9d0deb0482aa", "comment": "Malware payload (Mirai)", "value": "14b618f714857c603ec7b0491cc0f1523f17a032", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655409, "uuid": "79102e2e-ecea-4044-8a69-2e94173df639", "comment": "Malware payload (Mirai)", "value": "605eac31212bb9bff28546b2cd44f057d611f19a5d21a48e5813091c6a2e2bf8b7145ea59f233e25cd1a49736f416a21", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655409, "uuid": "8a2c7350-af51-48b4-a782-0a2ffd8a35fe", "value": "T1FF23F1B1A003ADA081B449357CD68BC277570FB8E7F9E9207E18412CB54A0B6476E7DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655409, "uuid": "a6006efb-6f2f-49d6-aff4-4d417fd70334", "value": "768:tkNuGO/4aiSnnXmIM9XLO5jQ5CWTGlhGIStR2O1Depd1Cq7f4B2ZHds3Uoz3:tkqjnnX49qTWgG3R9tEdLzgz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655409, "uuid": "26b95be9-0eb2-403a-9a88-ab0905cf5ef0", "value": 47640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655409, "uuid": "e92d455d-c865-468b-a618-82462a225b61", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655409, "uuid": "f92115f5-5dc3-48f9-bb2b-fd063f4f5307", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c225234-0c8b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630655403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655403, "uuid": "cdd2f4bd-eb4c-4c38-b2f6-5f35acb8ba0e", "comment": "Malware payload (Mirai)", "value": "2af6bc0f0cdc068295b287073c80b5a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655403, "uuid": "7c0c307b-f8be-437d-8504-06d28bb925d8", "comment": "Malware payload (Mirai)", "value": "f797e1ccf1ba3b867d3f81d9235a317856159555abdd5d588bf8fb1b52878929", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655403, "uuid": "e1bc7a4b-8a30-4a0f-b23d-641e0a6fbe32", "comment": "Malware payload (Mirai)", "value": "43ca7deff814653c440c88e4d28977d591c77378", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630655403, "uuid": "889ff8a5-d720-40b6-b0d2-9dc79fa31bb1", "comment": "Malware payload (Mirai)", "value": "4404aac685831296fa6d5f8ff8d3a771d92f764e87bf19f0849aee9885f9bb49f26eed8f0625c1b77be577044c65e26b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655403, "uuid": "0b908ed6-51d5-4050-9ebb-11971097ea86", "value": "T10F23F1C397DECE00CA5F00B6115EFF291A448167A95590E687F43074ADD9B05BA3E786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655403, "uuid": "29377594-61b9-4392-a971-8289c7e09619", "value": "768:PoCuGtDvqsxzgUDl2Uee8xt1XYYfOyE0t50AKWow8u4v7YjFLWOMqEuQnbcuyD7k:QTGtDysxzlBy1X/18Zwiv7YgOctnouyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630655403, "uuid": "d63f87d6-7623-4cb2-9f71-06e559e2190a", "value": 46068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630655403, "uuid": "a0998ef6-9063-4322-b7ea-94a6048e8056", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630655403, "uuid": "ef141685-ff39-4961-a4ad-ba5637220509", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff9de46-0c83-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630651973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651973, "uuid": "c13e4c45-14b8-4507-ad33-4b2c7d3d5a12", "comment": "Malware payload (AgentTesla)", "value": "976f52920b8b4b7834a4ce5038c937fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651973, "uuid": "c611a5f8-b4f1-4da9-9955-35fdb17ea0ba", "comment": "Malware payload (AgentTesla)", "value": "f7b2a629aae722340193dcfda8835179bd8bb9d63179baab3bc9c85d48e190f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651973, "uuid": "760fb33c-e90d-4b19-a02f-62c30221b58a", "comment": "Malware payload (AgentTesla)", "value": "7e8eea48843fa137536d63b50c1c328d4d156a8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630651973, "uuid": "b09788fd-7ed2-47ea-ade4-5354b799578b", "comment": "Malware payload (AgentTesla)", "value": "cb52b8ac57c0178c3c56407d9d1e94c18a168bcf55410b24de68c0adecb927144bb688d55e7af257f78644086c0ccec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651973, "uuid": "e0cce7dc-659d-4101-a535-980a311742c1", "value": "T19E05D0187780EA0EC17F4F7A89911540A7F4E662570BF3877CC222ED4AC73AA5A17379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651973, "uuid": "268eefa5-458b-42a7-a52b-22fa80952633", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651973, "uuid": "1100f69d-a037-4c21-8647-f12555c510ce", "value": "12288:xNKF5SUG+e+iST8uyXEjUg7aAzPH+R3HBjxZwSuPO0yAu4DKZH7dlId1Yn9:xNrUGj+y0ZWAzf+dhNZth0yAu4OBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630651973, "uuid": "5399c40d-9546-4ef0-a64a-61399a27e010", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630651973, "uuid": "c79ce0e9-a327-477e-9532-30a1c5114bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630651973, "uuid": "847606ea-2ba2-4304-bc04-3fb71c403ab1", "value": "MAERSK BL&S SHIPPING DOCS 9380828PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7912334b-0ca5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1630666538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666538, "uuid": "e1466a7b-df5d-4854-bd4e-2837a83bd29a", "comment": "Malware payload (AgentTesla)", "value": "8cfedd6fe6bd902e3f42ecdf29649fc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666538, "uuid": "9ceafb93-ea98-49ed-8139-d8cb6d3080d5", "comment": "Malware payload (AgentTesla)", "value": "f9c716c3b4b1144cc071f6056628f3f9c7fc05f20f17697b727804826ad03d3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666538, "uuid": "dcc6fc73-d582-4f8f-9efe-3085761acb09", "comment": "Malware payload (AgentTesla)", "value": "794f9f2b7f233de8a9fdc0f4c299d0e348fc3a85", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630666538, "uuid": "3eeb6c94-3aa7-48ba-a8de-f583fcdffc15", "comment": "Malware payload (AgentTesla)", "value": "a17c23d1a2ee76adbe09ba2c91f65f179fbb69246870446c7537904d031e40187cdf0e1e81c75d611b9592d5306dbb25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666538, "uuid": "c0708284-812c-4b12-834b-98ec926ce8cd", "value": "T191A4CF9D365076EFC857D976CD981C20AA61B47B531BD303A41722ACEE0E69BCF121F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666538, "uuid": "91f81f67-ef7b-4cf3-9cb8-573578ecbca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666538, "uuid": "78c435c6-68fa-4d56-ad54-811adae85f6e", "value": "12288:GzlskGizQ6YrrW1/isZKARQ6bvDg5lYJp6akDxLNwqZHvuN1eeB1WmRdhk:yPGizQ6Yrr61RQ67s2qtNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630666538, "uuid": "e2f9030d-588e-4dad-bbdd-d74e17885aad", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630666538, "uuid": "e8392719-9b15-4b7f-8fd0-b8d6bdb89a93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630666538, "uuid": "e7b029a5-d87c-44f2-a4ef-d63236ff5260", "value": "RFQ No,E027-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb8a44f-0cce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630684207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684207, "uuid": "fa934248-ee1f-41d1-8ffc-fe300273fce8", "comment": "Malware payload (Mirai)", "value": "05259e3105ac2742a292270da4092a7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684207, "uuid": "b0044921-d6d6-48d5-9f0d-2a86e4ac6746", "comment": "Malware payload (Mirai)", "value": "fa282cc686a264d65d00afe87ce06d5a57d04051cb7688131b8e15d8ce00e3b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684207, "uuid": "a23e208e-beac-4d45-bf29-3436614238e9", "comment": "Malware payload (Mirai)", "value": "9d58b999aed8984f93a8d9ce95603529f02e4f00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630684207, "uuid": "a0d7dfa7-ac40-4d13-970b-6a21ff8616e8", "comment": "Malware payload (Mirai)", "value": "78a9e6ee3746121f34fbeac9ae965cfa6e444ebad91cf8c4f869545a0a67f37220fc0cfe80f7cc2d3543ed13d4586149", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684207, "uuid": "5a0b7bae-1b08-42f8-8296-149a6d528325", "value": "T13D33D795B8D25A2AC6E4237AF9AE40CE332073E8D1CF3217CD151B147AD592F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684207, "uuid": "a8a51477-d7f6-4069-ba20-c48bd1b40185", "value": "1536:S5Z4fJ6tL/yXFeL5zvL5nrHwcA7WhKpQY:S5ZIs5LL5nEcAihWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630684207, "uuid": "31ac0663-e27d-4cd4-90d1-edae3602bca9", "value": 51168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630684207, "uuid": "84754cae-f25a-4c27-a584-53df58bee905", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630684207, "uuid": "3fe7c38c-ffbc-4f1e-86e4-b1f414733440", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4517f3a7-0cb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FluBot)", "timestamp": 1630671604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671604, "uuid": "56a124e2-cf9c-4ce1-ba5d-ae7c491f48a2", "comment": "Malware payload (FluBot)", "value": "af9f032aecbb2c3a4f5eed9b5f675419", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671604, "uuid": "5868c8ee-7485-41f1-8843-eeb9207ace9d", "comment": "Malware payload (FluBot)", "value": "fc45b5f85cee56830a9f7e3001dca42026a9691445afa8f429b57203fc47a1b2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671604, "uuid": "fcc8f410-010a-4e98-a421-dfe17083cc09", "comment": "Malware payload (FluBot)", "value": "a0ab0777891553d9c1dced5fdafe2b9e1d5b341e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671604, "uuid": "43acbcb1-c0e5-4be1-b497-873b4f551b42", "comment": "Malware payload (FluBot)", "value": "e329b6b1febe31047a6b7d65bd36d3bdacdce4697201887b0fc0b8632b2eae5594b5ede76aa4cc0a58d867e4c25fb473", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "v4.8", "colour": "#C33379", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671604, "uuid": "cdf5b6e3-a4cf-44ef-b352-8581b931492f", "value": "T1A7F52216FEDEE91AD087E13CD1649897440844484A08FF1B9B2692DC8FFAD44AB87FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671604, "uuid": "a9f8e084-a98b-434f-963a-93b65eb7cdbc", "value": "98304:Q7KGt3ZuI7y690JAD/oD4bSMI6/LTdCH93:QeGfuI7y2oDbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671604, "uuid": "621843c6-1a02-49c4-8d0b-76d2106c3927", "value": 3457984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671604, "uuid": "815ca8d7-3456-4c70-804a-9899f5b6c44a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671604, "uuid": "80f60392-521f-41e9-8bc7-f7a8f812c26c", "value": "fc45b5f85cee56830a9f7e3001dca42026a9691445afa8f429b57203fc47a1b2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ded3a5-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630654028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654028, "uuid": "efe569f1-5e8b-4428-8adf-ede030a4065a", "comment": "Malware payload", "value": "af45a353b8c112989a7661752daa934c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654028, "uuid": "cca39a04-6291-4377-95b4-284213199869", "comment": "Malware payload", "value": "fd2cf450e1c514cd731fbbcff6c78143e96bfbac5d9b8f4cf5251c94cde4cf5f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654028, "uuid": "9ba3a6d8-511b-4d96-b8a2-c56a3db508ae", "comment": "Malware payload", "value": "3cd0c332080ff6ab4d89262f24df758b49b2cdd3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654028, "uuid": "aef00e02-88dd-4a32-acd9-231a31d6fb11", "comment": "Malware payload", "value": "9cdca1df3007c54597f0a52a01f142d0cf2ea7569e3e16a58621c156948eaabe94d85ad149cd0ca2a93c7d0ec273c2e9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654028, "uuid": "1e3a88cf-648e-453c-a810-b7649108f817", "value": "T17CA109746E780807DE0782F6D678FFA301EBF3C9AAC71948725EFAA40B673111935652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654028, "uuid": "1cff63e0-267e-480f-bdb3-5062e34a31d4", "value": "96:jaGCwmO7o95JhymE/Hzd9rgpDXMq4qklqC1JGTJrLlnfAA+ebj:jvxs9ctT7YAJOJr5nfBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654028, "uuid": "104f3d69-ea60-4e0d-afa2-5a933d9c9e81", "value": 4799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654028, "uuid": "f7b334ba-ac0a-4690-87d8-361cd594f85c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654028, "uuid": "d6605a96-bcf2-40f7-a482-676ebd1c0273", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ef5677-0c6a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1630641190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641190, "uuid": "5c6838aa-6a86-440c-a083-79cf601713ad", "comment": "Malware payload (Mirai)", "value": "593494f798dba9b7a4035221d130817a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641190, "uuid": "166d787a-1110-4dd8-a8b3-1be8c0ae929c", "comment": "Malware payload (Mirai)", "value": "ff319f072b46a024c2471fc87c202d9aa533d13af0f9fc8cee16ac9c1a8baec8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641190, "uuid": "ad4eccbf-0ca5-48db-8119-d470e846109e", "comment": "Malware payload (Mirai)", "value": "25ea6e24f5015f486208e510537141adc99934cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630641190, "uuid": "301e97be-b966-4e71-8919-246501cb863b", "comment": "Malware payload (Mirai)", "value": "4470d9d8abb10cb287a237bc811936d7057371003f599bed982be80124d21f7d95cfd187f853c4f4185e881764b6c470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641190, "uuid": "95e9cd9b-6b85-4a43-b58a-e64198259edf", "value": "T1634339C6A042CCB2ED9381F1192BD77AB773F0772015CA43E3562A3AE875A90D68775C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641190, "uuid": "63108f76-39eb-46de-8b2a-31a8fd712f49", "value": "1536:6VoUNzzyKTh6RP4Pbk4Ou6iFuPwFiMhTLbAqwVfEzzTtCiSQwQ:GEHFiFuPwFioPALVfiRCUwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630641190, "uuid": "a7527add-26b0-40c6-8d72-5525ae1d478b", "value": 58612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630641190, "uuid": "d3692bda-0a7f-488e-8525-0041d2cdd35a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630641190, "uuid": "423c8131-cb71-4d2e-a2a7-d42fde45f832", "value": "593494f798dba9b7a4035221d130817a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc031393-0c88-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1630654221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654221, "uuid": "a89cb675-5de3-43e0-acb1-6e3413973b9a", "comment": "Malware payload", "value": "d08620b98b80f9e879eb4f09f765028a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654221, "uuid": "d558c81c-04ca-4094-a591-5f7974e1e3b8", "comment": "Malware payload", "value": "ff75385333b93d3f7469d95ddbbc88b7621e0bb4729f201a973fc628b71874ef", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654221, "uuid": "177660e8-6c22-4431-8164-d5546f70aeef", "comment": "Malware payload", "value": "e5ed083b17abaae33fcf1efa25734efdd24696f8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630654221, "uuid": "c4171b7c-d8af-4f4a-ac80-3d6867abbe1b", "comment": "Malware payload", "value": "399a66b47aad0ebbc52cdad96b434c5393fcdda8577ae3f654121c332c7fdd8d5ffbf690ce18cfe466346b8f21378645", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654221, "uuid": "74885749-57e1-474f-ac4b-941addbdb936", "value": "T196316A24CF1EC4DE4612A1E02A5B9E170EA55F117BDCDB8E1484D904EB1E86D46FD633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654221, "uuid": "39a4ef4f-fad6-48cf-bedb-028ae6a09942", "value": "48:c/u3t1kD3Geq3qz3u0exPf70ZvvvWWU5u:iu3tIbq3qru0wPfYFvvWWU5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630654221, "uuid": "81921788-9b95-494a-8174-b93e8e9ed56a", "value": 1576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630654221, "uuid": "321cf6b5-79a0-4ac9-be7f-39cc7d2e1c7d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630654221, "uuid": "3f6ca17c-2a6d-478f-a69b-078e91c4b451", "value": "TYGGJ802.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093d3a2a-0cc3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Cerberus)", "timestamp": 1630679235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679235, "uuid": "81bf7956-2707-40f6-bbbb-97507572e9ea", "comment": "Malware payload (Cerberus)", "value": "eeaeb0bbaab12d27f8206f6bec61b8bb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679235, "uuid": "9a746f44-0959-4770-b210-4a945b9551e8", "comment": "Malware payload (Cerberus)", "value": "ffb754f38c5d363e203e48279bfe779ad8a1e4d546c1a1650912e9fb0385430b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679235, "uuid": "5288c06d-89c8-42df-ab4c-37de5bb91d9f", "comment": "Malware payload (Cerberus)", "value": "bbeef6b27a5b7d5adaaee4bed87022f55fef45fb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630679235, "uuid": "c3c2bc6e-5671-45f5-b913-c33943961b86", "comment": "Malware payload (Cerberus)", "value": "394dab564473a8ad6b687d1c2cc8d1a380961f9f9fd48aac94e95c0fd01fe92f9443dcdb3f27881734b54a81239b7976", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679235, "uuid": "3f6ec7fc-e432-414d-b550-db481a903efa", "value": "T17B162266BF83C8B5C4C78D30E9069293A1194B4B0049F82F766584E53E7ADA05727EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679235, "uuid": "294401ca-8daf-424e-90ba-c21f24b3163f", "value": "98304:BuQxtvFx6XUQVEOEP5hS50qISG8NjPaF5WxBSi7ey:NFKQRnkD5PkBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630679235, "uuid": "f607f353-ec48-4ffc-a76c-2ffbc6e6e21f", "value": 4268003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630679235, "uuid": "fabae7f1-0a67-4e57-8bd3-8d5c4dc4c615", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630679235, "uuid": "44fa42da-489f-42cc-82ff-d708e05b77a4", "value": "Chrome628860.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a087e0-0cb1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1630671661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671661, "uuid": "018b1a8f-44f8-4288-a83c-cf5799489c86", "comment": "Malware payload (RaccoonStealer)", "value": "3cdd2a1bb998d92d1e35d42be577784e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671661, "uuid": "a78d09ca-4ce2-45d3-a6e6-defd1e61456c", "comment": "Malware payload (RaccoonStealer)", "value": "ffd862c979721d613c0001c1924ceac4690560cdbbc46551240c05bde5e025f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671661, "uuid": "1a9724ef-073d-4325-9f06-e0e4d3f7c6fa", "comment": "Malware payload (RaccoonStealer)", "value": "ca43c05a52321ec49b74a75dc7e20a2f9a543db4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1630671661, "uuid": "323f9fe4-b048-4eed-b148-3aab67c1d5fb", "comment": "Malware payload (RaccoonStealer)", "value": "afc2072b4e01924b1203284584161600221e4435127fa2c91fdae8173a04e26d4ffdc75dfda629bb449b6d7566508b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671661, "uuid": "e8c7b3c1-3353-4a14-adf7-947512d9eeab", "value": "T1F8A4F030AA50F033C492C9709865DFA52A3EFC6269504546BA75FF3F1E723E1A62235F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671661, "uuid": "b586b179-1a5e-4024-a269-177ff26fff89", "value": "ecda7b3fe7f3df133ca77cddd8e4064d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671661, "uuid": "a8893796-57aa-412f-8832-2902e5690663", "value": "12288:eVSQl4PBn9w/X8y8HfQrYtAusImrdCt7T:oiPx9iX8yl4AuWdCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1630671661, "uuid": "97a62898-c556-45a0-98bd-454b0c9c48d9", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1630671661, "uuid": "9eb91498-012b-45e1-9154-74707f511a1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1630671661, "uuid": "70447b84-2ba7-4c70-8635-f3f8c56c8ce6", "value": "3cdd2a1bb998d92d1e35d42be577784e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }