{ "Event": { "published": true, "date": "2023-03-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-03-27", "timestamp": 1679961781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "c5a30c6c-1e81-4561-9d12-b100753b6478", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5e02a3-ccb3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679930654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930654, "uuid": "a1e292e8-1ea6-4fc8-9dec-839da4d68bba", "comment": "Malware payload", "value": "882bc784202475c666b589b889b72037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930654, "uuid": "d19d5889-0614-4865-bcbf-a674ab4c85d0", "comment": "Malware payload", "value": "003c6607c3deee0f0c458c18220403e1eb2ae5469814756e551faf5bf3fc9f5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930654, "uuid": "d555d2db-4ef3-4a00-837e-0c18bc21cad6", "comment": "Malware payload", "value": "2a17b07e408d7f6e4c7ee5f7e833a199eeafe6dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930654, "uuid": "9faa8b07-bd08-4228-ae70-a52ffcdb7387", "comment": "Malware payload", "value": "9887fc6ce8d4d023bec2379febda0b75d01db8655b89a0c9ad550335fad8f878b068018cc2beea8fcf196ac6fb7295b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930654, "uuid": "0001ace6-88aa-4e01-ac92-5e8bb85faa9d", "value": "T12BF4131BE674A721C7A5C7F413E18A84E2BDF4F56766ED08AD8830E702F77208A57607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930654, "uuid": "4bb7bad3-31d3-461f-99e6-eeb3da59d22d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930654, "uuid": "b722c2c7-9e1f-41bb-a7dc-e1cf2a439c9a", "value": "12288:YkUJB0Oj1Si6Uxo6WM3ZYPVEWZU3LgLTM8VLOy5cT3l9mB3KaPvrBS3PTFJhZ:YNuiLxdW8YPVxUuTM8ZPcTIKrfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679930654, "uuid": "ca0de066-70f2-4624-9e3e-bca7c46e4342", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679930654, "uuid": "b393e3b0-fdf3-47a7-8405-289552a45b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930654, "uuid": "2a48117e-407a-4587-bf53-ef4e25ad17c0", "value": "Voyage Orders Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5421e59-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679928196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928196, "uuid": "0ed37d0d-f6d7-4455-8850-c5e966779664", "comment": "Malware payload (Rhadamanthys)", "value": "e6064fdee64cf67d083a2f1d16e6ad5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928196, "uuid": "c08d439f-1c5b-4e2e-8590-74bed72808fc", "comment": "Malware payload (Rhadamanthys)", "value": "0048ab300c6ed6ac61084c54c9d1dfab5338e54b9cfb5fb6a2a765bde03b2191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928196, "uuid": "efa924dd-28ea-46c0-8eb5-d3a413ceca6b", "comment": "Malware payload (Rhadamanthys)", "value": "281160e46c60f4f57c12facc0b2575571d7220fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928196, "uuid": "10406024-f9bb-4644-8ea7-dc33be104abe", "comment": "Malware payload (Rhadamanthys)", "value": "b40e7f27e9f7d947a75ebe0271193f5bc6ad1ffe8367f01d06f6196aab10da23e0628bab478b06b515824bcf873726c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928196, "uuid": "e3f9409e-7a65-43a6-bf07-cef6efc1181c", "value": "T1D964E0223791D072E46646754D26CBB55A3FB831ABA582CB3784173E0E317E2DB36386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928196, "uuid": "7b74dec0-2497-40cd-a491-4c20f83e1346", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928196, "uuid": "0f66c0a3-4377-4a4a-9bf8-c0634b1e970d", "value": "6144:DHo+Gf8DpLGCcgH+C/sQnPeO1Xbmg48Me0cn6MKk3Ckw8w:bUf8DpCF01XApc6M8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928196, "uuid": "89006da4-655a-493f-a9d5-f2a14d36c0d4", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928196, "uuid": "e15acda7-70e9-4e33-9976-0a367f454e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928196, "uuid": "69e836fd-09a6-4273-a897-3fa31b3104f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b953c60-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679927965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927965, "uuid": "4f7967e2-dd86-42d1-8db5-babfbd953a72", "comment": "Malware payload (RedLineStealer)", "value": "43b8c69cb7d4699a5a2d8f6248dd3267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927965, "uuid": "08a551ac-7537-4278-9ea1-8df34f509407", "comment": "Malware payload (RedLineStealer)", "value": "00e6233482a4f78cf82eda6358f0a3f32306810f3eecf25720cbb7a20c4e0c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927965, "uuid": "4824adcb-1640-4054-bf0a-d6d7613d03be", "comment": "Malware payload (RedLineStealer)", "value": "7ebd4ed6963a0ef7ee4ae242e68bc4b60c60bfbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927965, "uuid": "80532ab9-9fb3-471a-a019-d5b873de3a8c", "comment": "Malware payload (RedLineStealer)", "value": "bed55b8062524955a3fcf45f4ee3f24418c1ca3ea63d7a0ed2ac0fe893925292ea8931ea39b2d5ce236470aec62ea432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927965, "uuid": "260a34f3-bb67-42d0-b3c9-e3f4d871bd6d", "value": "T1A274E02273E1C072E9A205785661CAB0AE3FB8726B5646CB37805B3E0E317D1DB36752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927965, "uuid": "7f51e04d-024d-4177-985b-6e6e9ec351fc", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927965, "uuid": "ab0e5325-a6c3-46a2-833a-69c1100ffbda", "value": "6144:pj4zOSsTdLEO98/5bkvpZ00iZHVuLXgANfPoSjI3KDsGZ4X:BpPTdQ//a00CELXFYSjI2sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679927965, "uuid": "4edd8e4e-e62c-4de8-946e-bf2370cb3600", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679927965, "uuid": "a0a08d26-bf4b-4864-80dd-964b63eabc32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927965, "uuid": "7b91e79c-289f-4f36-94bd-d98968c82d71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5209d07-cce6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679952650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952650, "uuid": "f3dc5819-1eee-4a13-b534-4053888e0315", "comment": "Malware payload", "value": "9838d7b931ba280e94b401ed799e35f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952650, "uuid": "fc2e54c5-4037-4316-96f9-9d6991fac6b9", "comment": "Malware payload", "value": "0136319c6ea0ac8a0265c915e91731252b3e185433846300e858bf22570eff35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952650, "uuid": "d265c495-fd7b-499e-8a93-da7d25f8c865", "comment": "Malware payload", "value": "ae7d122c39e37ef24b9a1fd3fdf08fd002f8620e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952650, "uuid": "19e8f3ec-f1a3-45a7-8f41-983ab1ee9e29", "comment": "Malware payload", "value": "a0a02a7917b90438a7a66d3ba23c9525e8a4dfa0e8c69fbc7c9a0e458123a7dd4b55a4c3aab1b14ee5807859c2d58573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952650, "uuid": "47b6cf5b-58c0-4623-847d-beb1d8f29848", "value": "T171F533633C0DA225C8749879E846F1636B197DAA0EE44DB07BC8EBDFDD93071B406897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952650, "uuid": "4558bd13-d202-47d7-8141-3786e58866e9", "value": "36cdb963167b6b73999a5e7cb8300c9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952650, "uuid": "c3047386-a3e0-4c62-bc5c-6ab2fc87ed5f", "value": "98304:PUGbQl+tr2/LRPFiwwxBU0lxvCngfl1m4wgfT:2l+IN6ZvegDR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679952650, "uuid": "b27ef657-dd1e-4205-8ab0-a22f4bcc2981", "value": 3602832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679952650, "uuid": "a7d2bc8a-19b1-44f6-90f4-c55665fee7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952650, "uuid": "5631ac63-7d29-4d82-8522-b8e84d7c7c84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dff93da-cc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679909124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909124, "uuid": "7df43f12-3da4-408a-b6db-9aa40370cab2", "comment": "Malware payload (AgentTesla)", "value": "c5f03dfe714e81188bc7c6a681b48147", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909124, "uuid": "c8fde00b-0d71-402d-9bfa-1623c494cbf8", "comment": "Malware payload (AgentTesla)", "value": "016d1da2f0244ac3bbc392caace0d8ff5fd1870e6c627802d2e8b09c39e393a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909124, "uuid": "9543834a-5392-477d-a9b2-687d70c930c1", "comment": "Malware payload (AgentTesla)", "value": "3fa716a9f1781eb63de8987d0a176c840643c3f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909124, "uuid": "13456491-fe77-498a-b8d7-3860307e1892", "comment": "Malware payload (AgentTesla)", "value": "52de8cde8cffdd96c31db5c896489b61f48f1665e37e0b6303f876d53bd08ffcfda2ff31dcc4cd42518d646fe870af69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909124, "uuid": "e154eeba-db07-420a-a597-9e682441d0d3", "value": "T1B2F2605AE79F02B48B5102B3271E0AC99ABDB73D735555B178AC833433AC82D42766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909124, "uuid": "20e75222-598f-4c6f-af93-4687bb3a12c5", "value": "768:7Fx0XaIsnPRIa4fwJMJhpUMEuKNzE9apsX2RSbRqPqBhvb/d1:7f0Xvx3EM9zElNzDsNBtb/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679909124, "uuid": "0efe7503-cbc3-4595-8340-293d85581942", "value": 36314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679909124, "uuid": "bd8a54de-65f0-4044-bd4a-95f51f7b8719", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909124, "uuid": "bdff623c-0737-4011-909a-b3300cee5347", "value": "RFQ_ #QTN-20-971-JA04Q7.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bc607b-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894875, "uuid": "1e8a4038-d861-4931-a87c-a7f5ba768ba4", "comment": "Malware payload (Formbook)", "value": "98994d7606e0c9da417024c03c54b591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894875, "uuid": "efe0b541-a075-4a23-ad24-fabe5ec179e7", "comment": "Malware payload (Formbook)", "value": "01ab7eab84acdfbdf2f3addd8894d10cfc7993c11c7cfb3754fb649d9be86264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894875, "uuid": "8ca7c1e7-becd-4b43-9704-b022e8786c1b", "comment": "Malware payload (Formbook)", "value": "fa4e90845234e35c27fb5d1a2f61fd02d5c3d3f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894875, "uuid": "9a4e2c89-057e-4bf0-89d5-b7671c82e52c", "comment": "Malware payload (Formbook)", "value": "eefd5c6806fcb29c9b35c21c2f4505e6b0a9da9d6ea52cb55cf4a764d7625ce6df0a0376ba556ac1d874033bf06a6e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894875, "uuid": "638ea112-2f1c-4a60-93f4-d2af18b11690", "value": "T17404AE36DA42C071F2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894875, "uuid": "1d2ce87f-7011-4498-a8b6-d52f33319a5e", "value": "3072:2bX4kQvFJdO43t/c5scFV6hP/zSJRCUweMoeks3jG1ZlRRR:BU2tk5B6hP/MC9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894875, "uuid": "68fa1754-95c7-4d58-9c5f-c6fce131dca6", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894875, "uuid": "42b46d0c-e684-4ccc-b617-48f7a7f95595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894875, "uuid": "51b96128-fbf6-4469-a18a-6a39ed76d630", "value": "01ab7eab84acdfbdf2f3addd8894d10cfc7993c11c7cfb3754fb649d9be86264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9660c947-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904951, "uuid": "fef3343f-678a-4ea3-bb34-38f1f6857553", "comment": "Malware payload", "value": "b9ea19cd628fb117e279a585192bcda2", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904951, "uuid": "3116931b-0aa0-4b33-82b8-f9a587915c8f", "comment": "Malware payload", "value": "02872fb621e9880df88bcae080e81e243a6a655feeae38d7d22a552d345eb954", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904951, "uuid": "a3fcea6f-94f9-4fa7-bef4-98426110a2ad", "comment": "Malware payload", "value": "c5ac248e814dacb96862c8332114eda9c4f01347", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904951, "uuid": "e1d7c66a-7c13-4fc6-a586-118fe3a97936", "comment": "Malware payload", "value": "9b7fae3a42853868b3e10b563f088b803c76636a68575a131ffc61acfa6ad2091671152b86a9b0ffa7ae5818659400b5", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904951, "uuid": "9e9df2f3-07d9-4195-b92a-5fc4905486fa", "value": "T12B11CC1B392EDA1A433FD7F440B1500CD546D4906208FA2823A0F54FA21D9710F8228E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904951, "uuid": "7725c5e5-461e-4e5e-b623-1e9f16750c4e", "value": "24:kAx2kGRV56PnMK/sd4/7Sw/6LKu5K/3n4/rh/6XMCG:kuqr56vM/GSvLVcikcCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904951, "uuid": "37dd837f-419d-4e0c-be9e-c764858fa213", "value": 861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904951, "uuid": "d4224387-7ff0-447e-ba4c-5cffbef345d9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904951, "uuid": "a5ecfe4c-7806-433e-9124-5fd6be148106", "value": "document(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6197042-cce5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679952276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952276, "uuid": "65324ba9-35e6-4ea3-9be9-57f34c22c5aa", "comment": "Malware payload (GCleaner)", "value": "5b8cad8745bc9ecb60119026d233bc10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952276, "uuid": "50794d2a-34a4-4c42-b707-c8f5821bb2dd", "comment": "Malware payload (GCleaner)", "value": "03803dc71c996ce8a0dc7fb6aff2fd8f7623d803e3740eb38de13208ddcfbde7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952276, "uuid": "afca31d2-98fe-40d8-93f0-d4cf2b118424", "comment": "Malware payload (GCleaner)", "value": "52753d7a2ea01ee3f7f5d81600d60d5a6441a862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952276, "uuid": "2974d8d1-ed30-4763-8de4-fa116c7a56b3", "comment": "Malware payload (GCleaner)", "value": "44db3e7226c7db49fe00896cd0c0c1eaa7e043031a22128a1affafcdd2c5bc74a9770f7d625015bfc1ec5431b478d330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952276, "uuid": "bb2f30a2-22af-406a-b437-129466f6fabd", "value": "T19D853386D1AB84F0D7A387389CB58EB6DF1EF64A1C7E2059730F1AAC43260C469D5B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952276, "uuid": "5cea5e05-44a5-4187-acbd-abbea88f782f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952276, "uuid": "26da884e-5390-494c-b735-6c26995d8683", "value": "49152:EGlJfsBSf+lyU0HPU1fFIUDFLKMSGWXxyyxg8rN9l2SJEG5dlLYp:5kOUUefFbZ9SGWV3ZfJEMPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679952276, "uuid": "6849c2fb-9e86-484b-9b71-145f7199be3e", "value": 1862826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679952276, "uuid": "f443b8dd-b7f7-4212-b6c7-d844a58f997a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952276, "uuid": "f2c428ed-ea30-4718-af13-15da501a5e7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb11f1-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912342, "uuid": "324f8b76-03e0-4522-9f80-75dba6f12675", "comment": "Malware payload (SnakeKeylogger)", "value": "f690d5bc6a912808ec7c3cde8a7f88c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912342, "uuid": "83d150bb-ef29-415f-b9a0-eae5e08c7040", "comment": "Malware payload (SnakeKeylogger)", "value": "03a2024571a99c0e24be3ab024a9869b41d0e60e52db34d5bab311cb4782c7b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912342, "uuid": "1f7fe2a2-8c01-4b8c-a1c9-049293d18002", "comment": "Malware payload (SnakeKeylogger)", "value": "4342133a94b3dab0fe87eeb9b5024183588134d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912342, "uuid": "5ddf9266-1e9f-45d3-9c73-16dedce04c25", "comment": "Malware payload (SnakeKeylogger)", "value": "51de83e5db9c52c3631451465a9a2dabcff88001da2e36851e2adddd1904eb2800f5912c4d208e3d42da03d9c10414a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912342, "uuid": "401020fe-6308-4bb9-a673-034fe721e623", "value": "T19C15BE8977B86073F5CF01EE5C38278C2D2066577509E26E9B77BB91A270AFB72D8101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912342, "uuid": "d3809ee1-a4ca-44b7-a1fd-aaf6fe9a5c7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912342, "uuid": "09ec5ea0-97dc-42a9-97b8-c6992d41edbe", "value": "24576:1ky9IISOJ+HlvTrE9TLzhYczfeTIO0JEvp:QC/DrAlsEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912342, "uuid": "2bdc3ae8-adfa-47df-b5f8-0699b137d9f7", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912342, "uuid": "2f33fd37-b179-4f72-a7ec-0d2b12b8703f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912342, "uuid": "7156b216-e7dd-4b5a-9ae0-34fbb31faa9a", "value": "f690d5bc6a912808ec7c3cde8a7f88c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c780a4-cca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (STRRAT)", "timestamp": 1679923264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923264, "uuid": "eb4aac95-e539-41b5-8c60-c09dcbec15e5", "comment": "Malware payload (STRRAT)", "value": "b63df0e1517233d0d5d60e5375b774b2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923264, "uuid": "b212c731-951d-4cdf-9a97-fcb3140fc186", "comment": "Malware payload (STRRAT)", "value": "0431faeccbeca99b242fe5d8464ad5fcc7a24a853df8424d9c49951911e4fdab", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923264, "uuid": "b9b23867-d16e-4524-af3c-31f524b7ded2", "comment": "Malware payload (STRRAT)", "value": "063aedab9fa8b4ef44dd8ca8f08e00496e21546a", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923264, "uuid": "d18719a0-a636-4196-b03d-e2088823b9f2", "comment": "Malware payload (STRRAT)", "value": "16a1f5e8ef466f433db5f88853c12be2a86ba1a103fb3ae0a1324b79b8d7406b6885920c06f9aa3b7c8f93c57c680cdd", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923264, "uuid": "d86cc566-db03-49fe-a08f-3944c9ac2a07", "value": "T1712402BFBC8ED1FAE41B2131506DD12AEF0D5699D506A43B86FD85280C70C4E174AAEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923264, "uuid": "43c0dd5d-7acd-42e9-97a3-83e7d2ff4fea", "value": "6144:SZuvXdGeqfj20asN+YfalfNZCDtKJdtoe:YuvtfqfpxNhfQNMIbie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923264, "uuid": "f8c69595-dcea-451c-af43-fdf368baff4d", "value": 225608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923264, "uuid": "ce1c90d5-44be-4c47-8b26-51374c966946", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923264, "uuid": "a693f1da-691c-4211-86e4-05e5ff249710", "value": "UNILEVER PURCHASE ORDER #076863 for acknowledgement.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853aaace-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904922, "uuid": "6d81ecdc-9cab-44ff-9854-480073b9d607", "comment": "Malware payload", "value": "c10889aeffb8f2aa8f73e96b08f2fc3a", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904922, "uuid": "8369f3ce-1f28-42d0-847c-1d273d378a20", "comment": "Malware payload", "value": "0487ef401345aa17c6aaeac23151219863e1363f82fe76edd0066bbf3fb07715", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904922, "uuid": "facd5bed-eb9f-4610-922f-8e599da38230", "comment": "Malware payload", "value": "249ae696a443f72b6546f0ff73ec0592fe128e4d", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904922, "uuid": "7a0d8e31-8c75-4d15-9425-2eb81bbf647b", "comment": "Malware payload", "value": "5d1538398bf50a9bd3186861135bd6e7fadc9b974dc0c957a6028bf8459d45dec652714e90979245e8e7744b3436e166", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904922, "uuid": "5cda9259-18ca-48b3-bc2f-160d253f27da", "value": "T14C743298B8459289F01A76D6E4C3BCD951103B9F7DCFDC8B01618AB721BC69C6F894CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904922, "uuid": "992e70b4-20f1-49ba-ae17-f95f3e59add6", "value": "1536:yPEW7dR0nY/WE7o89PiPoKCTRsJhLYhHGlJeW7Elu/vRHl6w:PI3ZiFlJeWwlOH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904922, "uuid": "a0bdc47d-bcee-49a4-964f-d367d3cd2dbb", "value": 355773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904922, "uuid": "6f947bdf-e00e-416b-86a7-dcd8f346a53e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904922, "uuid": "a25495e9-79e2-47a0-a2f9-d667e91eb7af", "value": "note (2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c9d9cc-cce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679953270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953270, "uuid": "d77a5852-16f3-44dd-8f73-33e3d38faad2", "comment": "Malware payload (RedLineStealer)", "value": "87b3b41f6995b1084ef90a5aaf09877a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953270, "uuid": "1e294d9f-97ed-493b-a7e9-a65d614f819d", "comment": "Malware payload (RedLineStealer)", "value": "0494fa919445dde14089ec1df4683fed61b2c0bec370ae99c33250e5a7814293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953270, "uuid": "20215556-ebf2-4f15-99e7-f3b67eae2a5a", "comment": "Malware payload (RedLineStealer)", "value": "709fd8289f3f9eb893648e0d09bc9878c0b3c73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953270, "uuid": "3706cee1-4b38-4b1f-a058-9672343f1e68", "comment": "Malware payload (RedLineStealer)", "value": "504bf654c4c70767f4773ecd6d2de4008663b88598a876f9cd6775321e560cb6f91b08ea22e5005a09ee1c1cd9c9cbe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953270, "uuid": "3936c489-17d1-4f47-b3b1-0915cea5b81c", "value": "T1E0352353BAFC8573D8BC0B3018F51387173ABC91A97CD29AB781B9171D22685687633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953270, "uuid": "afceafbe-4a16-4595-8b51-d968fe1b9af5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953270, "uuid": "75f39b20-d45c-4a2b-8d0f-8a5d31449d8e", "value": "24576:YyCvCcAqrvDEPN0logVJzO1ICMPY9qIV:fCvDEPNKRa1I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679953270, "uuid": "14bee2f2-eb2b-44b7-9f63-aff37a069d17", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679953270, "uuid": "3e0c5c38-565f-40f4-a012-ce6f25a30aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953270, "uuid": "ce3c5d0e-dd59-4ba9-a598-d0e6f8ee61ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0429acaa-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679903417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903417, "uuid": "ab8ec07a-c320-4752-8bf5-060fa5d3b4b7", "comment": "Malware payload (Formbook)", "value": "9cf9b2689e9cf1828198509df38ed707", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903417, "uuid": "097974c3-d420-4d13-a39f-694e812a2eaf", "comment": "Malware payload (Formbook)", "value": "04a5e2c14d7f9d46c5eac57ea70040bbe1e4215205b6f616b125463c3bb7a466", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903417, "uuid": "3d1105a6-56a3-44d9-8611-b3e4d92580ef", "comment": "Malware payload (Formbook)", "value": "cd3687a2aed2c33ac8194d18fdd9ec31f854a59a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903417, "uuid": "ae798d99-3ef7-44d5-8187-e55912bb74da", "comment": "Malware payload (Formbook)", "value": "60a666eaa6776cb9af5c0db3bfb357bfc379684ab42532a0b8e01391c61ba473eab64d46d2537b9e00e28a387230bab6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903417, "uuid": "d14ed995-73fa-4773-8099-bb058c8d10dd", "value": "T16DD2815AE79E0275CB510273661E1AC9A7BDB33E735051A234AC933433AD83E42766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903417, "uuid": "7630ef40-d607-4cc6-88ef-409aafe40f50", "value": "768:BFx0XaIsnPRIa4fwJMXDICAhPjIJot1LnHWuTES:Bf0Xvx3EMzIh1jIOLbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903417, "uuid": "6fb799f4-6868-460d-a9cf-100c3780469f", "value": 30641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903417, "uuid": "a8afde40-0bdd-47cd-a380-90414284f951", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903417, "uuid": "d817c7b7-f263-4e3b-a240-b823a3c8ea7e", "value": "Mar23.SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e5fa30-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894904, "uuid": "397f254f-a9ec-4786-a5a7-5ab1e0723b69", "comment": "Malware payload (AgentTesla)", "value": "71619a2229c053ddb34ee5df6222d6aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894904, "uuid": "9446fc82-91b5-4efc-9867-d75d57a45bae", "comment": "Malware payload (AgentTesla)", "value": "04b3ebdb8ef471ed1baaa10c91e0654037120a0642d10aad6934f52a03cf3410", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894904, "uuid": "d85886df-6697-4ed4-ac8b-fb9e249dfd1d", "comment": "Malware payload (AgentTesla)", "value": "348f88b82e07f64740090f5357b0da891f05a583", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894904, "uuid": "0ab0dd96-9c89-4296-a31a-7cca54145493", "comment": "Malware payload (AgentTesla)", "value": "7cf2d62f2ee4145d428fb04dd2dc4785a187df5c0cf0fb5baac08e8b9b162238f12ef989cb28905e51f9407a1826b01e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894904, "uuid": "7bdb1f72-54f8-44b4-9c9a-45eb83fe1b2a", "value": "T102A4E0127719D903E25111709662E3BD1BB87F682D5A8B02B6F0BDAF3579B13EC1E780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894904, "uuid": "fe91e226-1524-4315-bfcb-c4faaf25384d", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894904, "uuid": "fc9f5778-9776-4508-87bc-a2214019db69", "value": "6144:AbUTp1kKX7AB/N0A6Sg46c0Gnh7C8t4eWnC1ow3Sz4phjLwJxJkDiKutgx57zcSl:AIFEzDgjr8t4eTTuCKJkDXxlck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894904, "uuid": "0cd396ef-c7b0-48da-9369-eb058a363a7d", "value": 471584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894904, "uuid": "29feafaa-31f7-4a2a-9c54-745ee64e31e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894904, "uuid": "7d2b6d1b-3a39-42cf-b72e-c8d7b8a3ba06", "value": "Drexel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5218d79-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679880978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880978, "uuid": "cb2a60b3-2dae-4ffe-89aa-0385b2050a21", "comment": "Malware payload (Rhadamanthys)", "value": "a4d21622c0da489bc13023d6559d3bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880978, "uuid": "1ed1e043-be9d-40a8-b88e-5e1fccae38ca", "comment": "Malware payload (Rhadamanthys)", "value": "04f659ce2e0df26afc54971fbae56b4e45f0138cced5210807b4410ab638676c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880978, "uuid": "053d8ef2-5371-48b8-9b44-544699f1c84b", "comment": "Malware payload (Rhadamanthys)", "value": "b19004da7f04b4057c34003f9167e893480df411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880978, "uuid": "aa19bb2d-d1ea-4c78-aed4-3b1c80a28b1b", "comment": "Malware payload (Rhadamanthys)", "value": "6041f9d68a7330c3f59f5fbc0f2a5acb486b88ecca2f4cac48ddc4fa7df09cad37babc420e1b5d5bd61fdecca1e14f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880978, "uuid": "9f8a17b4-144e-4f99-806b-df2ebe159d80", "value": "T18C547D0253E26860E72787328E2AC7F82E2EF8615E157FFE12559A3F2971F72C152705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880978, "uuid": "1ae12fd2-55ee-4922-8327-d160eac5c1ff", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880978, "uuid": "1fecaf5f-7a60-437c-bbfd-32323ca99ef4", "value": "3072:1i9CzcZ/Smq9IVueoF8GtpBuk79Co7oGuaaca5eMVitMz4Wfr+ke3xapKCJQN0f1:HQZoFxtzuk743bjxYiz4kUxCVTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880978, "uuid": "eebed9dc-749a-438e-8341-f4b414809c21", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880978, "uuid": "d6f29a52-35e1-4071-913e-ffa964dbcb95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880978, "uuid": "d6f4c88a-0f40-4fd7-981f-3a1aa7731e51", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f2b63b-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (EternityStealer)", "timestamp": 1679913268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913268, "uuid": "a441b328-cbcb-4a71-b6c3-dedc8574f6eb", "comment": "Malware payload (EternityStealer)", "value": "4c81e4497a420aea61e717fc94e0ad86", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913268, "uuid": "d08060cc-15bd-4166-92be-b5ba99d5f37c", "comment": "Malware payload (EternityStealer)", "value": "069ed36bdd5046201359415dab896f99f2e5adb89eb54c2e652786e0ccd79330", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913268, "uuid": "f6039912-eda0-4e6f-b6f2-24577536367a", "comment": "Malware payload (EternityStealer)", "value": "b8cf42124816876a6f5286af46202705d2e61189", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913268, "uuid": "801fb95e-83e5-4cbe-8ab0-8fd8a2a0ef42", "comment": "Malware payload (EternityStealer)", "value": "350893dce36c15a80bf989d0eeb7db4d964401f26bd9b002a3a1bd21af2a4ad27000e69821d243a29f625e0fd1167d3d", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913268, "uuid": "adc97343-7213-494d-93fa-bf94e9c76ecd", "value": "T15DB5023881A6FF53F028783EA4E5F51140D4A764170AB92CB6C56F1CFAA7BD95F12322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913268, "uuid": "50693ddd-c91d-4c02-8401-e6f9f4201f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913268, "uuid": "05ebbebf-9916-4ee1-acfa-e21b9575da1a", "value": "24576:ybKtGyBB9iuK++moKnfNIGQaK83uHU/uYfo11qis3s4b+6GIAANEN2tXL6Y3TEcZ:My1iuD+moCQZhHUWYfo11q33dRGyRt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913268, "uuid": "5d739988-c870-47c2-81ac-82beac9f84ad", "value": 2478080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913268, "uuid": "d9562f64-ff67-4231-9330-0d09b11086fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913268, "uuid": "bab2dfd6-7114-4fb3-85c8-75699df6f727", "value": "4c81e4497a420aea61e717fc94e0ad86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95d5a7d-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679912741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912741, "uuid": "ddaed2fd-bb78-4537-b9f3-ea3cf8f02312", "comment": "Malware payload", "value": "2d3ba8087e4e57ab7457217d30518a50", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912741, "uuid": "c2f307ac-e26c-4276-8064-57b79bf8384d", "comment": "Malware payload", "value": "074b485c19f455a2534ddf4ea9ef076b8f7f2988b8353393f8a5fb6ee7d9566a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912741, "uuid": "6e66733f-5fcc-45b9-a3d0-be7de5e68444", "comment": "Malware payload", "value": "e1c3854373f4d213b788071529452940806dbb87", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912741, "uuid": "be2fcddb-490d-4aa7-801f-c238c06e9bc2", "comment": "Malware payload", "value": "e921e48863ac41194a8fab505dcf5f3f0ebfcda850aca4ad80d5ce670950eed9f072eead8fc61ccc2df2344a630be1c1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912741, "uuid": "3676f5f3-55f7-4df6-bc4d-19ce11c8e443", "value": "T140350213F9C58D46D48247F96AE378D5131EBC626BD6A2C72344B70F6F786E08A4710E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912741, "uuid": "d37df682-57b7-4374-b0f9-57e8c56fcb1e", "value": "24576:tLKHWQmmav30xN+MXUu9u4Y+MXUu9U3bVX+MXUu9N3bVw1jpYpCnIn3q:tLK2QmmQ303+MXV9C+MXV9U3bVX+MXVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912741, "uuid": "77fececa-b514-4144-9c18-e848795d7113", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912741, "uuid": "2bbd02d0-0aac-446f-b8be-22b9c867bd7f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912741, "uuid": "2c5d0d53-151a-4097-a28f-30829f466142", "value": "DRAFT SHIPPING DOCUMENTS(1).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ef9d76-cc90-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1679915721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915721, "uuid": "477a10b8-09c2-4387-97c1-ca7970e5398d", "comment": "Malware payload (ModiLoader)", "value": "9f877247d908c1b925bde681ba3e23bb", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915721, "uuid": "d0efb360-a45e-4296-982f-9b59bab3f236", "comment": "Malware payload (ModiLoader)", "value": "07e3054ea7b32bc1b3dc65e7805364fdbfa2a4bb4438c6b531bb8a39a4e929ad", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915721, "uuid": "fae7a4db-c448-404e-a0ad-358dd4f869e4", "comment": "Malware payload (ModiLoader)", "value": "84fa6b3e11d7766bc5f0d887e2614104e3744fa0", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915721, "uuid": "754da381-041a-4301-be8c-d744602d205f", "comment": "Malware payload (ModiLoader)", "value": "ccb6f90dea10e931aaf1a7cc748eb51fafe16d342df42bed6e7b40d8e1e6efed8987376dac56eb49578c165e79bec35f", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915721, "uuid": "40105ce2-0858-46ed-9ea7-6faa41deb6fb", "value": "T1BD9423E8B95E9ED76C7202A59C7841E91760116162D6A468B3FF898096307F3DF2CEC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915721, "uuid": "0510484b-4e89-4f37-b4ef-812e444d6d3b", "value": "12288:M7j+Gl8CHn8BmPkqrZGwjggaSJFPks1aR:c8yn8Bmsq8WhER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915721, "uuid": "2ec31de9-2e08-46fb-a9f2-d6356d6eee4d", "value": 408397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915721, "uuid": "ab58c787-5bfc-4159-8fd4-3f14a6d42a2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915721, "uuid": "f28b1a1d-5721-4cc8-90a7-28082ddbfaec", "value": "0625413424416272_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8414c5-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904936, "uuid": "da3348af-03ef-432c-8981-22561feaf141", "comment": "Malware payload", "value": "367dd37da79d7214aea7883e0df4861e", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904936, "uuid": "d2166f50-d2f8-4387-a5df-8291728490c5", "comment": "Malware payload", "value": "07ee578cc44ad0ee4555ea70b46927a4570f3ae35172a4990af3e406f507f91f", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904936, "uuid": "99651ceb-3e24-4af5-9cef-eca7b6fa3aac", "comment": "Malware payload", "value": "1468a5ab2ed73ccb5c63315f06b02481149ac9b7", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904936, "uuid": "69a88ffa-d3d3-4608-a5c4-e9f129ca10cb", "comment": "Malware payload", "value": "495b16f61a1860fdac13939a800baeb3ce1b047d4771df43bacc8b6d1cc962530fe27fe64ef073146c94b947ca98cab8", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904936, "uuid": "3196015a-f8d4-4eb6-a83a-688fe33acc73", "value": "T14A31229219331E72357F02C9530E7CCB36349A2988E785E62CD4BE7474A63011ADFC2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904936, "uuid": "6ba7ff7e-e680-40b4-9fff-ed38147afa29", "value": "24:+RAAIWeitkPJfbOAZjp9OmVf7KW+jKyVs0VlbTZkSgPdYibBYXUMluWoYiq:upztkBfNZrOkf7NFy7kJmrXzR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904936, "uuid": "b396797a-c2e7-420e-8dd0-bf5e77b75930", "value": 1875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904936, "uuid": "ec28cee6-e32a-46fe-847b-2e10551e9790", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904936, "uuid": "8dcfba21-f570-448e-9786-b1f747b2176a", "value": "a(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38463d60-cc41-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679881600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881600, "uuid": "7f67fbf7-28d8-4cb4-b1ce-160350888e65", "comment": "Malware payload (njrat)", "value": "ae8c8f4af61359d2aa17115f5b446a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881600, "uuid": "424fa7b5-51e0-4389-af5d-f1daeb651f0e", "comment": "Malware payload (njrat)", "value": "07fa425039403fb7a4b08dc8511d2fdc41efa0248fd04bca026f97e91978a6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881600, "uuid": "e78e4db6-ed59-4668-b9c8-23d9aeb7dbe8", "comment": "Malware payload (njrat)", "value": "9c29f1dda42fc815a9290cc20aaf7c1b9055012e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881600, "uuid": "00e6e5fc-c85a-4886-86a2-b1605c88939f", "comment": "Malware payload (njrat)", "value": "fe7aff6491ddd371e6477aadc7fa453f30dd82d50d7438250b3c3b8fed97d5e384ee421fc3aa96e520eee052f215629d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881600, "uuid": "6ed6e96b-6af1-42e9-bb8a-23c08c966003", "value": "T181032B4D7FE18568C5FD057706B2D41207BAE00F6E23D90E8EF264AA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881600, "uuid": "a2c8a093-e9bc-46bb-b8bf-3b7340100c48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881600, "uuid": "bde61b14-97a0-4bfd-a284-fa56f1293ed7", "value": "384:M2WeZ5j6icTri5Z7JAyk/Q4AfbHZeaoNmrAF+rMRTyN/0L+EcoinblneHQM3epzT:Ge3HJ7k/Q4AzZro4rM+rMRa8NuwSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679881600, "uuid": "cb95cb1c-ef6d-49c4-b2dc-83c877d947da", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679881600, "uuid": "2e20315c-d4bc-4d22-8727-ae486234aa2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881600, "uuid": "f578195c-5993-4c14-a4f3-08421598dc38", "value": "celeka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69351ac6-cc87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babadeda)", "timestamp": 1679911747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911747, "uuid": "7241254c-6a8a-49e9-90ce-1c1d7958ae80", "comment": "Malware payload (Babadeda)", "value": "2e796fd4f40f597199ae66b5c5e12478", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911747, "uuid": "5bb00cab-690d-4fda-afa8-b1adf7f50f2a", "comment": "Malware payload (Babadeda)", "value": "08b093dc7c7b7f3b4bb86e0824d23adc88cf89c67836f1a717e12da5f7422573", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911747, "uuid": "a5775a37-6333-4259-8756-1e66f640db63", "comment": "Malware payload (Babadeda)", "value": "39546d3019a853586d7f6cf7b381275b74155c04", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911747, "uuid": "393a6b59-a176-4ac4-a093-eb3bc4b61763", "comment": "Malware payload (Babadeda)", "value": "f20425d1fffd69be5c81d3fbd977180009afa68e655c911831ed68fd754dfeadb74c838b33899b60c79ef1694e1e6c89", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911747, "uuid": "cf25939a-67f1-4081-a597-0fd52758bd79", "value": "T18485A7D80F6C4C96F182FC763675C2229D3948C9864A607ACD195E2BE1BBCECE0C7D65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911747, "uuid": "a28d9b18-3fd8-4b49-b7b3-81ff33da31b8", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911747, "uuid": "bfbf3e5c-1490-45c0-9b98-f64aba4468f3", "value": "12288:loSWNTd7Yo1VFnA4r5rraOVokssOcnh2tbbLqhS8aKq:loS2Tdko1V6u5rraOVouOcn4tbbR8a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679911747, "uuid": "dc01afe5-d16e-40cc-bf6c-dbdcc86e50a7", "value": 1756160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679911747, "uuid": "7eeb4bd6-8ed8-4226-8215-074beff816e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911747, "uuid": "4e1c44b9-3b13-48de-adc1-3bf082607adc", "value": "HURR-DURR 1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de247677-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679881020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881020, "uuid": "97338a2e-b63e-4e32-809a-172ab482a00e", "comment": "Malware payload (Smoke Loader)", "value": "6fd8eefe394a44ec3e32294dca17b58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881020, "uuid": "f2666ae4-87e5-478a-bd03-3cc954066d1b", "comment": "Malware payload (Smoke Loader)", "value": "0abfa054de14518b7f5538ea5052448548a5758ee3dc648124feb53dde49dfd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881020, "uuid": "a12854a5-bb10-4c12-a732-4ed46a349a5c", "comment": "Malware payload (Smoke Loader)", "value": "2f05ad7e05c99576bb47af4eba72a59a22d0a2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881020, "uuid": "7fd38c55-8062-4977-9211-10e9fabea94f", "comment": "Malware payload (Smoke Loader)", "value": "91e4ab5e833d7a691692c9783a0a8d98908928a46342b3873d5f4342ef5dd22d1886a9b834e899b052c369cf81757dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881020, "uuid": "bacd30c4-2cce-42b6-bf1a-98ac9a8dfd02", "value": "T102545C0253E26820E72387328E2EC7F82E2EF8615E156BFE16559E3F1971F72D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881020, "uuid": "43cbe915-059a-4156-99fc-ed60916c13c0", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881020, "uuid": "9badf4d3-4394-4585-be0e-c4d1f28ab865", "value": "3072:tSLTz8rL5hv9uDOCXlXrwGFHmio9CQ78PlRiQEy+UzVYKpN87jRjM/XZFcDsCJQO:Y9BlXrNFGio9Ud0QLVN83FMBFcfTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679881020, "uuid": "ed77334c-37b8-4022-8707-847c97197188", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679881020, "uuid": "c62aad18-2514-4552-aead-213e5de8d401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881020, "uuid": "d83d41df-474b-4635-9dcf-c118ef165ff0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4effdaf9-ccaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679926736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926736, "uuid": "7e54cfd6-ea26-4844-a297-0bd8a1fb211a", "comment": "Malware payload (Smoke Loader)", "value": "d114d458c6c4e36ec866be333027110a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926736, "uuid": "65666c90-1fb5-4347-821c-90f629f17ba4", "comment": "Malware payload (Smoke Loader)", "value": "0b2760e66b0860dec87a83211ad1475ccac91ad20f1ee528f09d467b99079049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926736, "uuid": "9dce5b11-a407-4a96-a425-f60325a65dab", "comment": "Malware payload (Smoke Loader)", "value": "950c6e1301afaefbcf1913ef856f39de4f42335c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926736, "uuid": "f180babe-70f9-4528-93fb-06809d0d68c8", "comment": "Malware payload (Smoke Loader)", "value": "f06d0cd4d177640c61e6ff8e009eb7ad93f94ddbe3a21791a3de64b5c02df0885b90ff2c48b11c111650e60207747706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926736, "uuid": "56f797e7-2082-454e-a96c-8d8ee5145efd", "value": "T1AF44D02236A1C432E65701718861C7B96A7F7C300B6686F77784573D1E327E2EB7AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926736, "uuid": "8ac6a942-190a-4706-9d1d-917078bdc7cb", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926736, "uuid": "d9c80a63-6138-43a0-bb4b-b8ca63519039", "value": "6144:37qMKmkzLj/dohNFNeHFiGUw6oHOCTUnQWQENL:rUmkzf/SbFkl7jAHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679926736, "uuid": "d30281ee-5dca-4080-a03c-e6fa0e6d3664", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679926736, "uuid": "ffdbe0a7-5584-49fc-9da5-d0833fe1348e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926736, "uuid": "fb3a7fc0-382c-4133-8272-c8408a5ecd98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc16362-cc8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679913634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913634, "uuid": "42548d67-504b-4c26-9a20-3f57032f7ad1", "comment": "Malware payload (RedLineStealer)", "value": "3feea1219e640e1215f708cb4aaef21e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913634, "uuid": "9dc7ed1b-da70-4f3a-b584-c248e9cca743", "comment": "Malware payload (RedLineStealer)", "value": "0bee8c6c071a4c7301b26123a1544fbedd43ea2f0fe169200f53ce67d9e0ea06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913634, "uuid": "70477bdb-88c5-4735-aa70-853c55a86189", "comment": "Malware payload (RedLineStealer)", "value": "1dcc3b09a4fc1fea81ce8d07e9d705b7abee65ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913634, "uuid": "6d671ea7-9537-4496-b764-e2062525beff", "comment": "Malware payload (RedLineStealer)", "value": "40dd34355ddd3d14d762f1a29333675d413b3f3ba9b05a96ae3206548ecc4ac16ab983a3847908ce8396b6a125075ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913634, "uuid": "4009f54d-6cf3-4f41-b2e9-a31c60b39027", "value": "T112E41256ABE940A2EC71177028FA03D30F397CF28CB44529275AD49E09F29E4B97177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913634, "uuid": "981e8a5e-23dc-4c51-8a94-61377b3aa4be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913634, "uuid": "70cf20cf-85e3-40e4-b5ec-3861c749e093", "value": "12288:RMrIy90YvFSm7E53zRBX3Xx2FDM+8xdVefc91sOCBeVRGS0twUyRddNRTQ:5yLNz7+BHXxn+89ZfrC4zGhsdxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913634, "uuid": "1dac3fef-b10e-40b8-9984-82479279fce7", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913634, "uuid": "58db5b2b-a2a3-40d0-81ef-530b09e00fd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913634, "uuid": "82bb97de-89c8-45fc-93b4-853a08de1dd4", "value": "3feea1219e640e1215f708cb4aaef21e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17840939-cc3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878539, "uuid": "1b5d62b6-b4d0-4f24-9505-a6fa4dcc9981", "comment": "Malware payload (Smoke Loader)", "value": "7158138f565b2f4c245109a289f8c0eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878539, "uuid": "2cb5ba63-747d-42e2-944e-305372b10e28", "comment": "Malware payload (Smoke Loader)", "value": "0d578df9802a7f7ee69039e91b889aa71b53925f74ff7255522cbc4a518f10a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878539, "uuid": "5acdef35-14dd-455e-8ce3-7e036dac11c1", "comment": "Malware payload (Smoke Loader)", "value": "4a4de2a8a961d49eda153d6ff1dbc82ff92041b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878539, "uuid": "b801fecb-61b9-45c5-8a4c-6aa1934a6957", "comment": "Malware payload (Smoke Loader)", "value": "93c237fa09caeb6504c95cb1af03a15731b41077ea245e844b5c524d9fb1b89c6a82c849066751ae4c3001ac17d6af9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878539, "uuid": "7ef33bc3-26e6-4d8e-b947-e45bcf084a8a", "value": "T155549E2E93F4A870E1734732BE1EC7F46A1FB8615D577B6E2648AA3F0930661DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878539, "uuid": "cc59b05d-f3e5-4c7c-9b95-5a3a871a2c0b", "value": "87d886eda68b09da2d904f9205843127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878539, "uuid": "d06f5bc8-d1be-4cb5-ba53-afacbb098ce7", "value": "3072:5UESzoY6rGN17n72kGGLgRdrRNXypDHBlkPxrhzFXQWyn78Ug:0vLvz72JHRpyxHYdhz1QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878539, "uuid": "426aa32b-2a38-438c-8571-8ee47352496c", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878539, "uuid": "1a860420-4626-4712-a269-e3d5243e92dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878539, "uuid": "e59ff7a1-0a34-40ab-8708-c674e2091b2b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919735c2-cc3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679879173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879173, "uuid": "7254b826-2906-4039-b2c3-f14c7dcf9d3d", "comment": "Malware payload (TeamBot)", "value": "a1c240e28cf9828fe5adc68119a57fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879173, "uuid": "7fdfcea3-cec6-4cc5-a18b-a16a5e808d3d", "comment": "Malware payload (TeamBot)", "value": "0e48989c3c279086632f0bfb9fe7e49eee62ac6b8222d210828f2d1b42f22541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879173, "uuid": "05c619e8-5cd3-4d75-b658-d3c58dc9dac3", "comment": "Malware payload (TeamBot)", "value": "0afbabe69316a1b24c1fc374e58247b14a821cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879173, "uuid": "040197b4-6bb6-46a4-848d-6b22e04b8067", "comment": "Malware payload (TeamBot)", "value": "4df2fd91c9558dc92146ddd29adf56f0f8ef3699d76bbfa818165efa74a0ebff4ad99c98988a3a83ed27332cffc8e5e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879173, "uuid": "15d8518d-c421-4f20-8200-9d8dd2cbc022", "value": "T1D8546B3252F06860E562DB338E2BC7FC2A2FB9619E157B7E13555A7F09702A2C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879173, "uuid": "a417a2c3-749f-47cc-91b7-019afda0e475", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879173, "uuid": "872777a1-b963-45e2-a9dc-b180b3df0621", "value": "3072:93lo2E9NTud8WxIYW0ukE0bZE2eU80ZRP7DYmfwf0Uo95FvhdFjIvP/7xpNN4TJY:ihXW+YWUg0ZRDDYmfHL1lIX/7jNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879173, "uuid": "8c9e029c-229d-4dab-8967-24dd44a587a2", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879173, "uuid": "25c03035-e2d0-497a-b8e5-fda8d3e7b061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879173, "uuid": "e31576c5-da34-48d5-b50b-9bfd5300398f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5844a989-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679913007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913007, "uuid": "238f7267-06b8-4d15-ab12-3dbea5a8c6f7", "comment": "Malware payload", "value": "667281a465949ffc9ec5f1f5a51ee7df", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913007, "uuid": "1f3fe986-f8d3-4477-b12b-d2b48c433aa0", "comment": "Malware payload", "value": "0e87f640274e9132793cf793022fb790024525e2fcf7349a2147315d972446d0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913007, "uuid": "6c43d68b-d3e6-4115-8def-da359cfa53d8", "comment": "Malware payload", "value": "3e3cbe30813d91293f28b7601b68fe8a07393090", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913007, "uuid": "560063f0-4412-47dd-9523-5025db874bee", "comment": "Malware payload", "value": "04807e0b4f996fa00e4949f8346b684a5dbd396ccde2b6b14a0f8b852facc3036fb91a6fb606e171ed56c4722fed73dc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913007, "uuid": "3a57b970-d00c-4e49-a244-37fe7e22bd03", "value": "T140616A1457DA0608F3F2AB3AA9BE52594E3B3956ED32C74E0059814E52F1A44DCA2F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913007, "uuid": "7fd5486d-773f-4ec0-922e-20e221ef338a", "value": "48:8KHaGU9Dmel0iglZ+kTslpQfYj1sAT1rTRRSJxodgImcC:8KHgB0+kT86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913007, "uuid": "69d47b4e-063c-44bf-b190-46638f9c4e77", "value": 3444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913007, "uuid": "8997314e-b3a8-469e-b6ad-4a77a05993d6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913007, "uuid": "a7fc3f1d-d778-4451-accb-7879e9a21d08", "value": "New Order Request.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ec9b53-cc45-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679883636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883636, "uuid": "6a45662b-205b-468b-90f4-3082c58b7632", "comment": "Malware payload", "value": "474b37541edeb9658f6a160294a4872d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883636, "uuid": "dd071e55-f7f2-4771-abd2-c6be56f4b562", "comment": "Malware payload", "value": "0eb6c3e7fbc28493979d2d55b37b6f2246e48ba46cd990efd5fbdcb84c52e7b0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883636, "uuid": "35a58cbe-7ac3-4f7d-822c-6a5437d5e11b", "comment": "Malware payload", "value": "a0ecf633e5a2eed7254ae9b307420f0188ed5b8f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883636, "uuid": "4519f99b-e184-4cdf-b83d-9460c905d2be", "comment": "Malware payload", "value": "eb131686a75fec1352c81ad6689e672a705041a5c69ebfdd73ce49a6bdb3d6e4c43048422769c4c58be46014eb249141", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883636, "uuid": "82ede4d5-1b6f-41e9-9aa6-5e9a8cda754d", "value": "T148073392F7E9BD2FCC7391334BBA063626425D558702D71B6825736C68FBAC88E44BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883636, "uuid": "63d6af71-1af9-46ca-b148-612cf51af933", "value": "393216:F95+GEg4/zvpdmt5yMGRo17nBYVqslAKa6SQFds:3JOzvpdmt5ERojOqslvhSOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679883636, "uuid": "f47e3e9c-2f31-4aa2-9bc8-fc5134c04609", "value": 17343749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679883636, "uuid": "7f3cb4c0-7f4c-492b-9c48-fc72862c9a48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883636, "uuid": "918ca584-febc-45cc-a235-c433d774d3f4", "value": "kurulum.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efe5ff0-cce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679952962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952962, "uuid": "9caa9a37-2533-4e18-a297-20e0944c10fc", "comment": "Malware payload (Rhadamanthys)", "value": "603e1c4b337563620dd3b0873efd2242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952962, "uuid": "298fff5a-6b4a-4bd3-abb6-8bc8ced2eec3", "comment": "Malware payload (Rhadamanthys)", "value": "0efe59a8f13a80ac3ee5c71b2282972bd42d9e609afbff88d9bf8b9092743bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952962, "uuid": "19396dcc-520f-4dbd-8b0a-d06d805a3b6d", "comment": "Malware payload (Rhadamanthys)", "value": "f334f318213431b357aa7fab4a869f0d300ac079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952962, "uuid": "56a83723-e4f8-41b0-b540-7587e43b2001", "comment": "Malware payload (Rhadamanthys)", "value": "6a0df3597d5a24c57a00ed76ade71f9a6001468f9085d128b69d4a6eef76e3fe359f7195a7f738bb8ee033f3bbd0fdbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952962, "uuid": "fa2ea376-a039-44b5-a45f-0806dd2ff8a2", "value": "T11544D0227391CCB3E61B05B94C65CBF56A7A78304B1985C73B48367E5E2C6D29E3A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952962, "uuid": "aa13e442-828a-44a8-8015-5758838498d2", "value": "d233995a591f0c21b167474a8600ae08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952962, "uuid": "089f2a24-2781-479e-8e12-2908bf06668f", "value": "3072:E3zCCRHyE0rYUXLHYLZ3zG9G6xHtPnBvsM+xUDzFQz1LlL5kYYCU3wsUf:EDz5yERUXL4Yzf2VkZ2oY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679952962, "uuid": "e4bd88d1-7430-4654-a33e-c52e98a99016", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679952962, "uuid": "389a6906-2852-4301-a62d-134cebf702a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952962, "uuid": "1e062e73-ff7b-4ae5-b65b-3052ac7586b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bc37df-cc9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920061, "uuid": "2971c0a7-3ac0-4159-a827-a27594d1bcea", "comment": "Malware payload", "value": "991c9c356aac0349f9ef39b9f5269990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920061, "uuid": "9d7571a3-cd40-4373-abb5-edb4a56bbef6", "comment": "Malware payload", "value": "0f55870edd1be2e17d90f9516c0648911fe5c4fb7cad3db81c9c01501af43e02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920061, "uuid": "a10f26bb-6ac3-46ef-bfed-ea0f4683fc19", "comment": "Malware payload", "value": "61a779d7395160bb61fe9c42c195acd07d829f99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920061, "uuid": "897d2f10-f87b-43a9-9108-74b242804259", "comment": "Malware payload", "value": "7de0947ffc94d93d9f4a7a0065566ce5703ebcc54c06dcc0bc34e03adb7c7defad03543caebf45c39867969be405bf59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920061, "uuid": "6002a953-bf5b-4e84-9c02-b423cc8cca45", "value": "T13C05294067F9DA5BF1BE5778A47202184BF1F486E3BAE71F2944D1E80862781DE8077B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920061, "uuid": "8dccbad2-06bf-4cf9-aba5-a4dc0d9d87e8", "value": "12288:TWr28gfftwgKmL9IrCc4jD1nXRS4yBaAudKqg:xfqgWrC/jxnhS4yBaAudKqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920061, "uuid": "45176459-deba-4271-b12f-43d76a21e6b6", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920061, "uuid": "d1ea058c-1952-4181-a63d-428accb176e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920061, "uuid": "4ea02c0b-f0ec-4405-8e8b-d88fa8fdb327", "value": "Quotation from Aria Kara Sanat Eng. Co________________________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3455c9-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894925, "uuid": "36a458e0-126a-451d-b98e-3e426b32f672", "comment": "Malware payload (Formbook)", "value": "36c918def347518ecf109d06a3b5802e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894925, "uuid": "aa104339-5883-45fe-85c2-b814610b1d80", "comment": "Malware payload (Formbook)", "value": "108edfe357a05a8227884876907fcde1f533d86026bf8f6888cb004b3385cd7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894925, "uuid": "3630b96a-465d-4ff9-8b83-6eab69333798", "comment": "Malware payload (Formbook)", "value": "1be3345cc048d3a6838a9c43a0df27d1c924ef29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894925, "uuid": "35989f74-665b-4f3f-97f9-c50d061c2f87", "comment": "Malware payload (Formbook)", "value": "0e6040bd7978f680a39bf8d0d450a9ed7d30d27adbf1ff9664d68d00aacae06144058b624a831c268f5880eef4b5405b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894925, "uuid": "77cf4512-0899-48cb-a961-de6ca07e317c", "value": "T16A54E0DD755079EEC857D8B289A81C70BBA07176930BD283A01751ED8E8DACBCF590F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894925, "uuid": "236bf156-2676-4ea9-93fb-b09dd4cf6a69", "value": "6144:NnhQy7787+F5GW1Fknxh2q31ZC/GT10THvsJ+oeajKbPHI:phQIX5lWeyZk9HvsJ+oeaKbPHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894925, "uuid": "86b92e9f-f89a-4793-9f67-f2b5f89a19e7", "value": 299752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894925, "uuid": "6e53f7bc-dbc1-4cba-b18e-7aff9541540d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894925, "uuid": "86c8e6ca-1f36-4ab6-829b-5f386783abe7", "value": "P.O Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d631c089-ccc4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679938129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938129, "uuid": "1ba03183-c7aa-4364-b4e0-44a049ee6c96", "comment": "Malware payload", "value": "df134a54ae5dca7963e49d97dd104660", "object_relation": "md5", "Tag": [ { "name": "DarkPower", "colour": "#501985", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938129, "uuid": "ee514099-646e-4d99-beaa-9a492fee2c7f", "comment": "Malware payload", "value": "11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394", "object_relation": "sha256", "Tag": [ { "name": "DarkPower", "colour": "#501985", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938129, "uuid": "a299bdf0-996b-470e-8432-c262c6cd6fc5", "comment": "Malware payload", "value": "9bddcce91756469051f2385ef36ba8171d99686d", "object_relation": "sha1", "Tag": [ { "name": "DarkPower", "colour": "#501985", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938129, "uuid": "1d890fa0-00d4-4b9f-8a23-f22969ede716", "comment": "Malware payload", "value": "2457288d1cb65fb3add2313e378d5a147d108efc98a40191a40cc4b2bbfee0ced1fe04a2a194a39469904ccb3e978fdd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkPower", "colour": "#501985", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938129, "uuid": "737b4ab0-b385-4ecc-bfc9-0421b78a5ea0", "value": "T15F55CF73FA928CAADB2DD37891CBD3926234FA824E339707554543312E97BD01E8CE59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938129, "uuid": "7c2122cd-5ddd-4e07-9058-883d1d97f9d9", "value": "04605125b4aac7d1cf589457480d2d6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938129, "uuid": "584f0f1e-263a-45da-b904-26b5c7942f9d", "value": "24576:fsspRa70Hm5QQF0fTOOqs60utA+islfs/DHEj3TBi0mhwLlz2Ya60xchhH2yP1DF:f7W707QEpq3u+PkDHEj3TBi0mhwLlz2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679938129, "uuid": "21999901-cf25-4f2e-9209-7f1fe735da7d", "value": 1323422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679938129, "uuid": "983f9dd9-a2e1-49ea-ab4b-a5de2913714f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938129, "uuid": "48df2f19-222e-444a-9062-db9685be1780", "value": "malware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ec5e66-cccb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679940899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940899, "uuid": "27cd9a22-008b-4261-bec3-b0da1e994c3f", "comment": "Malware payload (Stop)", "value": "23f7d98ddb2bafaefd121c30aeb2a7b1", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940899, "uuid": "3dae1ef1-c940-42c2-b470-ebeab5c84679", "comment": "Malware payload (Stop)", "value": "138b1d4d4e0d854f6ae9fe1103f26158e0df921384a403c812649534158809a9", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940899, "uuid": "7a2b7926-fa0d-46c4-8a37-d4938e0ffd52", "comment": "Malware payload (Stop)", "value": "56e0967ba750cc8b8a7eaaad287210ff494e32a9", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940899, "uuid": "97d01972-edb9-4088-b32f-d3b6e527f33a", "comment": "Malware payload (Stop)", "value": "6cd358f2b26b04a7932591d97d7225378108c2f73be23c2463603e8d04ff45dff56cfc776ea2e41445e4411ad37770fa", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940899, "uuid": "af8837a9-f5dc-4770-92e3-cbe9fc069cba", "value": "T196F4121177C2C073E99632F58912CBB18A3BB871D7694ADB7B04077E2E207D18E7235A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940899, "uuid": "ea71827d-4820-4cd5-8c6a-c51ee0e042db", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940899, "uuid": "0f13a97b-9572-4e86-9089-000ad75578a0", "value": "12288:9jZ58lx9fhvCKqugl21Q3HGOj6zxECE9ACOoA1x5DujXWjmqHLraHT:lv01hKKqBl212HP6zKFYvwWjpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940899, "uuid": "8a9b0f2d-44a6-402f-8d3d-b354d742874a", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940899, "uuid": "be2966d8-5d4e-4d5e-8522-ad9e89958b9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940899, "uuid": "24692875-6242-4993-8174-67643b393580", "value": "138b1d4d4e0d854f6ae9fe1103f26158e0df921384a403c812649534158809a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a9b9c6-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679912860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912860, "uuid": "5862929c-9882-4a1e-9473-3c809e199405", "comment": "Malware payload (AgentTesla)", "value": "da59ab34d514725fb840c360764ac804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912860, "uuid": "ddaed082-24b9-408d-bb4c-34d38f2896c1", "comment": "Malware payload (AgentTesla)", "value": "152f513c479a55d3be76da6ef1c4faed59972ef097bd61c3ecf2173c5fbd27d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912860, "uuid": "52969348-4460-453b-9886-ab678a0b0054", "comment": "Malware payload (AgentTesla)", "value": "bb2e81d756dcd83c96cc018991d87f8447d80bc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912860, "uuid": "562ec398-e11d-40f1-8f16-95b17397d9f5", "comment": "Malware payload (AgentTesla)", "value": "3a84217fdf1786f7ba918c10a63466eb44ce2e46c7c10f47000ad7ea62a9a64a4ed486ad0fa62baccfaa2cc37bb1e758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912860, "uuid": "fa94986c-2f67-40a1-9ca6-8f1aa7cb9a9e", "value": "T15F04CED9725475CFC85BC571A9A81D68BB70B137970B8283A02340E9EE4CB97CF291F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912860, "uuid": "7dcbce04-d915-46fb-a2df-f67ec049c761", "value": "3072:162jKNzeeSHv3x/9ZS+8XIX6yGXmkLM7wLsvKeWjC0gAm6:j8zJSH/x1Zx2IG9i9vK/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912860, "uuid": "3abd5d82-6366-4d43-ad47-fda5a30a7258", "value": 184040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912860, "uuid": "5543ac32-0de0-44df-a628-bba02222e11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912860, "uuid": "39fa0bce-d63a-4ef9-bdaf-dcdd924a7361", "value": "Para Transferi Bilgilendirmesi-Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c996a0e-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904961, "uuid": "09066820-c5f7-4160-875f-03a09ac29239", "comment": "Malware payload", "value": "9666ae1080513c0a3727192ddca62037", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904961, "uuid": "be14d696-d538-43cb-a2aa-a05616ffb593", "comment": "Malware payload", "value": "156ec04cbb2925b4072ac2554bd5b79d48883f48bfbcef49c99fc1b27cd2a2a3", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904961, "uuid": "d9562e2c-c924-45de-a528-02c8295a9c9c", "comment": "Malware payload", "value": "24dc258a6785375b76ab03c1cb2611269ccab419", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904961, "uuid": "b4daf5bd-1381-4c7e-96b7-934c40d1313f", "comment": "Malware payload", "value": "3b404089b523a5d8d5c4261f77aed6e922b27617f6e591f84a101df9a57d1b525a1e0d631a66c3c82508657aad69caa4", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904961, "uuid": "dac5f37f-e2ed-449a-a312-64e36b6b0ff6", "value": "T19CF398A74066C89BFE66EB00D1B4FF8574F1F07364E52E252B39155CCEA9F022E8C529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904961, "uuid": "24262154-04b1-4a50-ba91-36081d177b65", "value": "1536:6USr0XNOa1i6f86GbLngrABwoYzd3ovMlbPMDwfCOfm08macnAoTcu4QzxN:6USAdRi6fULwd3tNTrrD4QzxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904961, "uuid": "cf68fa71-2926-4a32-86e7-8ca5403a108c", "value": 171508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904961, "uuid": "c0b25de5-ea9c-4f24-b66a-647ccd9e4932", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904961, "uuid": "892516ca-4ed1-45b1-91e0-5861b58a243e", "value": "note", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edd2638-cc5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679894228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894228, "uuid": "f3fa3da2-6da8-41cd-a01d-ec8270376e87", "comment": "Malware payload (CoinMiner)", "value": "2217a7dc1aa0b5ef18f73aeb4f996d2c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894228, "uuid": "8140c388-ab55-4ffb-baaa-379f3cb32db6", "comment": "Malware payload (CoinMiner)", "value": "159ac8af8578d932513d407cfec08d07cc9ea3ff48797cfa96b7c9d45c530554", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894228, "uuid": "75f0564f-f9ca-4206-949c-b989ce17eaf7", "comment": "Malware payload (CoinMiner)", "value": "2a427ee930b5c575d1ba27eced532570260d515e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894228, "uuid": "dc059fa0-371e-4452-bb33-2afb5abdc89d", "comment": "Malware payload (CoinMiner)", "value": "4844712acf70ce4d2a8ee3cd034c0088cc5510db6b4e5c9050c515c884c45a6ef1c3f736e99390157435ec647dfe9a03", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894228, "uuid": "e47f58e3-4ffa-480c-bbc7-65e837b55ffa", "value": "T18944CF12B6D1C832D46641398DA1CAF9E93BBC708B158AC777942B3E6E703D2AF35345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894228, "uuid": "d6f8a30a-c684-4d28-8db3-78d4b7ccd1b8", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894228, "uuid": "90c39243-e32c-4163-b3c5-e9bde5b8c82c", "value": "3072:249jhOaFQDZL6Vh5Fe1uwXbylxgCt9IXiDusLjM1uKNcL+uqHs5xbtufPWQ:1CDZL85KuwGlqCt91D/A1Jm+g1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894228, "uuid": "583bbf6d-a08a-4e6c-85dd-df6a994c37e7", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894228, "uuid": "abf8160c-f830-49a9-b593-c44ae81900c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894228, "uuid": "5eb534a0-7bb4-44d9-aa26-6c741e3e642a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285f63c7-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912497, "uuid": "6008d064-07bd-4fbd-b757-5a2806c441a0", "comment": "Malware payload (SnakeKeylogger)", "value": "9ba87279866c439f64af3c00bc43f017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912497, "uuid": "66725e4e-12ba-430c-8d2f-2f8118defe47", "comment": "Malware payload (SnakeKeylogger)", "value": "161dcfc1ee7057836e13c64d517721a880e18fa13a37d5330311698ffd7f4c74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912497, "uuid": "fb881cb2-9824-49c7-a7eb-ce20038ef217", "comment": "Malware payload (SnakeKeylogger)", "value": "dff1cafa38131563f20a1ee1772c677ea6e5ddf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912497, "uuid": "7a280c4c-7fc5-44bf-8c33-a1a5176b596c", "comment": "Malware payload (SnakeKeylogger)", "value": "1b9caa72c6c02dc9e5a88d4ded094d58ed63d3511b059a981e6a3e306517b9ab62fa44cdc46d7c30c08cdcb13af6a550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912497, "uuid": "5aa89a05-ca1c-43d3-9386-d35e6a92137f", "value": "T1DF243A5A77E48410E5FF493304B05261CB3AFC121A2ADE1F57D1A52A1F7DAD08E1AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912497, "uuid": "b7a2617c-4638-414d-b980-f3f1f27792ca", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912497, "uuid": "8bee3abc-b3db-4145-a9be-377812716b61", "value": "3072:RqqaM97eOTPiK3DruiiF/XbKjPI18llUNEOaa89WpAGsWOub8522wB88vFbY+:ACteODDmzKt3dOTNb2V8dbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912497, "uuid": "15e6185e-2f89-4d70-aff4-9c5cc195ad59", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912497, "uuid": "da4ed7d9-ca8a-4f30-b2e6-3dbe49021bb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912497, "uuid": "c2906e80-0534-4aab-b809-d5914c9296ee", "value": "9ba87279866c439f64af3c00bc43f017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96a7e37-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951476, "uuid": "4cefbe2b-69ca-4678-b421-0d85a725951f", "comment": "Malware payload (Mirai)", "value": "65f8acada4bdee0003fdb0d40dfaf627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951476, "uuid": "90a69e6f-0763-40b8-88d7-223ece47f485", "comment": "Malware payload (Mirai)", "value": "165455bc47f94bf64aa5ccfd7250fccd7c26d977a41bfd376ac7463533df93f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951476, "uuid": "9221f3b6-5a12-43cd-94d7-fe453b68583b", "comment": "Malware payload (Mirai)", "value": "6f7448443efe00a28a1dea5a1f69a9c095c7e13e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951476, "uuid": "f4545612-6221-423d-9dac-03f144790ad6", "comment": "Malware payload (Mirai)", "value": "44e023eef19f9dafaaa6c02951528fadc7ea390ce62d068f3f66966b504cd2888af3badb41493a07385f27ac6eb4572d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951476, "uuid": "3d054d6c-4e84-4d6c-a59e-29dcec40feae", "value": "T1FE735C24AD3D2E22C0D4A53A62FB8361F2E5230E25749A5DBC760F8FFF6464464172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951476, "uuid": "b8f26870-665c-4279-9a19-5658edfed023", "value": "1536:9r4kI6X5FhbhCZyqDgAHcN/WePdjtfgd/6sX1:5d5kP8ecBdZfGCA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951476, "uuid": "28062487-e272-460d-b5a3-1623a1396783", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951476, "uuid": "dcea9452-13a7-4e8e-a433-67f0151d79c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951476, "uuid": "34850643-9686-4e7e-83e8-532e02f36560", "value": "65f8acada4bdee0003fdb0d40dfaf627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa300e5c-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679912715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912715, "uuid": "1b2142df-f156-4e11-94a4-c82c34773cd0", "comment": "Malware payload (AgentTesla)", "value": "405ce008aa0beb601f9af88919c702dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912715, "uuid": "6a5a3b38-ba12-4c0c-95c4-0bd5e18a9fd4", "comment": "Malware payload (AgentTesla)", "value": "18cb32d6dcf22ac378879d60f16ed3065bd716e6e0f885c115b133fc757b454a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912715, "uuid": "b274ff13-9ae9-4ee3-80ec-41d6effa3296", "comment": "Malware payload (AgentTesla)", "value": "9fb0577545db01445656f280deef58c00bc04bc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912715, "uuid": "45913694-ba45-4b0b-9b6a-dbbb27bedf45", "comment": "Malware payload (AgentTesla)", "value": "f6d01ac8af413e8b513e694d736db794504e852a207a3305fd8024b9bb74091f188147a55e290a68026510c53b937ab9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912715, "uuid": "93c51d35-76e5-418b-ac97-1c5d38c9b8bb", "value": "T10E551203D545DD8BD0F58374BB237DE5450DFD7261FA72C22884B76B1B32E9A824A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912715, "uuid": "7143e20c-8cbd-470a-90dc-81adc872ea11", "value": "24576:mLKOWQmmav30xuSSMMednErP6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXYNOSSMO:mLKDQmmQ30oMM6jwMVs6jrfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912715, "uuid": "9c64f39e-c13b-4ded-92c7-cbdeb08205b4", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912715, "uuid": "a048483c-560a-4cd2-8c71-b161bd5c06b1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912715, "uuid": "6a618d9e-a526-40a3-b441-9e06945de571", "value": "RFQ #040023001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b793158-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920207, "uuid": "0756796d-02ed-43f4-ac7c-be2a08753c75", "comment": "Malware payload", "value": "035d2c1c47ef48318a1b9e3a4e39c5cf", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920207, "uuid": "1478e94f-3114-4bd5-9b24-e3ff5ed74cf3", "comment": "Malware payload", "value": "19f00c273bc6a5e5874b8f0927c5f06e2b56669f183ff33c3cb35d728e3375c0", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920207, "uuid": "39d1f39b-96a5-467c-afe1-39f6f7e65960", "comment": "Malware payload", "value": "70a3dbcd734442d9d7b0c30fed67ae8f71058796", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920207, "uuid": "d9213f53-5cfb-4479-a563-3078dd8c5155", "comment": "Malware payload", "value": "17c5ae000fad27e43a63a9cee7a6a4bc9bc6cb9d8fe26e8d174aa3be992f986501a1d37256c52616e7f7c3d452f359d1", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920207, "uuid": "faf069d0-c10d-4ec4-b213-319ded2b7e90", "value": "T1361370095D4A996B9573B37AEFA38448EF27122702665231FEDCF2041F7041896B1FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920207, "uuid": "c8c40b72-8be5-48c6-9750-ab490fc48a29", "value": "384:WxKdZHW0MpTWTt+RIGOEc1sgjzQvcg84jw4uppBlthxVQ0PLFA/oJzkGrZ2Ltz3:ZrWLpSTt9EQzQvUrDAg5kC4tz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920207, "uuid": "7ddde555-abb6-4c9a-aec4-3fbd2feba7ae", "value": 42518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920207, "uuid": "1291ab43-0b92-4018-bbe5-2d2dd4d4d86c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920207, "uuid": "9084a0e2-2dc2-4084-96d6-14b547e0854f", "value": "34rDHR5Z.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3afb38-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878275, "uuid": "193a8a58-9369-4868-b65c-e66a6df70318", "comment": "Malware payload (Smoke Loader)", "value": "46989c78857cec1d97888ca84b5d2ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878275, "uuid": "0c954dca-53bb-490a-9252-4a4369e15272", "comment": "Malware payload (Smoke Loader)", "value": "1a45a6c96b623a7a923ebe8bc504eb20cd87b933f4076abd32c583ce6e6fd699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878275, "uuid": "23b17581-cf2f-47f6-b5fa-35fa1e8d68bd", "comment": "Malware payload (Smoke Loader)", "value": "b90aa798ce0aeefaf8edc5d735070d53a9eb938d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878275, "uuid": "ceb844dd-9937-4dcb-a099-368c1d2c1e41", "comment": "Malware payload (Smoke Loader)", "value": "6563b0bc76c80954ba51ce12ab9c7bd0f137b15d41ac8b0935ce8ed7f8f492cfc4f9fe2c42587123ff842a9ac4712583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878275, "uuid": "0bef3c21-7aca-47c3-a801-b40d8417eb1e", "value": "T18D548D2E63F46830E5334732BE2EC2F42A1FB8615D577B9E2649AA3F0970761DD62305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878275, "uuid": "126c88e5-c0b0-4c9b-bb15-21da89727f0c", "value": "a45b0eab0ff7170ea4d75272be8d3235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878275, "uuid": "67b3db8d-8053-4eb5-af18-c035ed0d4c43", "value": "3072:HyzDi1q+FFNkwySkAzmdYqdoywmb9LmNInL2xabeEWiP58SMdleHn78B:71BPkwhkAVz6Z+InSQmiP5APe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878275, "uuid": "41bfb755-76a2-4a32-a5d3-6a7ac3964355", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878275, "uuid": "d44ba4c1-0f07-45e4-b30a-1ab4969d86e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878275, "uuid": "09309343-693d-4e77-b468-0be950478a17", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcbd49f-cc7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679907839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907839, "uuid": "a3d19a5f-2560-425f-a60f-ed5b14cf8a7f", "comment": "Malware payload (RecordBreaker)", "value": "21465615bcd479755c4d02c2b5947b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907839, "uuid": "482eb9de-c44b-4720-bc2f-eda1f5ddd9c7", "comment": "Malware payload (RecordBreaker)", "value": "1b012d01c86be5d68959504d362c52170b27d726cf2943e2e0250506a29c765a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907839, "uuid": "7f91b330-4478-4c80-8518-b75fdbb735cf", "comment": "Malware payload (RecordBreaker)", "value": "05e87d914a93d16d417b811c550f39bb78ad833e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907839, "uuid": "7aabe6a5-a79d-4e59-827f-518225ea7a1c", "comment": "Malware payload (RecordBreaker)", "value": "e5cb3a55426f487dcba2b5f830bc45c1ade45c81201c607deb898da559b8a613653561e0d2203c44df599480b276f910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907839, "uuid": "27fc8f0f-5f39-47c6-ae99-64d25682392b", "value": "T196352311D1648F28D62FA07080934B6695A37E47AF451BC32A907F1ABB7F39372C948F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907839, "uuid": "8af0c613-bc70-4cc9-8a03-d17965d6d99e", "value": "24c15941d57e04bbb31d24b0a670828a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907839, "uuid": "f4e258d2-b36d-4a7d-95a4-65a8bf47004d", "value": "24576:XKkctNXpMf1iRRIETZWVCeaNxBBz4sjd039NxWe9HiFgOMd+ez:XetNXCf8RIkWoe+BBHjd+NxFwiPdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679907839, "uuid": "dd296aa8-aa7a-47fd-8fe9-7add8cc9e563", "value": 1110520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679907839, "uuid": "7c39dbdf-3c82-4204-8dc6-ec5b2d5956b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907839, "uuid": "0802aca1-7b23-4635-93ad-70a0a1160e9a", "value": "readerdc64_it_a_crd_mdr_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98352fb-cca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679923532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923532, "uuid": "263e9bb0-185d-4f73-afe1-a680cb18aedc", "comment": "Malware payload (Amadey)", "value": "ff328b453b385e6c759fbea7511e8e32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923532, "uuid": "df787b10-4dac-4f1f-9d1d-c2ecfda8ab75", "comment": "Malware payload (Amadey)", "value": "1bca67c733cd0c9199a5c6957ae9f5a521453d3be3123312ca70fccfc59b0c7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923532, "uuid": "4210e79f-64a7-4849-90ca-b01db2a57daf", "comment": "Malware payload (Amadey)", "value": "111e1e0e2b86719eaaa4e548b5fbd56c8e752cb7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923532, "uuid": "a9eb6d35-a2c2-40fa-9c37-2435e2d8268d", "comment": "Malware payload (Amadey)", "value": "91254c7e20db831f23f154cb8377cd60777fe6c0e355c9ed95943f4c19f6d39117dc19c59b07281a1d3f6a91aa9da85f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923532, "uuid": "8b712b05-3efa-4145-9b15-702602a479b0", "value": "T112252313F6E49137C5781BB09CFA13831B31BC6298B9421A72897D4A1CB3695787E72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923532, "uuid": "7d8549a1-b4a1-40e2-aa75-0446e57b2e98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923532, "uuid": "15eee916-dc01-4047-928d-7211e59b6b01", "value": "24576:yyS6Zut4eE09Ose8t685UuwNS/D4QHqU:Zlkt4r0+F8BD4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923532, "uuid": "4b50293d-615f-48a8-9b6e-d2a30a39019e", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923532, "uuid": "6a880484-8813-4e40-8cd4-5eaa8978bfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923532, "uuid": "504bb36a-fcd1-46a6-a78a-785c8a5b4e94", "value": "ff328b453b385e6c759fbea7511e8e32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fb9ff7-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679912955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912955, "uuid": "f2502144-96fe-450c-b0bb-5a94363f1190", "comment": "Malware payload (Formbook)", "value": "c995210ed7e96c962c03bb6775058f93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912955, "uuid": "c781150d-6292-41f5-9fbc-0105d72a352a", "comment": "Malware payload (Formbook)", "value": "1c3d02bf97f70f89aeb799b745e486622c4a0196519b23c9d61ccdd57d2b0872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912955, "uuid": "b631176b-2263-405c-8f43-4812b2e5c45d", "comment": "Malware payload (Formbook)", "value": "3dc5bf56382a8abb242f851550e4e28b87cfaeab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912955, "uuid": "e5e9a629-9968-4b8b-8147-30fb2f80ce26", "comment": "Malware payload (Formbook)", "value": "e2c12675cbaa312d0ddb63f73ae3923150cc68890aebcf99d482691db2c18706197201bb248a4ab66c1df96d232043de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912955, "uuid": "8c5d1783-f89b-496a-b26f-a5d5c4c79746", "value": "T148A4AEE0D351D9E4F86A92F690339C3229578D2EA4F8152F04BD31616AB33831DB7D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912955, "uuid": "505703ce-466b-4ff9-af30-5368d052d901", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912955, "uuid": "1f1ffff2-4716-4ceb-988d-7b4d0033d43f", "value": "6144:OYa6PtseYlNrGwbgnjwqRtYEaF8wyzKjC4mVtfvtA/RXO+d859jSLB2:OYQKwbgjwgt5a9qKPQva/RXOBkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912955, "uuid": "29f72c71-619f-43e4-b586-b4a5c289a6f1", "value": 463109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912955, "uuid": "66c4532c-2f79-49bf-a10b-1ea8e51f1b06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912955, "uuid": "d3c273fb-628e-4aca-8b09-dbab3bf32031", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41f5e56-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912356, "uuid": "c3f9ca57-56f9-494a-8b86-75cf8ac17546", "comment": "Malware payload (SnakeKeylogger)", "value": "3b3f9a082f35192b4ff09140af7d28f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912356, "uuid": "c07471e9-a6d8-4068-97cc-5d6428761a6a", "comment": "Malware payload (SnakeKeylogger)", "value": "1c97bae25b133e2b28133eb17889f3f2f063faf1003f9d575d67d16414e9a6e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912356, "uuid": "01c0847f-7fd3-40a8-a8df-4165db64ada9", "comment": "Malware payload (SnakeKeylogger)", "value": "757781ac6e91bac472bc3e0c4badad025ec51aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912356, "uuid": "28d74933-2b77-4481-8253-fa6e0ac37582", "comment": "Malware payload (SnakeKeylogger)", "value": "fcd268940ed7eccfa2ac3e30cd0514bb42b1778e86d25c75ace4593dbf9478e8906b5974211b850ac5e0afba583fe3de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912356, "uuid": "7ba0d654-86b5-41b0-b030-b8a172de99f1", "value": "T14A358ED1F150CC9AEE6B09F17D2A9530649BBEDC55A4810C5A9DBB1B26F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912356, "uuid": "027d5706-df97-4cd0-8f11-acbfaf4535f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912356, "uuid": "2e317c7f-d716-4227-83b4-25ea68303716", "value": "12288:pfUJB0Onb/9bDJ49FkTklBFvOtNgdPlD+64pkPxOZzKJhZ:p0tlG9gM7+rpag8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912356, "uuid": "1fcee7f8-779d-45a1-b800-10c194ab2478", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912356, "uuid": "1257ee94-6a27-404c-bbfe-6c2895bc0c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912356, "uuid": "7ab15f2c-a9f4-4a53-bf94-255f5a9da06b", "value": "Ziraat Bankas\u0131 Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47b44e1d-cc38-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679877761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877761, "uuid": "b832a9d0-1e63-4782-88e1-ee75c1ca7a17", "comment": "Malware payload (CoinMiner)", "value": "033e6af2279b3369bb2e84380ba16e06", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877761, "uuid": "181d3f7c-bf8a-4cac-b9b1-01afb6d9fb42", "comment": "Malware payload (CoinMiner)", "value": "1dea3e86c77debbf0bc3446255b287327cab8bbf8194fb96d64b598d2ef65dab", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877761, "uuid": "27ab78a7-b2a7-4580-8e5d-753c4eb14e33", "comment": "Malware payload (CoinMiner)", "value": "ce48d90ad361f8b3c02a0191ac0f03901b49a34a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877761, "uuid": "24f08c13-f171-4852-9e31-b45081aa5dae", "comment": "Malware payload (CoinMiner)", "value": "e3c1593a8892eac85f1bc5f1ffa52185ebf2f10a8d5a56c9be8e359c73f092d224e0aef0f8f8c62e792b3db7a4ab2f0e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877761, "uuid": "3536b791-d002-4954-ad27-5a026aad7267", "value": "T17044D013A5D4D963FA61C8FE649417F1802D343117B486C79FEE0B19AB762F30AB8297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877761, "uuid": "4cb459b9-2d45-4f2f-8210-24d8c0f9f954", "value": "03a003b2ab5e4e0a5303d82cb2f0927e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877761, "uuid": "e5aa04ea-dbd8-41a9-8f12-215a87dd6afc", "value": "3072:xl19lw0riDYFmfs/6uycZ4koUoq3c4GGYIuoBOqIBjmFPokgaLnOnnZNBhFw7R7x:vlw0hus3OUiGYD3oPRgauNBo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679877761, "uuid": "43d62898-8af7-4ab5-a51c-9fdacc023c3b", "value": 260720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679877761, "uuid": "63cc6a4e-15fc-41e4-9ffd-2fda4c15d52e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877761, "uuid": "24a772c0-aafc-4361-bc43-bb78aa9b6124", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be0d8f6-ccec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679955023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955023, "uuid": "64b27feb-0734-48ad-a4ac-02b8977ab3b5", "comment": "Malware payload (RedLineStealer)", "value": "83f78fc4ff8244e7b91da09f50ccdbaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955023, "uuid": "9dcec36b-51c1-4247-b4ef-3913ade3684c", "comment": "Malware payload (RedLineStealer)", "value": "1ed3acc8e9c4836587e1a70d34f9b860355033c57b96929138e4f91912bbc4c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955023, "uuid": "8cff28f7-e726-404c-ba1c-1a1d1b7698b2", "comment": "Malware payload (RedLineStealer)", "value": "d43e6728f33c5e24a98ef0ce27a481877ac9a00e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955023, "uuid": "ee15b456-2a86-49f5-a0c5-849cf567e1bc", "comment": "Malware payload (RedLineStealer)", "value": "4a5e946715e7648a521f3316c68f8ab68106a230f1a46699f109522c7b3742c2a62f988aed07451ee804f73937eefbce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955023, "uuid": "fbf3d94a-b35e-4c45-8142-2d2cd8fe9bb6", "value": "T154E4123137A1D072C53A01B17960D764BF6E78719E208697774C2BAA2EB05C19EB732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955023, "uuid": "0a1a5c8c-116e-4ae0-8bec-bf53fe847845", "value": "6f4f1f2acd8b4a1d801f57154fc6b504", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955023, "uuid": "b4deec38-d850-40c7-9015-e08c0536c7a7", "value": "12288:VGEAzyEWuWxSGEFbgUU/T/G9qPkdFJQZ5AOOiCKAGePUBr:VGFWuiSGEFbgUUeqPkdFJoWOOC51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955023, "uuid": "34a80a8f-0592-4933-8a0b-1cf9fd2aed75", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955023, "uuid": "406e756a-387a-4f14-95df-15c172126fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955023, "uuid": "d7e9bcde-a143-42cd-996f-01f9dcab6e67", "value": "83f78fc4ff8244e7b91da09f50ccdbaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b658c1c6-ccee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679956115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679956115, "uuid": "af78410f-27be-415c-bf2e-207fae369e78", "comment": "Malware payload", "value": "d948d4b6db5d6d6e2e1ba6c0fa4bf008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679956115, "uuid": "de08f82f-c4bb-4998-817b-6db3d0ac185b", "comment": "Malware payload", "value": "1f43703d2171ab90e98357b6dfdf824417baa191a59419c27fce42cbafdb7ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679956115, "uuid": "11ebc781-bad8-47e3-8b13-3c1766d9e76c", "comment": "Malware payload", "value": "05846d5b1d37ee2d716140de4f4f984cf1e631d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679956115, "uuid": "7a5ccc85-3b53-4c16-914b-b0dbf92f7084", "comment": "Malware payload", "value": "027151df4792ff22016d3dd69b5aea3e3c658bf79de2909d7d4a401cbe61476ee3a39e584887e8e5a56e835baef66120", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679956115, "uuid": "e7ea3f23-62b0-44be-a5c8-34b194221cad", "value": "T1C6C5338A66B0CE52F7FEC7BFDA200814817A5A8A5150F37B16F9CD7C3B58AE0722054D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679956115, "uuid": "502f44d9-13b5-4557-877d-3688b6d783b2", "value": "49152:AjY216rMHabk161nZDmcQt8O4BY3+lu2OtXED355:k3YdnZDmcQP6YO/OtXEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679956115, "uuid": "96efb20b-8b98-439e-a25f-9b44adfc5e94", "value": 2497536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679956115, "uuid": "a65c66be-ec6c-45a9-832e-d90b38aa42b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679956115, "uuid": "a99db6b3-3930-450c-ac9b-8fbbe5084a9d", "value": "BlackLotus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ec8dbd-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679894879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894879, "uuid": "7fcee779-e478-481e-96dd-5f6508dafd88", "comment": "Malware payload", "value": "fde43afd79205d599c5f6d6f1e5840c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894879, "uuid": "a181e7fa-eb25-4d48-9596-da5c0dce1600", "comment": "Malware payload", "value": "1fe024ae004395ea872c447747d6606a0b371b08568612badcfec5cca4a03db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894879, "uuid": "d0f29b90-bc30-4c46-8f12-521831759815", "comment": "Malware payload", "value": "2e2590b5ca62c60938cc1528f966026723829782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894879, "uuid": "6f16167f-9f68-49db-84aa-6100b3f0d0af", "comment": "Malware payload", "value": "0a2cace19744079a52ada5edf33523f426a47d1ac2ab12d0cbe5c852e6cef9805b8f65c4ea419e3ae386597130658ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894879, "uuid": "531e22f7-8529-41c6-b090-b832d3461d03", "value": "T1FD720834E1961F33E2F141F742A67911A1A87E397F2CA0CBF909716339987A34E35953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894879, "uuid": "85d93426-6220-4e37-8f8a-7aaebba340b7", "value": "384:Kfg0Ma9eVmJtoIsQbgf1V5NuWSFeRhWf:K409eQnsQsD5O8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894879, "uuid": "f75fe8c8-26e7-46e2-9578-be8a12b2dfe4", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894879, "uuid": "62a9422f-704a-436f-a6ce-dd071cace8cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894879, "uuid": "ebc74256-5034-46fc-8bfd-5dcc2eac168f", "value": "1fe024ae004395ea872c447747d6606a0b371b08568612badcfec5cca4a03db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5774f02c-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679912576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912576, "uuid": "2bf5500e-abc8-4832-9121-9a747b4c4954", "comment": "Malware payload (RedLineStealer)", "value": "b26480dce772642635204619f30c35d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912576, "uuid": "a3a34a5b-ca90-4915-a798-b1a82a907f67", "comment": "Malware payload (RedLineStealer)", "value": "20f9eb4bd36001f8c3c80ad01078221bb823b2846a00c12549f77f07ef5498ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912576, "uuid": "9d36c584-137d-4909-88b0-1d8337eeca2c", "comment": "Malware payload (RedLineStealer)", "value": "7693a39461090bde35919ea4f6652955f5159a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912576, "uuid": "cbaf26dc-0721-4f62-b256-caee95f848bf", "comment": "Malware payload (RedLineStealer)", "value": "09a3462d59c977cb2f3edbcce3a7e7f0438a1b1c84161fd6510611b1993438e56a9ea71be3c7b41c0bebd4c806219a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912576, "uuid": "df437c4d-6f42-434a-9b1d-3942d6a622c4", "value": "T15E15F80571DADB92C3AA8F35C948EEE04778CD419A87FE16AD8817D3B1033A29CE5573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912576, "uuid": "9a194c3f-9377-4d41-a00b-baa1ec038088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912576, "uuid": "94c79974-d6ef-46c1-8064-9846a903efa8", "value": "12288:GUw49Bd51RtJFh9NKXEoXpM501eVM+SMgYvVHiBFqmpQ5i9rwH4a:eEH1VtSMPfmp5GH4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912576, "uuid": "5b67faa7-7fd9-4abd-a056-d2e101e07a72", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912576, "uuid": "ab9cf7bd-6339-43ac-a797-32bcb83134f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912576, "uuid": "2be4503c-aaf4-4448-9595-f7464d70edd2", "value": "b26480dce772642635204619f30c35d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7db5246-cc9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679920039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920039, "uuid": "c5198b47-a730-489a-b2f6-b52fd300e37a", "comment": "Malware payload (Formbook)", "value": "5b1acef229bf56768ae57282e85b9f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920039, "uuid": "37698c23-392f-4921-84b0-530493ef6c3e", "comment": "Malware payload (Formbook)", "value": "218f58a212cb8f5061efee07b7a1c2b088c7cef3b81a6e92d8702af82687edf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920039, "uuid": "4d596fe9-0f4e-432b-98ee-f376eb18255a", "comment": "Malware payload (Formbook)", "value": "5dca8fc8e5a6feffe48550ea594be892334ac536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920039, "uuid": "50c5f765-216c-43bb-bbcc-7186d7d7cb6a", "comment": "Malware payload (Formbook)", "value": "82de08359005043b0a3500d90361c97dc9286622d24a0dcbc33b5ae0c43c95e442ac945e5a80c5e0fa29384c334a9025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920039, "uuid": "70c07850-4763-40be-a645-8e81b35f5945", "value": "T1FB2412E275D0D4E3DBA34B310DFA2F0B6BB3AA1715D0070B67947E0ABDA3680691B547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920039, "uuid": "0f799322-6a33-4d0c-a92c-1d13cb621c95", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920039, "uuid": "afeb99c8-f340-457f-ba36-b355a44a3485", "value": "6144:pPX7iN4M2b4kKc2WHfbNHD+kj/GwHEBbMh9:IGaDEx+kxkB+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920039, "uuid": "4a3bc6a1-6c76-47e4-bed4-e4bc2c0767f8", "value": 218168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920039, "uuid": "d88df795-d093-492b-b551-cd21ca233906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920039, "uuid": "cc40c136-da24-49e3-bb4b-9ff7641f3e31", "value": "Farvetonerne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ff416b-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951438, "uuid": "8b1e9216-d3d7-4f3c-bfee-592ad2c3d77b", "comment": "Malware payload (Mirai)", "value": "7f81b77198e3d2e8a08ef72e35338ec7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951438, "uuid": "e44eb27c-0a03-4fb3-9407-89262601b5d9", "comment": "Malware payload (Mirai)", "value": "21c8f0574fcd3876385f9f56594d5ff200aedfb2a9d2bf16702cce93b1cb360f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951438, "uuid": "e308aee2-8d13-4d95-8c25-0773da50511a", "comment": "Malware payload (Mirai)", "value": "dfb6291f2c4c483ceab4510b19c917342bf3337d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951438, "uuid": "c5c2746a-2228-4c8a-aace-fd96d5c5ed16", "comment": "Malware payload (Mirai)", "value": "1a23bb88ed11105c2d5274c24e24e0221395f9a52345818cad27a1e9728065dd292bcf1ab8605412375d1c1fac001e6e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951438, "uuid": "2ceb67de-eb75-4fc7-9663-d24cfe26dd43", "value": "T135D2D0A7A327B631C03AA3F24C6299D5F86559037E57677F9043B03EC6B31645532F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951438, "uuid": "590d9e16-92ca-4718-a5b4-80eaa9788aa8", "value": "768:XpsvxgELyxink18bNBXMy70PLhC1yW3zUnUoex09/:5svxgEs8bD70TMZInUDc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951438, "uuid": "e04747de-6ac1-4de6-a1b7-ea5481df5b3c", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951438, "uuid": "c0bbeae2-f5bd-454a-a6a3-c28719d22965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951438, "uuid": "738e4f5e-cbed-48a8-850a-917618010cec", "value": "7f81b77198e3d2e8a08ef72e35338ec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde0da67-ccaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679926922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926922, "uuid": "1dc27f15-cdf1-41aa-8a05-44128940d4a8", "comment": "Malware payload", "value": "34896173b5d0c8ddc638c44b3cacdcb9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidJack", "colour": "#B1642B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926922, "uuid": "7cb6603e-d0f9-4451-afb3-9ffeaab3ef48", "comment": "Malware payload", "value": "21d178e0688af591964ae00b71263d2e086706017ebc98d7488d57771144d337", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidJack", "colour": "#B1642B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926922, "uuid": "a6bd0fda-d0d9-432e-8c45-aad1657b2dff", "comment": "Malware payload", "value": "135395bc831527b04fc41a94f2972115f1ad7475", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidJack", "colour": "#B1642B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679926922, "uuid": "fbcbffa4-ab81-46f0-9fb9-42a1b117d8d5", "comment": "Malware payload", "value": "b63727df7940de914725dc7e04fd591f91518f385f4f629b29c65414ec5e4747abd53adc6071c2c9e2800c7a619c4884", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "DroidJack", "colour": "#B1642B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926922, "uuid": "ba9a4d9b-f866-467b-a042-4a3eb96bd70f", "value": "T1E844233B97857507DF7291F12C4A7ED38E39148A46F7C09A03CB18AC496659CFEE6A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926922, "uuid": "79b436a0-9032-4f24-ad30-4678a1006a8b", "value": "6144:6yKs44cbQAa36N8oK+r2kplir6V/HOUD33/wTa:neMAa36N8H+r/irKHOUbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679926922, "uuid": "746feb81-12fb-4694-b41d-39997b41eb65", "value": 260479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679926922, "uuid": "22dc9338-dbdc-4562-b33e-33fb35162302", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679926922, "uuid": "44af3f1f-9d4f-4359-b4a5-115b2bea4837", "value": "infofs.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899c24e5-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679903641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903641, "uuid": "5e279399-76b3-45ee-b968-e2047d97025e", "comment": "Malware payload (RemcosRAT)", "value": "f14f9b49b3d07114aba9673aacd7010c", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903641, "uuid": "29c01d13-ebb8-4e8a-a7dc-53a1a8fef105", "comment": "Malware payload (RemcosRAT)", "value": "2236b256e571deb77952dd007e3a36b7914db6674901436a7a60d20f7d7167c8", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903641, "uuid": "eeef35c3-2b1f-4b9f-b1cf-1523a45c435d", "comment": "Malware payload (RemcosRAT)", "value": "99edbf571860b0318805e6004e19b2d3188b7e3f", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903641, "uuid": "b304acf9-4ce0-4637-9a43-deae6872edcf", "comment": "Malware payload (RemcosRAT)", "value": "0949b2cfd831b94ac99e9dd8ba1d5b8e83227e2947efdf5295c424750c0a7cccabf8aee84c4a36d347db8549d70a5485", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903641, "uuid": "ea053159-1069-4fec-89b9-3c0c7b5f3ac4", "value": "T1C0253358E1C5EBC1C96016B2FC969CEDCBE06E730BB394A07548C4F18BC6D15BCEA960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903641, "uuid": "68286be1-b45e-414b-9b7f-8e6236d9e10c", "value": "24576:jm5eq7+TqdMyrek09y3TIyvqNV7rvNbUkZpvKo5fPvVj1Lc:9q7ayik0wky+JLNIkZAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903641, "uuid": "8c4a3de9-f6ad-4d3d-889e-40dbb56b98bb", "value": 1055000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903641, "uuid": "27295571-c37b-42a2-84f4-dad226589caf", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903641, "uuid": "a0da69c2-1c8c-4ed2-9185-c9def2236b9c", "value": "80460-PROC-98047900- RFQ.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7941a716-cc5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679893306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893306, "uuid": "1cb41ceb-fc0d-4ba1-aa27-76b18d2e210e", "comment": "Malware payload (Smoke Loader)", "value": "7d09f3b97c0ff38450e1fa00028d43f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893306, "uuid": "6f08afdb-2145-4cda-8fc5-6ff0be4d9f1b", "comment": "Malware payload (Smoke Loader)", "value": "2276b829dff30e82fcc9a2f7507efbba86e047c45fca3576eab6f56099a5adc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893306, "uuid": "c8fa8936-610f-44b6-9bf7-f1a65fcc1b6d", "comment": "Malware payload (Smoke Loader)", "value": "37c88af27f8fe169e17c8db29b727d6c13fa28c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893306, "uuid": "19a048ee-79a4-48ff-9ea2-3ac1c43cf822", "comment": "Malware payload (Smoke Loader)", "value": "c28c998d7b87149a7fefed962a9bde7870b4b952bd4b2bb366c144d6da120a95b18d5a53055c77b9e5b3bdfa66e20b8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893306, "uuid": "9b8b5925-b230-4be3-8f64-28cb77a51879", "value": "T1A9447C1E93F46870E2774732BE2EC2F42A1FB8205D577B5E2659AA3F09706B1DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893306, "uuid": "bceb80a5-ec38-4573-b3ad-baf2470150c4", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893306, "uuid": "60464f17-4d7d-42be-bf8a-760c2345d398", "value": "3072:4Ty7jHlA+FF6NFtG59fYK5s+tjcB24u/B9skv422Vzs7UOr4ZXE00pn78F:hlvkG59gK5FD/B9MVoX4G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679893306, "uuid": "ce97b971-3790-4e12-8c1b-59ae19ce19cf", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679893306, "uuid": "6e2471a0-c6f3-4580-a780-4a310ca07c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893306, "uuid": "96748ab0-492c-4f22-88b9-edae810015e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c0105d-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880811, "uuid": "1cfb6bb8-9034-4d8c-a310-d93ff2f26e7d", "comment": "Malware payload (Smoke Loader)", "value": "08e274934e788c233d22526ebc5d63f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880811, "uuid": "c4b92714-3175-4931-b345-69d5a837db8f", "comment": "Malware payload (Smoke Loader)", "value": "229ce43634bea99f1e62a232d6f179fa908b5aa1de8751ba0068b6b89dcdfef6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880811, "uuid": "2a7a588a-02a8-4364-96ed-39c81e27f627", "comment": "Malware payload (Smoke Loader)", "value": "78c59cfca9216ba944ab60226142f6806f9db05f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880811, "uuid": "e6eadc31-e288-4fa3-8ead-f4ef1470de87", "comment": "Malware payload (Smoke Loader)", "value": "0e860c4d4033f74c096a506676339d63dd3ac7bd5f5d41b206fe44f498ce3466e12078cd8372b030286ab4a123eead8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880811, "uuid": "c788481e-a69a-40eb-b2e3-15bc14e66c9b", "value": "T143546D0253E16860E75386328E2EC7F82E2EF8615E157BFE17559A3F2971FB2C162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880811, "uuid": "afe4b2d9-107a-45ca-9f44-d8a0a69313f8", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880811, "uuid": "b4a7cb9f-95ef-400e-95d9-fe898a6e065b", "value": "3072:ECSTzYUB+aY97WSKwiGMhfqag5kA7GlSudYYYiUKzOEux+SITPqmjkUCJQN0fm2X:guOw3MRqagElS5+7ducxTSmj4Tfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880811, "uuid": "d43bb956-4f4d-4a0e-9672-1fded66f1673", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880811, "uuid": "9322ede0-d4be-470b-942a-ded44401c738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880811, "uuid": "f746a56f-ff2a-4a56-a4a8-3f85e31b300f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0b208b-cc5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679894760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894760, "uuid": "7d41b2e3-8bde-4ea4-abac-ea61396bb5fb", "comment": "Malware payload (RedLineStealer)", "value": "bad2cd7051c709b467cf623a9493256e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894760, "uuid": "0f996736-5bda-4c59-8443-572c5b3b362b", "comment": "Malware payload (RedLineStealer)", "value": "22f8e968a506352f6bd494eb2022633f7f5aa63c8fb3dee3a18b70be139822e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894760, "uuid": "a899e730-c6a0-4daa-910c-206e01a747d9", "comment": "Malware payload (RedLineStealer)", "value": "26a681a6ceb2ee4994646bd0a9d1260c8abfe246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894760, "uuid": "e9b1008f-561d-4bd2-b01e-27fe8e86941d", "comment": "Malware payload (RedLineStealer)", "value": "73fd3326baacb5d6f87301c7adb4b607de0bf78b88b7cdc8b32b32e87a9255ad8ec40179489057656155f124eaed8362", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894760, "uuid": "06c64e2a-094d-431a-bb8b-b96a5abe11b2", "value": "T199E4121272E1C072D59281788926C3B46EFAFC729B558BCB3798277A1E313D19E3534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894760, "uuid": "c77b888b-8f7e-46e6-b1c9-a0ecc1c5dc93", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894760, "uuid": "d562fce6-49b4-42de-a2ce-9a13ff2a215c", "value": "12288:QBVTbILUBFnob9ROF52dVW5iXygBfovnzMd6T0BplqHvnLM8d:yRAUBFo7V1XyiovzvIPlSvL5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894760, "uuid": "673cecd9-a242-47f9-9b54-d409fb1f3051", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894760, "uuid": "18604b20-140f-46e8-92a7-ddb57da1a4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894760, "uuid": "da86b7b4-0207-4f02-9ae2-2ce2fa7ed734", "value": "bad2cd7051c709b467cf623a9493256e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240746be-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894881, "uuid": "1cc3ad58-a97d-4ddc-87ae-c53a7850b64b", "comment": "Malware payload (AgentTesla)", "value": "28c8a8a46f67adcd59b48d9f967ca7d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894881, "uuid": "f8371022-4228-41e2-ba51-96c628613fd8", "comment": "Malware payload (AgentTesla)", "value": "231a82ded923d41465ce13e21138c2e15eaf3f2b4c41d9c4da1caebb1fca08f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894881, "uuid": "17e34fd9-9c7f-4d25-bd46-1b31b1f37f81", "comment": "Malware payload (AgentTesla)", "value": "00a6ab7f11f6202a860744c1349aebba832f45da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894881, "uuid": "f39647a1-9c47-491a-964d-6267dbb040a2", "comment": "Malware payload (AgentTesla)", "value": "7ddc956710d120037b5b89269a582d9f997aac273cee53b8752060fb089805cc46900e709c7b89863a0106468b35ac86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894881, "uuid": "ab255013-d0d2-42d1-aff4-a4526ae5ccd4", "value": "T19A15230A71578987DA3E4FF45522738453B2A3665E03CBEE6C919CDCA6F17D22600BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894881, "uuid": "f234c3b8-ca54-4a47-bc9e-52871a04b4e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894881, "uuid": "2a854525-df0b-4206-b87c-2315685d47e6", "value": "24576:fGJVZtj63MzwlnajCy2ByKW/1HntvPWHuOv5EC:f0163YsQ/m585tvP0HEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894881, "uuid": "0266ac55-c0e0-48b7-b221-a3c2b4d8d49c", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894881, "uuid": "4eb9abf0-7eef-439c-9bc7-a9dabb6d4ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894881, "uuid": "1ab6246c-c279-416f-8f6b-919f20c78d68", "value": "3209383742.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09ac144-cc9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679920108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920108, "uuid": "6f0e7629-59a3-4e20-82ff-b2c1eb2e286b", "comment": "Malware payload (GuLoader)", "value": "7ff4ca325678a568841cfd241169c0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920108, "uuid": "0eac3569-d299-4fc3-a643-8da2ac05e172", "comment": "Malware payload (GuLoader)", "value": "2366158b67d626bbab28ef335785c92b699270725ec193d1e813c6dba86f04f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920108, "uuid": "da0a2534-153a-46c0-b8d2-05e84e03f9cd", "comment": "Malware payload (GuLoader)", "value": "43b28b061b86084d224eb664c3135aee641aff08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920108, "uuid": "2c29cd73-411f-46a9-8fa7-89b5fe05f059", "comment": "Malware payload (GuLoader)", "value": "bc0d2c2a59b4e10f9dc0f958d3794025f67305359c12bf19cebc0fc1df1254694e658b1724a5d7320f233a098ce8e515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920108, "uuid": "24fc7ce6-13b6-4f34-8d50-6eac44093e11", "value": "T160B401626B94DC13EB8156708191F37EA635AFE85E1B87039EED7CAF7F247666C08001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920108, "uuid": "ec6adcb8-6c9b-4d5e-aef9-1d0955dffabe", "value": "b40f29cd171eb54c01b1dd2683c9c26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920108, "uuid": "b64808ea-d781-4f52-bcb5-cd23c201d229", "value": "12288:CrEE/hTVFds4nL5vZMjCe2w7sGfl58WtSQ/RTTk0gm71:vEzFds4nVvZMee2wrfXVNsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920108, "uuid": "a3e01773-0620-47d0-9c76-01d4d66987d0", "value": 542640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920108, "uuid": "e0ac5e09-1b3a-43dd-8dcf-02422663248f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920108, "uuid": "fd532e7a-1bb1-43f8-b162-66daa02dcc22", "value": "Invoice PI PL XtDEXae99_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79cb384-ccca-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679940709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940709, "uuid": "e5cf2ffc-4f11-4122-abd8-b62ed947d901", "comment": "Malware payload (AgentTesla)", "value": "3fdc90aafa6b59f415eefeee172978cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940709, "uuid": "19aa3fb3-7b4c-44f2-b3a1-110301eeb981", "comment": "Malware payload (AgentTesla)", "value": "24a910ccb877faa3efb698f2762eb8c5c4914b126eb27d01d8a37b269b99b654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940709, "uuid": "9b354f18-0bd0-4176-8ab2-391cacbce214", "comment": "Malware payload (AgentTesla)", "value": "7303ab70f0c6df3f8d14a354c3722a8b3b506bc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940709, "uuid": "6c268e12-7915-4f65-805c-dacd7e2a1c4f", "comment": "Malware payload (AgentTesla)", "value": "9597b38f6a36911f923e91c4d6f3b3984e02c51c1dae8fead72eef5a9de920d331d5ef6235b84a12776e3215138c3827", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940709, "uuid": "ab2d2989-5f52-492c-a396-0c59b6159439", "value": "T10ED57C7262E3ED92D36F1F32C4E419004F60A8139679DB1DBDCA22971693760DF89B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940709, "uuid": "f5ad6eb3-d5ed-4add-9911-3566a66ac35e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940709, "uuid": "295cdc52-9e8a-41c3-a611-cb2dee2e3f31", "value": "24576:aOSFXL3c3V8NNRad5n0V4Q0l/JWIb1sFWS9Ot09OX7l348A5NysSU+wGXaDJ59NU:aOSxLsF4NMdQ0l/JWes8B8NIcXrG1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940709, "uuid": "6a8ae21c-7385-421c-a383-ff7a833d75eb", "value": 2904064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940709, "uuid": "c984fe9f-299e-4418-8c71-70daaf12f878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940709, "uuid": "7a614a73-5545-4913-90a9-c5ff5d594206", "value": "IMG_111534_7810pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91e8cb6-cc9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679921330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921330, "uuid": "ec7d3604-0e73-4be9-99e6-adbceabe3848", "comment": "Malware payload (Smoke Loader)", "value": "df685c46122667099f011d1e0e9e8c1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921330, "uuid": "883f8a27-6bf0-476b-9697-686d4d379c15", "comment": "Malware payload (Smoke Loader)", "value": "250b96f746d338ed309919b5afc0c885354fadde2c84e8f7a8d7b2cb6529a0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921330, "uuid": "4f8210f4-01b8-46ea-a6d7-de9c988ad092", "comment": "Malware payload (Smoke Loader)", "value": "a8b4de4b407295525646d815b6aac6b82b7ffa2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921330, "uuid": "927acdc3-6335-4539-bded-1b8526792777", "comment": "Malware payload (Smoke Loader)", "value": "db7768524e9d891ea6088c147ef0d6e9fed4e98e2e59f0645ed3be839234dd2407863d1635581c782574095a1cd9ed51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921330, "uuid": "7f8459fa-b05c-4670-aa6c-2dde1f031019", "value": "T1D044D0127290C9F2E4574135A825C7F86A3BBC785B158ACB3784276F5E387D2EA39343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921330, "uuid": "18f20219-c15b-4745-a0a4-8a69a8d28779", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921330, "uuid": "c54aa27b-f8a1-4d04-a1a2-4b517355791d", "value": "6144:d0ruZmEkiLz7ZM9MN0LrOOO8kVPR2xluUA:CdEki/7ZWMN0OOO8wPRKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921330, "uuid": "30f7ad0b-cabb-442b-afc9-d54d69a068ba", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921330, "uuid": "6904c7da-14ea-4db6-bdac-a677b329affb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921330, "uuid": "62a25338-36d8-4aeb-bbbc-6ff7cb6cb117", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "febe2eab-cc3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880645, "uuid": "3d655c58-31ac-4a53-b679-ea3afe3360f5", "comment": "Malware payload (Smoke Loader)", "value": "94441ad6e4cce0f1c8909601d58b6b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880645, "uuid": "01e720c0-022b-4a2d-82be-8df8d0ea4264", "comment": "Malware payload (Smoke Loader)", "value": "251a743bb992473b8ba4549105dc0e3359197afd63e5f31305e8fcc1db4e8b6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880645, "uuid": "c2b3f5fd-d0ca-4885-88df-eee6cfb96f27", "comment": "Malware payload (Smoke Loader)", "value": "d654f875a7c8cc3ca5a74b0021f643b16737195f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880645, "uuid": "fada1236-e465-478a-9c9d-03e6728c1c80", "comment": "Malware payload (Smoke Loader)", "value": "1f5b568c1d7146c086d10e95cc5009293170da1f7595ef14a88d396eb694c423bd7bf2bd88d266e7f1afff91daf7af31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880645, "uuid": "d8f358c2-820c-4174-b7ec-4f01ae6fd456", "value": "T1DA546C0253E16820E71387328E2AC7F82E6EF8615E557BFE16589A3F1971FB2D162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880645, "uuid": "9b011741-e026-4edb-a15e-4a922efc250b", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880645, "uuid": "57ba57ee-fa29-4bea-9e9d-98280fce5332", "value": "3072:XP5kzAoZAT8V9f66+bxKGYRfiCshV7/w4QuDxNVRlRn3oWNwOxep+h307vCJQN09:iXDebx/YxiCsLPxNPfn33GOc+h33Tfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880645, "uuid": "e9cd3f1d-9fc5-46c3-9cb9-331909c89b0a", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880645, "uuid": "cca33067-5c1a-450b-bfc8-ac2efe5f4326", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880645, "uuid": "7bc332e6-35a6-4909-87f0-b6fc7a2130cd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4079663-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679912705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912705, "uuid": "9df9c1e1-d1b0-46fa-ac7f-0f1f3306ad35", "comment": "Malware payload (Loki)", "value": "a14eb8db11d9222b2e08ab4b9787ce0b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912705, "uuid": "2b79fa10-73f6-45e6-8c6a-8b2422ab3a1b", "comment": "Malware payload (Loki)", "value": "27196e9eaf31ab1cbc64641706392b8748571eaa19dcfb419396ce1464910558", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912705, "uuid": "44e3b126-df29-4728-9969-5d6719aac2d5", "comment": "Malware payload (Loki)", "value": "728cbdf334d8133c1c3e6d638e0f94e5354e316d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912705, "uuid": "2329c771-0bf4-4692-a0df-879dc2b3c4b6", "comment": "Malware payload (Loki)", "value": "14b614e38df457d224ede4d11c461f42c2734bf107c066e7012268f6b761ea72a6233c7438cb6dff6e5f6fe9e2d4ac3a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912705, "uuid": "0a822863-adc4-432f-9f19-91f498f9408e", "value": "T171D22E0AE79E02B48B4112B3171E0AC997BDB63EB35055A1385C937433ED86D46BA6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912705, "uuid": "93ccdf68-913b-482e-9c2b-5d81173f3c9d", "value": "384:FQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZI/ptGd+EKPBAyYZOG0jMdxBds:TFx0XaIsnPRIa4fwJMabNpA1ZPxBbjGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912705, "uuid": "d417d1e0-db18-4a4b-8928-b35a864d4293", "value": 28819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912705, "uuid": "6e582019-0645-4641-bde9-dfc4aece2bbb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912705, "uuid": "cb6d790c-4853-45b2-8f68-25d60a3b09e3", "value": "New Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495de1a7-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679878193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878193, "uuid": "a656b746-73ec-4793-8c4f-6d538c33d6e6", "comment": "Malware payload (Rhadamanthys)", "value": "f600606cd9d5f6857810b47ae6d28585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878193, "uuid": "64666358-7377-4865-b8a4-90adf02d2e2b", "comment": "Malware payload (Rhadamanthys)", "value": "282062f074de941d9f095f71d5a1ee063385b09509c1a143da90a0cba4d32382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878193, "uuid": "4139a328-b7d2-4739-a3a7-fcdb791cabf8", "comment": "Malware payload (Rhadamanthys)", "value": "4a1bcaac14d1dc589450dbef717c0d58153d5881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878193, "uuid": "eb642727-0979-4da9-be9b-d6b3a4f95d0f", "comment": "Malware payload (Rhadamanthys)", "value": "2fc4303f10d7c5b2e8dbe2cec31892370862721e5e2a1c16060e25c8bb0cbe981f9e4e4617089f0a89a37750d752120f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878193, "uuid": "7cb896fe-0855-4a3b-8df7-e51d305b9e3e", "value": "T1BF447D2E93F46871E1734732BE1AC6F82A1FF8215E577B5E2649AA3F0930761DD62301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878193, "uuid": "b2f107d6-b0e8-47d1-92d0-01e9c7795e41", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878193, "uuid": "99e627a6-c530-4e12-8a78-9375a1596e37", "value": "3072:ZdxP8HA+RFAOQ3Sy+Dq+NV5B8VUozgAFM/NCL2QI8huf9FHpDMnDJjjJn78F:eHr6OQ3t+DW6HuMlCL2R8hgCDBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878193, "uuid": "e6f1d0a7-be8c-4efd-896d-c8571ba8b2b6", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878193, "uuid": "61c36ad1-5833-47f2-9d67-da3ed2a62e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878193, "uuid": "6b23b5fa-6073-4879-9d3d-b17d3ce3118e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943c2e8f-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679912678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912678, "uuid": "f68eb75a-600a-467b-bab5-1f45a01ef36c", "comment": "Malware payload", "value": "6512741ded1505a7b3dc528d8a337ee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912678, "uuid": "7102757b-8a6b-4b99-9540-1ce4f1d218c0", "comment": "Malware payload", "value": "282ec7ae0a46477fa57b4b0bceeed797b841893daa5dff9e9d6039ed18899098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912678, "uuid": "b0b9a301-6c32-452f-9647-baa2ce2d705b", "comment": "Malware payload", "value": "c216bae4540d95fbd69c8d49cbdd1ce468b435fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912678, "uuid": "8a25f778-afe7-4cec-82db-5b8563f60e21", "comment": "Malware payload", "value": "90e335f2f53658e9cb1282120eb0f603205e6322acd067228071feed06d8bc9a5236bbdd6fa85c91eb67ebf9e98fca35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912678, "uuid": "efae9a7b-47e6-458c-baa8-8038732c1601", "value": "T13923F61A3C53C073E40249B5C6D586C56FFF6C0336E3A07FEF9806495AE169C49AAAF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912678, "uuid": "b0b06675-75b3-4a64-9590-874ce230656b", "value": "aca77bb36f4ee9dc931c40d10b8cabe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912678, "uuid": "07107624-b5ac-4b8c-9165-78a6a4239864", "value": "768:1PaX1h9m+6NB7kUTI3TwHm3WPeFV+CNEtQ2:1a3m+Q7kU00HoWPeqTtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912678, "uuid": "2f4faf7b-7b82-4171-bb08-8f9e45c5bd91", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912678, "uuid": "aa7c1503-68ee-4488-b421-5db2a31b7844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912678, "uuid": "dfe068c3-8609-464a-a29c-3a68ca6f1682", "value": "6512741ded1505a7b3dc528d8a337ee5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98e0fbe-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679912848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912848, "uuid": "bfff9009-0a4d-4174-a590-5e2d67a7a08c", "comment": "Malware payload (Formbook)", "value": "fe8637b7f28206897219305735fdc407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912848, "uuid": "82a8e26f-f1ce-4c27-bf2c-d440eaafeb49", "comment": "Malware payload (Formbook)", "value": "28384833cb4f57932b5344a38245cc995941d7fcccc387a2ffa7f295c91108ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912848, "uuid": "f2d47af7-0700-4648-ad52-bf12b79176f8", "comment": "Malware payload (Formbook)", "value": "9aaa5209476907a311d9905ab0566aadd833be3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912848, "uuid": "82f9d49c-36d2-4cdb-84e4-232c6c85579d", "comment": "Malware payload (Formbook)", "value": "cf310febc5a0af5fc17ca05edc51f454a74b89e996559080e0cbcd5af8b0a0f7200964a662943bdf710b0f19fdb20c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912848, "uuid": "71a7c3a6-d1e6-42f5-a069-d1b84d94444d", "value": "T1EA7412461A52CDEBC4B717368FB92B065EA9C85A7490131B2F753B08FF72086935F283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912848, "uuid": "afe0d64e-1905-44fc-bb90-8ea55b929eb7", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912848, "uuid": "3cc79f02-faaf-49d6-910b-d9090478f64e", "value": "6144:H6+/tV8E/1E0OrEl4SrruvJp6SRaitECiNHITLVnxbSHl55HMlPLbQf:Pn8E/1EOl4aeJpFECy5Hl5WV8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912848, "uuid": "9b9a0e0c-1550-4845-9129-2c3133936079", "value": 352508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912848, "uuid": "e2a45add-8f72-40a6-b0a2-d002243a3266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912848, "uuid": "904ec65d-b487-48b7-b9d0-c031503e8690", "value": "E-DEKONT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dd0a09-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912364, "uuid": "6b444226-09bb-4518-af47-d877b2e54b3f", "comment": "Malware payload (SnakeKeylogger)", "value": "8324d5a7b1a9fef357ed965c7b68b55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912364, "uuid": "0c4332da-7ab0-4abe-a628-402991722956", "comment": "Malware payload (SnakeKeylogger)", "value": "285442f66366aab5b789ec12e4e484b345f4c3a5e3357841507ccb0d0049ac0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912364, "uuid": "70523957-8cad-4a50-9e9a-9299793b63df", "comment": "Malware payload (SnakeKeylogger)", "value": "4eae7c53da603e5e4d5c34ad0ca9588d86fc6c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912364, "uuid": "7f7d09b2-83e0-4691-abe1-7bc6827d28a0", "comment": "Malware payload (SnakeKeylogger)", "value": "d7636bd062e04ebdc1b78d3bce40b799669b8e9c95c8cb5467932f506e08ea1695779c56f4560ed978ed6130a6d901d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912364, "uuid": "e7d622ab-8e7e-4951-8074-33f4efc74916", "value": "T1DC358DD2F150CC9AEA6B06F17D2A993064EB7EDC55A4810C5A9D7B1726F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912364, "uuid": "089f3162-a42a-4d88-a45b-31fd72f93645", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912364, "uuid": "7d5f58f4-b59a-4551-9ccd-07d514890165", "value": "12288:O6UJB0OfVDpQ4eoZZbwZMpOv5DRSXiqMTAaIVenDtMGtTZJhZ:OjC4ndOv9QiaQBMGNPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912364, "uuid": "24ffd5d8-2994-4630-9569-c022bbebd00d", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912364, "uuid": "56efae3c-e0a9-4854-86e9-0fec36fa2cca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912364, "uuid": "38ae186b-8495-40a9-bd8f-030d1ffac56d", "value": "sira ters.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8412951-cc3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679879292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879292, "uuid": "efa652e9-8985-4860-9e4f-f8ea49e20922", "comment": "Malware payload (Smoke Loader)", "value": "f2ffa208b5ee6217d81dd0baf95b745a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879292, "uuid": "1a6129f9-a2bf-4435-bd1a-61ead631815e", "comment": "Malware payload (Smoke Loader)", "value": "285c06a95d26fe21cc328cb19073bc4285a12313d0ea47ce293fac3de71a979b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879292, "uuid": "0e397b54-958e-4f67-8f17-f6dd388c1e71", "comment": "Malware payload (Smoke Loader)", "value": "a7086dd4d59204bb041883a02c64d3d368d39424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879292, "uuid": "dd604c74-bad4-4b83-8eaa-79dafd90e1ac", "comment": "Malware payload (Smoke Loader)", "value": "5d2d01c366d18fd48b09220a1617b4231a9b2c87f5f7dcb73f428b4ee0203e07722f473084d60d9a89e5a661b6f1463a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879292, "uuid": "082d01f4-088a-4c94-a508-6260e73f06ca", "value": "T1A2546B3262F06861E563D7338E2BC6FC2A2FB9219E157B7E12495A7F09702B1D172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879292, "uuid": "22bcd2c1-0229-4b02-b329-c9f696e8484d", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879292, "uuid": "2a52eaf1-3f61-4aa1-a72b-9035daf6b958", "value": "3072:13YPCOt43uLvsLuxVu6FRbZDh4wJJBcFD2cYdKwkRxAzHB+/ypNN4TJY:Kguv2ux9a0MWMBYo/INN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879292, "uuid": "cc9b47a2-79eb-477f-a7ef-5506d529944d", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879292, "uuid": "76f3a509-d4dc-4d10-95ce-ae1d2fe1d217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879292, "uuid": "cddefba7-9eef-4559-8e85-5bc84fe4de3c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8175d81-ccb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679929999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929999, "uuid": "384db2ad-1665-4b7c-a54c-2a29cd0cc37a", "comment": "Malware payload (Smoke Loader)", "value": "aa716a47e1edf2eba2fa4039ab307da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929999, "uuid": "dae979e5-e655-432f-86fa-ecade7a27b23", "comment": "Malware payload (Smoke Loader)", "value": "2940392a683880d056c8cd8227d44a1a307b42905df31a09872bb651c23fc110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929999, "uuid": "ff067356-4449-43ec-8b9f-346fb32a1658", "comment": "Malware payload (Smoke Loader)", "value": "ec398c58775ff11f241b17b2c0561e156a44bc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929999, "uuid": "ef1ef755-4f0b-4975-a78e-adc040ff5bd8", "comment": "Malware payload (Smoke Loader)", "value": "b38f2fbe682c534bfd5fe7377665d601f83112c2f5b8785ce0b19b85556e51854267ca60addc0e59c91dcda28ec61184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929999, "uuid": "7e18d18c-2e81-44d9-ab6c-6f7e30762b0a", "value": "T1EB44DF2272E1C8B2E55605398825EBB55ABFBC705B6586CB3B94537E0E313D28F36343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929999, "uuid": "dc62c23e-a707-4046-b2de-5d29736af569", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929999, "uuid": "a6b3ab4b-8352-4acb-b108-5146d949a27a", "value": "6144:S8T+GUkLLgUPCTqybV2NAG5g5ZdztRn7:xTUkL8UqTqyV2wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679929999, "uuid": "1ee89cfc-9f42-4a7f-9c7f-81bb3bd38353", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679929999, "uuid": "eeeb0fb4-0cc7-4edc-86e8-0a688bd863c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929999, "uuid": "e8137d77-0958-4258-850a-1945f2126d43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3670e1-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679894898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894898, "uuid": "225de0c4-631c-4e86-b100-6a226ae7815b", "comment": "Malware payload (AveMariaRAT)", "value": "1e083bd201fe14037fe76f75d8311368", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894898, "uuid": "4ccd6444-4b6e-4f68-bed8-e0186c202412", "comment": "Malware payload (AveMariaRAT)", "value": "2a35c92620e14bd31b6ccdfdafeaec0ad6113d4bf30abc950210c64488763a1f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894898, "uuid": "14133e8e-248f-4821-bf8f-c0045061d259", "comment": "Malware payload (AveMariaRAT)", "value": "2ebbe13bfce4d48eda0fcff8f82d8bd8127bab29", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894898, "uuid": "8343b938-ce9b-4422-a13d-51ba9e6cc0a3", "comment": "Malware payload (AveMariaRAT)", "value": "80fa4a2fabd62c093e8e8a3d927655020e9dd699c5b3faa1f74d02b29714dbc3f9bfae00c1b622ea0a56f9aed37e97fc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894898, "uuid": "e9dbe950-8af8-4485-9dc7-1ecdb7b6915e", "value": "T14EC55BB112A3FEC0D37F1D35D44426408D249877A7ACD28CBDC42AA7A3DA6B4DF586B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894898, "uuid": "60713b6a-d07e-43d9-a8d3-a3612982ae20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894898, "uuid": "58501ed7-812c-4618-bd60-6ee4c7db4696", "value": "24576:Tr768L+AX5H+NeYKtu1Dze6HDpLgIyge8wVp4UdPFqkby+gKOCdVvGBF3LjAPOzP:b6iVIRe/7Py/4OzMvI+zQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894898, "uuid": "379102c9-2469-4d86-8577-c392334897e7", "value": 2633216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894898, "uuid": "c1939ee4-9469-46c0-954b-8a57ab133314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894898, "uuid": "827d2b29-a1f1-4ed2-ac27-ba2a2f819956", "value": "CTM INSTRUCTION_MV.PACIFIC OCEAN-20230321001^pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a58a30-cc54-11ed-88f6-42010a9c006e", "comment": "Malware payload (AZORult)", "timestamp": 1679889669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889669, "uuid": "dbf1af16-493c-4514-8cc6-2c2e2dd92bdd", "comment": "Malware payload (AZORult)", "value": "baf9ca75d335e33b6bc63ffe2f7149d9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889669, "uuid": "259ac784-8e07-43c6-9ec8-f0066e6da545", "comment": "Malware payload (AZORult)", "value": "2a3b9417a90179a848e9dd0cb628bc88042d284505901f092aa77a360c09e405", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889669, "uuid": "30d9c0d9-56e1-4f7d-b182-2cd6fba6efc4", "comment": "Malware payload (AZORult)", "value": "3e4c29a668ab5db7a2e3fc3ed0d7cce90cd3111c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889669, "uuid": "c57b1901-16a6-4ce1-863b-4fe1945aae70", "comment": "Malware payload (AZORult)", "value": "975aca01b9d29b81731f2b18b1cd8e813eae3860f47dac366de31e01d4166f43a1d4ab1e3d433257b49dd9d8fe6cd923", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889669, "uuid": "0331874d-274f-44b8-8d90-c932ea58e97b", "value": "T11324F1956294C167ECB20631163AAF461ED7ED2628D426076341FE9F3A73382EC6E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889669, "uuid": "87613ffa-3d6b-410d-a982-9cd7c7ca35e6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889669, "uuid": "ff895ebd-6035-4867-b5c9-b4d75d43b244", "value": "3072:2fY/TU9fE9PEtu4TSkvVcbloANFF8WA1LBLoNFhqdxG3ZIPFpVDCWh8Y6N3+j5jX:gYa6oBAloAipdoj1pYxedG56bb6RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679889669, "uuid": "866b9298-6e42-4ad1-b8b3-761f89af42e4", "value": 210492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679889669, "uuid": "74171251-6ca7-4e5e-86ec-152069b7c44b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889669, "uuid": "a342c2fc-6039-45fd-855c-02001195761b", "value": "baf9ca75d335e33b6bc63ffe2f7149d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a23647-cc3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679879021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879021, "uuid": "586e746b-7ac5-42ac-8c78-67ffc86edddb", "comment": "Malware payload (Smoke Loader)", "value": "bbff5523ec2d855e9c4b14bddbf3650b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879021, "uuid": "01514dfa-9299-4140-8117-bb6a55523628", "comment": "Malware payload (Smoke Loader)", "value": "2b1c09aeb66dbd7982089575ea49d55564642b5752abbc0586b4d6f50e16c149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879021, "uuid": "8fe5e115-7503-4297-943c-ace5311865ad", "comment": "Malware payload (Smoke Loader)", "value": "00f9e4fb8a787b711f75aa64dbc63a8732cb713e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879021, "uuid": "c35b87a0-42bb-4d3d-8b1c-08927245816d", "comment": "Malware payload (Smoke Loader)", "value": "75521f75d0534bb77ae1791a9b13f40b1422d36dca75ba6cd170af5e34a37c0aad8c137a35ffd0ebd99cc99d17410310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879021, "uuid": "a6438bb4-ce4c-4c1e-9ff2-9445772acfcd", "value": "T155547C3263F06860E163D7328E2BC7FC2A6FB9619E157B7E16555A7F09702A1C272334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879021, "uuid": "537c62ea-e8a2-43f6-88e8-a2c83280efa6", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879021, "uuid": "3979a867-c19e-4697-a28c-99e327fefc41", "value": "3072:z3Uo6ySkvufjvrHedZuqB3qbZfIxfaHcnHj8SOwoWjXsoG6/uLpNN4Th3:kEajvLedtzftn7GZ6/eNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879021, "uuid": "5ff97029-aa9d-49bf-9675-c307babcc334", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879021, "uuid": "bf4038af-de9b-4d79-9e3c-04a995c0de6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879021, "uuid": "78b86b28-0dc6-4134-a93c-d71769319978", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c68298-cc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920618, "uuid": "5a5754e9-8d95-47c3-ab02-673fac451099", "comment": "Malware payload", "value": "b545eeb0fc5312fa44c44656405c4650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920618, "uuid": "0c6fd5ae-218b-42cc-9211-6695b83c8b10", "comment": "Malware payload", "value": "2b31311b62da5ef612b3c8060456914fb0e23e095a79ad21b0c9e05569016910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920618, "uuid": "60ef381e-1fce-46b3-a0a9-e4ce65c5082c", "comment": "Malware payload", "value": "b4d549feb61e5584f304ec0c80c07de240824663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920618, "uuid": "a51d7420-8384-4daa-b379-ba0dbb434b56", "comment": "Malware payload", "value": "aa15cca852b1313ac806d4db1771d9025df46f26c93d83ba07f80877455a2927a70a3a2eed3f3b73d931a0592a901406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920618, "uuid": "f9c65e22-e45d-4c1b-9582-2a3bf2e05dc7", "value": "T1A8E33A21B6D5C071D4B340B243B8D2A6667E7E72976989DF6BCC4D0D0BB41C2AB36363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920618, "uuid": "5219f21f-1318-4af2-a4ea-53345e70aafe", "value": "e93b0fa594d670a466cb6a5c504e254c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920618, "uuid": "a0b82069-6c17-4585-8e41-c7649aee34e0", "value": "3072:9yCId32Q5MsDxVxb95Xwy/S83pRSxMl1vUhAd:9yCId32QH595Xwy/N3zqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920618, "uuid": "599e56f6-6cd4-4473-ba17-893f10018150", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920618, "uuid": "fc2051b3-dbd9-4f07-bd8a-ad2c1df31ec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920618, "uuid": "21c65fb7-b13f-4207-9c43-bcbcec5b22b6", "value": "SecuriteInfo.com.Trojan.Loader.1363.7772.14132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ed8bf3-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679901835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901835, "uuid": "9a92306e-dba2-418d-aa10-ec151f154967", "comment": "Malware payload (Mirai)", "value": "6413cb19185b88e91dd33df118ac2526", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901835, "uuid": "bd1acf54-c6c8-4069-b1b9-93ed491e76cb", "comment": "Malware payload (Mirai)", "value": "2d4d2c4098487e13f26e6aca082e4d3bf52a9b78a9cb2fc6f857bca5602c732a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901835, "uuid": "0a20e76c-97d3-49d6-9f8d-9dbded58f271", "comment": "Malware payload (Mirai)", "value": "a73fa8452d5bf8133de2f5c4d180180a7ca7e894", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901835, "uuid": "c05b31f2-90a7-45f9-9ada-21380be4ca81", "comment": "Malware payload (Mirai)", "value": "0d8d87231edfa78188e5abd97a2cabf2b2c694f1691fd086bde9c3e05aa65ba937449abba91cb33f49cc0f8c16d7ca23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901835, "uuid": "c0453f26-bc41-48b4-a669-2c8c7a476402", "value": "T108E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8279B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901835, "uuid": "8ea7f628-2b92-47c7-a2d2-ac8a7ddafc21", "value": "3072:CJLce3pCsF7naLHbz4N9GUJURIJ1FuEXkkTM/9AIMY:CJLc6xnaLHbz4NMUJdHuEXkYM/9TMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901835, "uuid": "56823b19-f4dd-430d-a9ee-8f590a8cd133", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901835, "uuid": "284cb3e3-8e08-4cee-9c38-7bbee1b11f33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901835, "uuid": "f3d710d4-6b14-4bcf-af93-3fbe11ea5a22", "value": "6413cb19185b88e91dd33df118ac2526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275df931-cc72-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679902617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902617, "uuid": "918d61f7-c36d-43cf-9ace-2896da453353", "comment": "Malware payload (AgentTesla)", "value": "2b42daa4c780e6667bf1332bee8cc9c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902617, "uuid": "f283d13b-9df2-41de-b0ca-5ea7e5174dc3", "comment": "Malware payload (AgentTesla)", "value": "2e43f9ff0c17b624f2fc1ac1f742e546d8ef02a23eb9eb8e430138bf15a411b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902617, "uuid": "94290fec-9342-4a75-8215-7db45abef152", "comment": "Malware payload (AgentTesla)", "value": "a9cb05c76231ec14b35e256c2f93312b3a990fd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902617, "uuid": "2cdd24f3-6982-41a7-abd4-dced4e148124", "comment": "Malware payload (AgentTesla)", "value": "7a27b3ee5417ee5a25f12f6bf062b028d8943871619850f0a7ade44f200e23254909f1a974b639cb4596c9d406e4e2c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902617, "uuid": "1674953b-a614-44f7-8a77-2e9b55ae3316", "value": "T159F4094023F8C61BF1FE57B1E47115180AF6F8C5EAB6E74E2948E1E91C62F019A4277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902617, "uuid": "032d9c62-dc52-430b-9b07-568d0d333c9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902617, "uuid": "c83b67fd-3c02-4e7b-a43a-0d07b2e1460d", "value": "12288:8Wr28gfftwgKmc4xVVevCKOCA4b0VuizwSBLfZdHZg3:mfqgYvC7CA18SBLZdHZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679902617, "uuid": "500e987b-3b00-4081-a389-306b55705414", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679902617, "uuid": "850f4676-b432-41cd-a220-71afd27346dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902617, "uuid": "2c74b7c3-f8a6-4aba-bc64-1dca18657bdd", "value": "Zam\u00f3wienie Z2300056_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9942b315-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904956, "uuid": "f63d3dc4-3ea3-4f27-8a6f-6186374681d2", "comment": "Malware payload", "value": "58a9572e9e6ef2f5468ebc353c6c529c", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904956, "uuid": "65b7d3de-1948-4f29-b85d-089049d99e67", "comment": "Malware payload", "value": "2e5325c0bad5dc2beec825ad8dbec6bf2b189ca07b48de6afa8bb51ee417567a", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904956, "uuid": "ce3d287e-153c-47b6-95c4-3a23661e2e0c", "comment": "Malware payload", "value": "8fe484bfc5d7a352e68e5088ee46c35572b87121", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904956, "uuid": "7c48eac7-c869-457b-ab84-355246dba290", "comment": "Malware payload", "value": "8f8304b139e32c57969538e180168b4af70fe164b2b7ea0e01fb8714ae3eac41115b0af96ba18f38cb62ab31d0577380", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904956, "uuid": "33d5fd67-44ec-4eb4-9bfc-345935cc5ad6", "value": "T1563412E52A5C2A9EC1E88072E4FE9BA6768149E1174FC49419C1BF4D4C4BEC528F5C7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904956, "uuid": "e0ded277-ce70-4bd8-8f3b-c74ed4f4aecb", "value": "6144:OzewLfbQeFxzuK3v3joSeqT5pZvSVl/RZ4V2VVToKgZ:OznfUMzN7Deq9pZ8j4V2sbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904956, "uuid": "cef5cb0c-d123-4dd5-a9dc-0a13e5cf93b9", "value": 244390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904956, "uuid": "27e5696a-ff69-4b82-b959-e6bce2f00f3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904956, "uuid": "fb4e0c73-63ae-4bc2-ab43-82e6267e4f0b", "value": "z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816ac1b9-cc8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679913935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913935, "uuid": "46029411-369b-4602-9351-ef87c1a27956", "comment": "Malware payload (RedLineStealer)", "value": "ab1b2af5a93dabe86d6c1337aaf926d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913935, "uuid": "e314a90d-6ddc-4c32-ba43-82565cbed383", "comment": "Malware payload (RedLineStealer)", "value": "2e7d10e7f46b4e43878693428315971c874892129af53911f7ed52d4d4005c2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913935, "uuid": "56be619e-f2c7-4ec4-9dc7-2f1bd260c6dc", "comment": "Malware payload (RedLineStealer)", "value": "0e5fc8fa28432be9d4d0af433fbe0696f42424c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913935, "uuid": "8c61fc89-d664-49e3-98e8-68788bdf788c", "comment": "Malware payload (RedLineStealer)", "value": "74df5087e36bb0f75df7925b730ce25b1b529b8ef1440750453ddd3014efd8a5bf55af9bec9172d9ee48a1dda2c81aa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913935, "uuid": "06b7e559-1b11-47b5-adde-5b9db95485e6", "value": "T19325230AC7E88013C5711B702DF502D31936BCA2A975976B336AD98D0DF3688B5B27B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913935, "uuid": "e2be0aa2-9663-4aaa-98b7-f9cbae7e505a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913935, "uuid": "15bfa6d1-9f8f-4345-a934-a5d549205291", "value": "24576:ayaYSUhoa8yzx8S0vbpq1Rzc6YXXFpYwmhXh:haYEqyqPID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913935, "uuid": "8afc2b8b-555d-4a9f-8d65-89a840fdd9fe", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913935, "uuid": "2b4f9525-ed40-456e-87f5-a8f382b94547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913935, "uuid": "07c2e63a-3601-453f-b53d-cd473a7af25f", "value": "ab1b2af5a93dabe86d6c1337aaf926d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfece88a-cce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679950601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950601, "uuid": "fb550b44-5398-4be2-9314-71f2c18589be", "comment": "Malware payload (Mirai)", "value": "8bdaa8b0898a509f7408b96c987750c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950601, "uuid": "18170ad1-5b03-4cb9-88f0-5e6f830b1aea", "comment": "Malware payload (Mirai)", "value": "2ea118d2e08dda29d710c3c615c3ab0b48d6ffdecd90789bd88df0a4eb11030a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950601, "uuid": "be775214-0049-4f68-b859-deb9d7232792", "comment": "Malware payload (Mirai)", "value": "9eebf7b6216ae076c6515a950555ae2a4a478fd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950601, "uuid": "2ab9406b-a525-46bc-832d-1d1a319e2a65", "comment": "Malware payload (Mirai)", "value": "b8b6cc333755d0778cb5981b31583a5f8f44d2e05af141e7c241ef3f5c1054e9f7fb4952d5bcda2762a7a4d10047aec4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950601, "uuid": "17567926-b948-428d-bd89-5ac871d5659d", "value": "T11AD2E1E37A6B43A7CC296736E59ED88372C8F11B617B6304B7C5EC1443E5A5861CBC84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950601, "uuid": "6b1eb047-1d08-47e5-a22c-96dd9e3897f1", "value": "384:Mq8C9FzBjK3Dj0utDCtUp5bYTjjBUewGsk5nId6eZjQxkjBtegqr/74Asr753yY:L8+HjK3vVFCtwKjBNwGsbjnt8EYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679950601, "uuid": "916c1850-2f4c-4e6c-ae9e-d13cbac9af68", "value": 29520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679950601, "uuid": "8d2e0989-f517-4c46-b4d8-f3e17671e62b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950601, "uuid": "0286cf4b-5018-4aa7-b4dc-50cd8bb64fce", "value": "8bdaa8b0898a509f7408b96c987750c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f9bb4-cc38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679877827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877827, "uuid": "d889ec5d-22d5-415d-8acc-da6bf19b4eb2", "comment": "Malware payload (Smoke Loader)", "value": "b5dd0b46e14943acda5a2f16c232afde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877827, "uuid": "305db0c7-6423-4a6d-8455-8e7532a56927", "comment": "Malware payload (Smoke Loader)", "value": "2ecc7930f5239a83d7e5382c4dfa4a4af5a391a42afc7bcb205633d2b5cb22d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877827, "uuid": "187c27a3-c000-45e6-9e16-ce2c495a7e11", "comment": "Malware payload (Smoke Loader)", "value": "54d1d5b615e7fbe7bc1549ec48a4b2f7db80d385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877827, "uuid": "4900ebe5-52f1-46ed-970e-a2a2ccd61503", "comment": "Malware payload (Smoke Loader)", "value": "145995ec433a315637e62b6db5276fb756dbd2e4d0936e0a4f2db9710487b02714bacf5a969f97a9579c1ebd48da58bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877827, "uuid": "fc65e4a2-359a-403f-a20b-da6c290fc48e", "value": "T10C448D2E93F46860E1334732BE2EC3F42A1FB8615D177B5E2649AA3F0970761DD62705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877827, "uuid": "5464eb6c-327d-4b67-86f4-f815bbd03893", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877827, "uuid": "65012815-a614-451b-be1a-eb9518599728", "value": "3072:suLqPk4A+RFA7bo8q8cH+1zrBhEEEEEEEbeVqSGLm+/PQ8Ijdr3n78F:z4LC7boT8chuP+udr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679877827, "uuid": "4f3c6a43-2093-41b7-ae27-9309384d027d", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679877827, "uuid": "10d83ae6-472e-4006-8d85-06dab21fbab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877827, "uuid": "9c2e1884-21e2-41ce-9dc2-afd61bae7cac", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe0500d-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (GurcuStealer)", "timestamp": 1679912564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912564, "uuid": "c66b3c71-00fd-464b-84bf-319b80776c3a", "comment": "Malware payload (GurcuStealer)", "value": "38fe6bfe203e2a468dcfb58135ec7cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912564, "uuid": "1bb0828d-0f0a-47d7-a29c-afee96878b12", "comment": "Malware payload (GurcuStealer)", "value": "2ed5f76c682961361e24932c589d73ee7c4819c2bf60c32227f0c5a6e36d4768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912564, "uuid": "03397b0e-6367-4162-9300-e1ce2a96ad30", "comment": "Malware payload (GurcuStealer)", "value": "f2cda87f34be01b6eb38011b3397fd1fb4d3d9e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912564, "uuid": "001ff555-a205-4e53-87d1-d0b5aa873bdc", "comment": "Malware payload (GurcuStealer)", "value": "f34dc38a1c1222a90a85359c06f7c9d7e6a7ba461337a327f56ea4fa1404eb8eabfe2ca87da85d88c27c9d40905bca9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912564, "uuid": "6e4505f1-0895-4dbf-a1ae-321aae7163e0", "value": "T1BCD21906B364C235F99E4B3BD8726790177483437B02FE4A5CDFB155AEC37982A83A58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912564, "uuid": "0b8708db-df81-4d47-a866-705334827079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912564, "uuid": "c83970a6-aea3-4335-be38-d5a3b104a468", "value": "768:Kkcwn4ufsThBbbaW8jrEpqX7Kv7RHkZPA:jcwn4isTHbWWk6NE9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912564, "uuid": "ce5de041-081b-4202-bf53-ece299bd2473", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912564, "uuid": "b68da73f-7620-45f0-8121-792a4038135c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912564, "uuid": "4dd90447-5f2e-46e6-9515-a8f7edf9c514", "value": "38fe6bfe203e2a468dcfb58135ec7cf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306b3d0d-ccec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679955031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955031, "uuid": "2a29f961-5f70-4046-a18b-6513d6bb1478", "comment": "Malware payload (RedLineStealer)", "value": "9744d48a89a883ff6ca3a33dc419001b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955031, "uuid": "a1c96ad1-6410-4b04-9b33-f3c2e08b7419", "comment": "Malware payload (RedLineStealer)", "value": "2ed78a7170336d23af7b56c93a0c38c7c041e135ee38f52375a61a3245eb02ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955031, "uuid": "487ace98-d44d-42c3-b588-3c6826ef60b4", "comment": "Malware payload (RedLineStealer)", "value": "e0d406538b3fa79ac96f07ceb0ff8bd99fdc7438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955031, "uuid": "2b8ca962-a4b2-4743-b9c9-30e14483a8a3", "comment": "Malware payload (RedLineStealer)", "value": "a06dae2b520afa087cbbb0981b71e69183dbfa736ddbc2f2550afb20c9ea686d1c27d6c7db962029ed7a3d78d8179b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955031, "uuid": "d4606535-2633-4a20-83ff-8b3ddded0c3f", "value": "T12A54071B02E48E2AFCDEDA7D919A22509C5F39E3ABC5C2CE179C954B0558B5C703AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955031, "uuid": "1c8a28d3-671d-4f59-81bc-d7869f7c49d7", "value": "67a13e475a7159590c30461a3c5d1a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955031, "uuid": "49e0f283-4293-4615-a714-ac0eff78d4b5", "value": "3072:U1L/wDkkPHR8Vhuy+tQ+ZV2BX7PhHVD0SH2VWS6cYDT6QALnxGL6L5RR26l11Uq+:o8vRvtQ8YX7Ph1D0SWVWS6cYCLnmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955031, "uuid": "8125d9ca-9690-43cd-9dec-8a60c99d9e59", "value": 302344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955031, "uuid": "2a7652b4-7cfa-4616-8f78-45199d17fb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955031, "uuid": "505009bf-68b5-4381-9c25-789bb0b20e6e", "value": "9744d48a89a883ff6ca3a33dc419001b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a5a818-cc9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679921106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921106, "uuid": "bfe3d197-36cd-415c-b9b1-12b7de0cd5ab", "comment": "Malware payload (GuLoader)", "value": "613c37b75995fde9ae189d6abd621bb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921106, "uuid": "268fab1f-e5eb-4ae2-8025-1b448c50c4a7", "comment": "Malware payload (GuLoader)", "value": "2f9f913f5802b9bda523ef9975a5d9cc478a8cda4720727beab9a6bd3cd1c91f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921106, "uuid": "251863fe-ab9f-4fa5-80ae-8a738cb1cc58", "comment": "Malware payload (GuLoader)", "value": "712cb0725f81257bb1b7d132487dc1a21b7e6e41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921106, "uuid": "6206ddf2-0219-47cf-b56b-9dfa67d1f485", "comment": "Malware payload (GuLoader)", "value": "4ce38d97d12d7c7d978b0ccd3b2bc8066dfb479cff63e6367f6e2449d0199e0e2120cc8990948960de657d98f04f54fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921106, "uuid": "1c1f4f6f-f860-407a-b609-9eb33d7aa7f2", "value": "T1E8D4CF90D298FCE6D4073475BC3DE522290BAF1F9738081A376A7D156A7339324AAD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921106, "uuid": "b77786c0-59da-43a7-8ca4-d42f825d29ae", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921106, "uuid": "3e1d184c-b7b9-4b94-aa71-8b8a54836708", "value": "12288:arAERjMZ+P/SdJBFrbsYiLaIWF3POv/rQiD2nNoUnn6JzLJ4QNO:arAE++iUaJFGHcFNoUn6jdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921106, "uuid": "672948ec-3220-4f92-834d-a2887f0a405e", "value": 648032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921106, "uuid": "8c397c11-41c1-410c-873d-e1d6411b0157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921106, "uuid": "5662bc9d-c87c-4b30-9cae-7236fa84ee90", "value": "Aperistalsis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf81e8ae-cca7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679925636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925636, "uuid": "2f075240-50de-4def-bec9-9e75da44e0d8", "comment": "Malware payload (RedLineStealer)", "value": "3d5f2336caf9a81a843418d9819a5c2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925636, "uuid": "8cdf45c4-112a-49c9-ac90-c73e62eb6795", "comment": "Malware payload (RedLineStealer)", "value": "2fea6af2b1d327967a46c3228132be457cfc6d670b7e2bbd50d546d844fc77c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925636, "uuid": "ebaa44ac-a545-4f12-9b14-810fffe683cf", "comment": "Malware payload (RedLineStealer)", "value": "1124f2066f99f835735be52492e0d5716dc25445", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925636, "uuid": "3c70cab9-0ba4-47e1-8e89-eff548319306", "comment": "Malware payload (RedLineStealer)", "value": "af7be3149c9d73289ea192473a8b3aa602775ef3411953fac37680aa538a8c12a31c9147299aca8d563675292760401c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925636, "uuid": "3ee9e4ba-c95f-4cf4-89e3-4d8e11d94bfb", "value": "T122E41203BAE1C0B3E2464A754557C2F08A7FF8759F6582D72BC4666A5F382D0CB3A385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925636, "uuid": "3c3005d6-7b32-4492-bf63-7bebf05f42b8", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925636, "uuid": "f0eef9e9-6ba8-4ed8-b8f1-caca163416d6", "value": "12288:8K7KRc/2qg5H3fNrHqZ99foYUtoBsaUleNc8EfSzAON8ymWJtMsOYyBu:PmI2tH3fBHqZnfoYUt4rUleNECGy54bB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679925636, "uuid": "56682578-163a-4658-9a1c-0e726df35d7a", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679925636, "uuid": "090a08da-3f35-476d-a9b1-e590cd321f65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925636, "uuid": "6534f46a-ae07-470c-a590-cdb794474330", "value": "3d5f2336caf9a81a843418d9819a5c2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb34745-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894922, "uuid": "ffc698e9-2cda-446c-b3ab-7f75884863e8", "comment": "Malware payload (Formbook)", "value": "3e872be3033224c36cc17cccdd0db5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894922, "uuid": "b8e8ed26-3d21-47e9-8dee-ead8fa1c4654", "comment": "Malware payload (Formbook)", "value": "30c25464c1c21db7b22b1c479912dbc7a17f9f5772016507e3afab04ed8367d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894922, "uuid": "02f60d1b-e0f8-413b-94f2-e0fee0aac349", "comment": "Malware payload (Formbook)", "value": "2c2c30b58846ad4abd8cf9afc7c42e77ed0671d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894922, "uuid": "862218f2-d9b8-4ee7-8a2a-d89337018064", "comment": "Malware payload (Formbook)", "value": "0efecd11c6730b63f5ee036dbd7ea8403879129ad06624709846615b7a701488a8ad3ab5919aaba5b299179dd94e1e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894922, "uuid": "2d505bfa-8f84-4f47-9301-5358af3158ea", "value": "T1C4F42316BF838AA0C4A977B964A542C10374DBE852B3C6AD5BC024D8FF773650771EE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894922, "uuid": "46823b55-fe37-467e-ae16-1dd37931c750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894922, "uuid": "ceecf0bd-b588-49ce-9977-03f43578cd50", "value": "12288:7eqYCzl06/TgTU4CpRIbGut/uEP8P4OHz0NqYxl+/hdiHrlexiWiNLkphj7xHTxT:rl06MFCput/uuROHYx4/eoTiuTxzxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894922, "uuid": "fd6ace34-74be-4a67-bc79-b34147f24d36", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894922, "uuid": "79ad97c5-41a7-4aa1-886c-be8ce2d5bbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894922, "uuid": "87297294-035a-41a1-81e4-1fb5ef039d73", "value": "PI n0. 8234.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aee1325-cc3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679880048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880048, "uuid": "e1745798-d816-4c6b-bc28-61e87956b8e8", "comment": "Malware payload (RedLineStealer)", "value": "ed98e4e84979b44ae1032328ea645fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880048, "uuid": "4a28bb45-d7d4-48f4-bea9-cb44f02398a9", "comment": "Malware payload (RedLineStealer)", "value": "30c6ce18a0862dae4160a119ddbc2d21218b07486a5d9a10925acbd91b10b322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880048, "uuid": "543574db-1962-4e3c-9f7f-feb1f67d514f", "comment": "Malware payload (RedLineStealer)", "value": "05cf59739c57aad18508bba5d384ae2756703849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880048, "uuid": "2ac0acf8-77c5-4622-8d89-7713628a8348", "comment": "Malware payload (RedLineStealer)", "value": "d1e0f6f630d18e459cf087c1f3e29f81c82a300fb8ea19a7dac6296b53bbc13677dcef831de4dd1efb9c2423d6042dc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880048, "uuid": "4bc3815a-cedd-43d6-823d-ffeeb915d7ad", "value": "T1C62523139AF8D46AD8F123B15CFA4B870E327EE25EB8821A55855C4B0CF37D456313AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880048, "uuid": "5c28b1a7-3b3a-4bf1-a4c4-f7201ad7ae8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880048, "uuid": "e9c845f5-02da-4908-8208-06a0cbd58354", "value": "24576:eyED5hKKLXXtucUk10+xKINld9w0AMZkFpKBA0y:tEDaKLXYcN0+R9zVZkFqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880048, "uuid": "8ddf551f-b7bd-4db0-a3b0-b9409a7598e4", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880048, "uuid": "c3341278-4bf3-4d59-8e93-54105d0e6e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880048, "uuid": "88c2c849-775b-4e3f-ba9a-ca87c23bedc3", "value": "ed98e4e84979b44ae1032328ea645fe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2dce46-cca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679924150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924150, "uuid": "082af5a3-e841-4dd8-b9aa-fd1b8890056f", "comment": "Malware payload (AgentTesla)", "value": "de3409f5d14c9b23a29ad18de6e35446", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924150, "uuid": "f2f2321b-63fc-4f69-be1f-14d7f45a9f32", "comment": "Malware payload (AgentTesla)", "value": "3128770f8c211d4bd2c1b4341432ba1fea73d4576091d7eb8150ac126fd1b985", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924150, "uuid": "f19734e5-f3f9-496e-a3bc-36f56ca294a2", "comment": "Malware payload (AgentTesla)", "value": "31f314d797a7baaa73815318010134769b0cacd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924150, "uuid": "96b1ee03-e07f-4dd9-9dfa-3e744f7d5b0b", "comment": "Malware payload (AgentTesla)", "value": "41608dea71f85897b5ceb8f847652ad8ec3a5ec04c7ccb1d58092d083084a6f2bc81581cd93d624bb43a25ab617f4433", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924150, "uuid": "497dff9b-6bc0-4ea0-b3ed-3338dc41f828", "value": "T19FF4E64027F8C61AF5AF5774ACB409380BF5FC86B2B6E74F1A44B5E82862710D9507BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924150, "uuid": "bf0ffe8a-c8a0-4f23-9c97-b2f6706602bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924150, "uuid": "983fa719-fd02-4301-8a97-0d62fc6d10b5", "value": "12288:gev/GZe1bRQHemDpJm7NngFXgykV1bBiFs8dVjg:tQHeopRFwyEVBiFs8dVjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679924150, "uuid": "152139f4-62b8-4fa8-8f3d-1121ab5014ff", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679924150, "uuid": "09d4bf52-0c35-423b-ac8a-6c077275c9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924150, "uuid": "6a52b4e0-43c8-48c5-b253-245951ef4caa", "value": "de3409f5d14c9b23a29ad18de6e35446.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d1a497-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679901856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901856, "uuid": "c7c2322f-5adb-4337-b222-e36ecc91b835", "comment": "Malware payload (Mirai)", "value": "4206a52c7ffedbb3ea34369e7cc35413", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901856, "uuid": "59e594c9-00a4-4929-92f4-1386224d62b0", "comment": "Malware payload (Mirai)", "value": "31a13b6b7f6b63c34bdf7f68153dceffb93b022374940aeecea5238de1b16dcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901856, "uuid": "21cece2a-e736-490b-b406-d21b3309dd72", "comment": "Malware payload (Mirai)", "value": "3ff829e51618b8a76eb46dad9e8697fb6962f834", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901856, "uuid": "176e92d1-b166-4c7b-894c-fd31ca850e15", "comment": "Malware payload (Mirai)", "value": "2db0566290eb87593bcff767f9c5d9cb0f30cfcdac0a44de93512eda14d7b308791ff02e696856a1ebc4a617fad4d457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901856, "uuid": "5c86e195-a7a5-47c9-987a-d446ea0b2795", "value": "T1A3436BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901856, "uuid": "7550d751-2b3a-4d81-bd42-f50fa646693f", "value": "1536:JeESt/basV2rcZhG6+KN7TqppW1ZzWOIaEjrqMVs:JeESt/basVTgW7Tqpw1ptXESG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901856, "uuid": "5add9787-0b1e-4290-afbb-58e255b24911", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901856, "uuid": "7987bafc-a968-4085-afac-6d1beb6006ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901856, "uuid": "b1628715-8c58-4234-8172-5f736f37894e", "value": "4206a52c7ffedbb3ea34369e7cc35413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8153aa87-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679903627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903627, "uuid": "495ca317-76e6-446d-8183-77b395ee7dfe", "comment": "Malware payload (Formbook)", "value": "25954d9416a65c2a3bc4a1d156c1cc7c", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903627, "uuid": "61455bad-d4fe-40aa-9550-407310449419", "comment": "Malware payload (Formbook)", "value": "3286ec2c06c7875442b9cb6d6a6f58d0a9c23f79747b2e25a9af62dfaeb8e462", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903627, "uuid": "14f273f1-24ae-4eb9-8b2e-4713acbb2f94", "comment": "Malware payload (Formbook)", "value": "95d4b880698accfff08734644600c93f2a104c74", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903627, "uuid": "cfd96276-f2cb-4f7d-98b6-a865e823b7b4", "comment": "Malware payload (Formbook)", "value": "a3a748ab3d3786375e86565635a7ba86724e5775dc5a7d46f4fa68efb6e5300c0739f54f090c46a753d207360295c266", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903627, "uuid": "0feeb370-3522-4a9b-92d9-7c78271705de", "value": "T1CBF433D2AB709859BC31AF7023061C795BCCD40F7244EEB9D58E1E7C3672906DAE690D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903627, "uuid": "142f2ddb-f855-4d1b-bb17-39ed15a838b7", "value": "12288:1PKjUW+jNZt82DUl8JRAmja2ClUNvUFdmFCpssyKyKNwpW/nRotfKlzx0rYjEJ:tyyjNEMUlWS326sCakvJNwkvVhqIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903627, "uuid": "3acbde1c-6437-4479-b024-11f848a9eb7e", "value": 740482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903627, "uuid": "f2b78a32-04f2-476e-8d0d-4b0f87bd2ebb", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903627, "uuid": "093d5a41-d98e-4655-a514-ea9332cbfc27", "value": "80460-Contract Ref 2023.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c493f4-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1679901326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901326, "uuid": "5901a134-d8e4-4a53-a77e-97497e13b0bb", "comment": "Malware payload (PrivateLoader)", "value": "df36b8a03f1c4100ccea6a79116c1bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901326, "uuid": "b30cc6e9-606a-4750-8ac7-69bc0281240e", "comment": "Malware payload (PrivateLoader)", "value": "32ac0624a534a2c40fb8eba41e80bb1d31b99cd118d42208c89229079699f783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901326, "uuid": "f0935ffe-5d44-45d0-820d-433f5f9e183a", "comment": "Malware payload (PrivateLoader)", "value": "6d0cf1d6aadd77bf16251551f1a00a76fca395e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901326, "uuid": "8124fe62-7ead-4a66-b3be-6715de82e818", "comment": "Malware payload (PrivateLoader)", "value": "8f4b7dc9f1fcdd34554995accbd8698ec26cfec04f2540d79b546fee9484e2b9b48414961c1a81be952e2f8170b8571d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901326, "uuid": "e236fbcf-b41f-42f5-b491-cb3705506992", "value": "T1DFF533417A8196B1D53A1D354A756B11983DBC200F34CBDF63F4266D9A3A1C2EF32BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901326, "uuid": "fd5a8ebb-530e-4458-9edb-defbef45f126", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901326, "uuid": "f120e7b3-7a30-4851-8757-4a1677875dd7", "value": "98304:Ubjn1zQyFximOATdA8xd4svk3upL/ZWt/LcMJ:UPnVxHOATdA8YsvkuLBics", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901326, "uuid": "51b422e5-5e5a-41dd-94cb-179be940c3d8", "value": 3499573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901326, "uuid": "b9e734e6-9397-4487-9daa-be546718096c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901326, "uuid": "adb9db82-e880-460c-8a88-3c8567cdd1ea", "value": "32AC0624A534A2C40FB8EBA41E80BB1D31B99CD118D42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5eb768-cc90-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1679915724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915724, "uuid": "7ee9cbac-d5ea-466a-bdee-d9acf2e09741", "comment": "Malware payload (ModiLoader)", "value": "5fc4c73e287297316316d56ec340bb98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915724, "uuid": "811f09cb-0f30-4efa-aa1f-769a34311910", "comment": "Malware payload (ModiLoader)", "value": "33ba34d8685f48fc23e074cf802716cce5f1b27a656a0996bdf88232c42a36d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915724, "uuid": "f26e48ff-d3b5-4418-833d-bc61bacd10be", "comment": "Malware payload (ModiLoader)", "value": "306fd44b6d688e9f84d87e533605121bdf64eb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915724, "uuid": "6b6565f2-9ee6-4974-bbde-6ac8d799fc98", "comment": "Malware payload (ModiLoader)", "value": "42d7b60f777e9712f6ee626761e12bcd271d766036ba3ee7876f947ebe8c617b1fd30f03de2f4d1bce5f927ba78993db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915724, "uuid": "6201643b-9a4f-4196-a892-77c5a4339de2", "value": "T1C1059E11B661E837E3266AB8CC47D355AC3ABD212E2764427BFC3E5C9F356503A24273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915724, "uuid": "bfcde35a-152e-4e44-abd7-368120036d28", "value": "5710d974d303962d4a1254e8085feb40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915724, "uuid": "062e533e-7887-4917-ab4e-138d0abfa9d9", "value": "12288:1xkn6YuwDEgW0+K4tvzxn58XdUpGHnSieAi+Ze643VaxBP:nM6yG0+hhzxnidiGHSi3HuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915724, "uuid": "bbdb12f6-cd5e-40d2-aaf2-64f1983cdc67", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915724, "uuid": "3eca8259-1e7c-403b-b3ce-e9007a0033c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915724, "uuid": "63384aa4-1274-4031-a0b0-4172b129919f", "value": "0625413424416272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fdb685b-cc5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679893612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893612, "uuid": "39c7d4be-19b9-4a9d-b395-f850b4a992ca", "comment": "Malware payload (Amadey)", "value": "97b88920ee48d36d19c823ff237812c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893612, "uuid": "d858bc1b-7a96-4af4-b90e-63a999bd3c14", "comment": "Malware payload (Amadey)", "value": "34171e8efa5e3091775e8f47e35690a34be7da2905f6e9acc7d1672372c258a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893612, "uuid": "4f5badf5-7dd6-49af-a56a-f92d0094efed", "comment": "Malware payload (Amadey)", "value": "0880f124b3140458391e947ae63a40b728712a1a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893612, "uuid": "d2c2f4d9-6eac-43c1-8046-e2d6eccaf83b", "comment": "Malware payload (Amadey)", "value": "a2a92309bf819bceb7ab65946de8fa543067d48135e1822ce9561ae9d88f6328c20644f7d8f974888aaf5fa59929c10a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893612, "uuid": "54888b04-b905-435c-b960-bea028b1bc5a", "value": "T1C225230276D55036E87527305CF707870F38BC615AA8875A2B8AAD4E5DBBEC0A471B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893612, "uuid": "2f6a2782-dcc3-405f-a841-66ab7f7d6a9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893612, "uuid": "ddfb965a-ef0d-4341-ab1f-892fe072f275", "value": "24576:6yyKIhKQfFSc2ujqCjXxIo23JGbetNxvXg0YoxRXnbNj:BFwSudBIo2mCrxR3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679893612, "uuid": "050dff30-110f-4a7e-8fbd-0e7cfb8bef1d", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679893612, "uuid": "adca64dd-f91d-480e-bdde-6f6ada4f3d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893612, "uuid": "464dc31e-77fc-4851-a28b-899f6e1db0f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f425b21-ccb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679930306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930306, "uuid": "84b57b67-33c0-4c40-b008-4441cb4832e7", "comment": "Malware payload (Amadey)", "value": "e37b39e745a9c440ac23d502ed85af55", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930306, "uuid": "00dddea5-b1d2-4c23-a472-e600d2631161", "comment": "Malware payload (Amadey)", "value": "34c064d8fd5046e9b2949e7cedf75d5882581decb1915c902d43ad70e5cbac0f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930306, "uuid": "ae7ce6bf-4b05-4339-a1fb-273abc11a5e4", "comment": "Malware payload (Amadey)", "value": "73d2dcd7258c6a9cd6ab2db6b1f4766ce1b43374", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930306, "uuid": "534ed354-45da-416f-bdd3-07e41ab7fe6a", "comment": "Malware payload (Amadey)", "value": "875818cd525d3ec928cdbf24e332492db07fa6de3165d62f38f5df34b41e891e48bc297c0537358e4e66a92a139d6370", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930306, "uuid": "a86ca055-4f5f-4bf6-9529-fbf15a184b22", "value": "T1BE252312AAE884B2DD799B7048F603C30F3ABCD17D795756369A9C8E0D722C4B1317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930306, "uuid": "f3565fdb-bee9-4e04-a5df-2864e193d250", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930306, "uuid": "d7bd5531-12b0-456b-8944-60045e87e347", "value": "24576:uy6Gp+m9R43FJYuhyCVp8QEcQbPIgqbE:96GIYR4US835Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679930306, "uuid": "e5c5b0ed-589e-4d32-893b-4578fc44d6ee", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679930306, "uuid": "2a0903aa-9888-46c2-9f43-7ef021a2089c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930306, "uuid": "ffbde424-4e9d-4890-b7d3-c4f2cdeab032", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8e54c2-cc8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679913550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913550, "uuid": "36006ae6-d97a-4c35-bf37-f41413db91d7", "comment": "Malware payload (Formbook)", "value": "030de17769357418013f18e0ad1b61bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913550, "uuid": "dc6742d4-402a-4ebd-834e-0a661722be72", "comment": "Malware payload (Formbook)", "value": "34c2526748f1214c70cbefa7e45e067e86e78c79759cafa9fdf1082795ed92bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913550, "uuid": "2d9b7309-2cd4-41dc-892b-e3ad0cef5668", "comment": "Malware payload (Formbook)", "value": "3bfd9fd82f846a73f319eb2a29f246dbf143e721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913550, "uuid": "f7dafd7a-70b6-4510-b7f5-450bc8bf63fb", "comment": "Malware payload (Formbook)", "value": "61aaec7ff7f72748d7d35a96edc8e236072571de983c1871e32070d27719d813e07afba2209c641906dc4e92373eea11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913550, "uuid": "c0c79446-c2a6-47e1-ab51-e8239bd0f144", "value": "T173050155F3E4AB12E7B6ABF02A704800D3BCB4DB6B45D98D4D8A24D790F5B108E53E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913550, "uuid": "c5553a44-b57c-4f48-9b56-fb5a36a64fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913550, "uuid": "64f47724-455a-474b-b67a-92f56d04cea8", "value": "12288:qA53B0OKIZt8JDol8JSfyjaGClHNfUFL1FCgUoygyKIwp6DoFxVf6lzZGJhZ:qA5x8IE9olWK7G6t4jFBJIw4cMhZgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913550, "uuid": "f08d9222-a203-45c4-a8a7-0b2f1646e467", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913550, "uuid": "cc642747-1121-4731-a16a-81abf6372a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913550, "uuid": "0f608bde-e908-44d0-a99d-07a176e32256", "value": "80460-Contract Ref 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdd3896-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951455, "uuid": "d3557f33-fc5f-45b7-a236-1688e98c1bd7", "comment": "Malware payload (Mirai)", "value": "f87d5b427a826f650bb80b33ca3c7ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951455, "uuid": "00e94a0d-de5c-4bb3-a9ef-f3b0cde50e60", "comment": "Malware payload (Mirai)", "value": "35532aea6b8fe43e8a6142733d3dbbf790df04afd1d0bd3d79e4385556f66905", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951455, "uuid": "327576e0-1196-4e0f-9947-8fb925b5e66a", "comment": "Malware payload (Mirai)", "value": "e307cd0061f121b21ffdae9a4e59d95a7b70ad62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951455, "uuid": "4f9bee01-5fcb-4019-9595-a7c2ad633f18", "comment": "Malware payload (Mirai)", "value": "f2eb576b93eccfb1622befb9277d46c9fad8b3abd4f8e9f44db2c253c61c258e291d5212731077569e02571976d6948d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951455, "uuid": "131fb4b3-0c2d-46e3-8388-fe488bcde745", "value": "T1A3B2D07681A6EDB2CF205C3299B88ED891478BFD72F23F352081515D418939A72BE4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951455, "uuid": "9be8d4b4-a855-41ea-87f5-e5cc9bd9b90d", "value": "384:S83f25SMZzQy5PRh2BofsftxhxowapiBC3N+ewBEh+vyjtARn9p/TuMoX/hmWAxf:S8P25SMZzZPRhEwsftxh/agBC3Pto98S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951455, "uuid": "360b872d-a01d-4351-a62d-aa1285a94a85", "value": 24476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951455, "uuid": "b0dccaa5-af81-41e1-b04b-cfb1c8c0320c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951455, "uuid": "ad90fcdb-ac5d-4953-bd4c-f11588fc766e", "value": "f87d5b427a826f650bb80b33ca3c7ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51daf4fb-cc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679909131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909131, "uuid": "c4cf7e18-1253-4c83-90c4-e88810022c9d", "comment": "Malware payload (RedLineStealer)", "value": "5ebb78447e0c5f9d763a4821dcc6953d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909131, "uuid": "89fd65bb-1778-4f9d-8f1e-05ca755a3000", "comment": "Malware payload (RedLineStealer)", "value": "35984772051be6bcb95f93e5df8cbd243074e68d364db91440da706406dd6ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909131, "uuid": "a901e48a-31f9-4ff4-890b-c4abc6e7c30e", "comment": "Malware payload (RedLineStealer)", "value": "d90fd2730485c3bab65f2ba7f81e54502ec05642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909131, "uuid": "beb303c7-e223-412f-bfcc-0231a7ecd4ea", "comment": "Malware payload (RedLineStealer)", "value": "00eef4b438bab6a59f34e7857d3433eb18bdf00d4d1bd537b12471a7389d9c8819b8eb50fd1ab1d775296047027c90f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909131, "uuid": "b026a44b-8182-40a9-a1ea-055005fad806", "value": "T1A9252302F6E84013E4F2677458F707971F36BC914D21475A3A8B99DE1EB2E80A7317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909131, "uuid": "20f7d3f3-5c06-44d4-a58f-793bae823b54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909131, "uuid": "931a35fe-083b-44c4-ae92-4d3fe5ab7ac4", "value": "24576:jyStLh1bmTlhtE87LS01YInuDXx0sD1tQbgDyXi26g:2StLDOhtdPOInuGsfDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679909131, "uuid": "a2b075e1-f358-41f5-ae19-064fa9c68fb5", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679909131, "uuid": "a8c91a9a-2d73-4152-8b27-92d3ce055f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909131, "uuid": "155313eb-5415-4854-9ac4-da4a370ef123", "value": "5ebb78447e0c5f9d763a4821dcc6953d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bd8572-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894882, "uuid": "817b848d-c87e-475c-9cfb-4a976517dbf8", "comment": "Malware payload (AgentTesla)", "value": "ff0a86e2170966182a7be06e08811fcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894882, "uuid": "f0aba0a2-b062-4a6f-98f1-b3d43d3ff7c5", "comment": "Malware payload (AgentTesla)", "value": "35a5ee101c02290061928de471fa3d2212de663dbb14b520b50d1373df082f60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894882, "uuid": "32b14a37-6602-4bdb-8d99-bc7927f80a2a", "comment": "Malware payload (AgentTesla)", "value": "127cf2e6d406d1861f82ba18c7aa6670d9100643", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894882, "uuid": "bae5ca2e-7205-46ca-9d63-fea156c84ecd", "comment": "Malware payload (AgentTesla)", "value": "6a295cb00ef127ed8fdf3174da9a2cb53a2f717f992835ce4e200aecaf5ab213a93462ccfcbde1895fd04d8ffb732f14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894882, "uuid": "a1cf0d86-f505-4a61-8bd9-375c1aaa9477", "value": "T1CEF34A6892958D11D31D4CB4C4B319F80AB2A2575617EB7E1EB198F63E4B3C3372ECA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894882, "uuid": "279bdae4-29cb-4072-93a8-87afbb9e12d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894882, "uuid": "871d6ee3-1b78-4897-92d5-556aa795b7e4", "value": "3072:x7v8S+C2FEaGZiwdjRk1VQw3WGyYmIEz05QWOry:x7kC+elKVryYmId5QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894882, "uuid": "b4821c4c-f568-42e7-89a8-9626db727fb3", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894882, "uuid": "746d37e9-0f98-45c4-a86f-675cdfa9ce67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894882, "uuid": "6d12915f-86a1-4f30-bb3b-312f2e7a710e", "value": "35a5ee101c02290061928de471fa3d2212de663dbb14b520b50d1373df082f60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c3adf5-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679903770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903770, "uuid": "dd87eb53-485b-4813-badc-dc23034db3ad", "comment": "Malware payload (RemcosRAT)", "value": "1b757184307094f4f4d1caefe3ee80d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903770, "uuid": "247b9bf2-24f1-482f-8265-4d108f0ec878", "comment": "Malware payload (RemcosRAT)", "value": "36006e43513ee6ca1f60cf3a18b55d0cf42dcf095f166ab71314902d472a0453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903770, "uuid": "3db7804b-4ab5-42e5-a8ba-44ad64f6bdf1", "comment": "Malware payload (RemcosRAT)", "value": "fd19f622093c77c00879a3b2bce2171f1b5445bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903770, "uuid": "eb39f416-499d-4ae2-ad9c-cd0ec2e7dec1", "comment": "Malware payload (RemcosRAT)", "value": "10a0f61ed03df89c93b52deaeadbf740007a630944271656bcca7bc95ea067ad18b9b92897caf45e1f3ae040cd08c652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903770, "uuid": "46017366-2205-4f05-8ccd-fd4d3549119b", "value": "T141351249F3942722E777A7F029B04940D3BCB4EB6756DA8D4D4A20CB90F5B104E83E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903770, "uuid": "3fcb0149-d4fd-4ae3-aeb4-081e0f4a926c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903770, "uuid": "d9c013df-21bd-401f-9889-8597e2d7b0d6", "value": "24576:MA5Ix0j/0Yw6gDYm+T1Nk/iEYaEr/pa7qvjSUJD:V5Q0gGg8XxNk/i8Ej42SUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903770, "uuid": "8faea9e7-9ec4-489c-8e06-e608c3af623b", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903770, "uuid": "6e013fda-298f-4185-bf80-47d158a5c97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903770, "uuid": "62632bd4-5015-4534-8f4a-05ea9887ddc4", "value": "PROOF_OF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a6a812-cc9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679921943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921943, "uuid": "f9d44a7a-0bb2-425c-b80e-f918eca897f2", "comment": "Malware payload (RedLineStealer)", "value": "04a617814138557b44deb44f82b54121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921943, "uuid": "3bd090a5-f41d-45f2-9730-db056ad2a00b", "comment": "Malware payload (RedLineStealer)", "value": "37006f3fd5b2a8ebd06e763b6dc6665792a79f047c2215fae82da47335000bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921943, "uuid": "c8a9525c-c302-4308-9144-cfa42093dee0", "comment": "Malware payload (RedLineStealer)", "value": "a1c88fe48640adfcfe33f003c09090f89d34dfa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921943, "uuid": "5b8e15f8-e922-4273-aea0-5183b0d0a55a", "comment": "Malware payload (RedLineStealer)", "value": "4f20ff1f3c9721936097396254f9864dd28a9fc576b5e497479d9bc1ac8724dfcbcb88b5a6c440b18a167e41c497b04f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921943, "uuid": "4a3cafeb-8b9b-4a19-afa2-fb9d61ff88a1", "value": "T14E74D02273D1C473D8A641754962C6B9BD3FBC705B5986CB37842B7A6E303E2DA36342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921943, "uuid": "2d144aa4-ec18-4e4f-9de2-65ee1a460355", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921943, "uuid": "e9ac2647-0c49-4d7c-bc49-a16c25da1f25", "value": "6144:0t8x8iNVTxL4JPp96iuh/WckY83oonLe5sWprT9VLlCX88wzz7EPybg/R:h/vTx8JPyi6kYOLe5skrT9X2/oz7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921943, "uuid": "f4e7d23e-0406-4baf-9afd-cd873224a970", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921943, "uuid": "5f842257-6094-48e2-b844-49fe2425f875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921943, "uuid": "bf19df77-8ff7-4d14-aeb8-eb24bad9f7fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e96e519-ccdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679948720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948720, "uuid": "9bf96f0b-5d11-4e31-b190-13e3e149029a", "comment": "Malware payload (Loki)", "value": "3ba18ac29be8aac2fd64ffdff621cd7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948720, "uuid": "2f7552d7-f3dc-4ec5-88d0-649208a477f0", "comment": "Malware payload (Loki)", "value": "3722230201739f00b5967d0d77061f995f8c53f1f68911ba7faa7002797ef208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948720, "uuid": "12798a37-a194-4df2-b6a8-2bb1a25123a2", "comment": "Malware payload (Loki)", "value": "5c40013d7324bd449fa954a0f68d70095c45a99a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948720, "uuid": "298916c3-c288-470c-8e8a-f971a26fa7a3", "comment": "Malware payload (Loki)", "value": "155565455a149bfaf0b931b8ab4d5bbf4ce77515465984cfce81a348411ca47bf19000bb6b73a25398cfe294a248f780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948720, "uuid": "7d546fbb-f792-4997-9fb2-53f11cb845fa", "value": "T19A84DF05AE50F292F7592D71E6F1E30E8AA6BE395B011607C6FD363E923F33C6462641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948720, "uuid": "4a8897e3-6e7c-477b-8903-31e9c1435a0e", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948720, "uuid": "9f5179df-f216-4600-9310-5f2c98af14f4", "value": "6144:Ua4TQNkR6GfUaMzpWCEv8ad15+6pnKODH240FcP2h3pYR1w:14cCR+9zpa8ad15BpK02ZSO/Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679948720, "uuid": "59ad28a9-b5ad-4a46-bb5c-faa369093fee", "value": 375037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679948720, "uuid": "64d68c9a-016f-4526-9337-034704376db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948720, "uuid": "1ff5755e-0f0d-4c0f-aef6-a000888ca60d", "value": "H. H. Arnold Co. RFQ 230327\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5910989c-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679901842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901842, "uuid": "126dbac2-34ac-4ce7-b3fb-ece6a5028b87", "comment": "Malware payload (Mirai)", "value": "5b36243627dacaa830d09c7cc12ab920", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901842, "uuid": "b7cc5898-d0a8-474a-b295-e0872d6c56b3", "comment": "Malware payload (Mirai)", "value": "3743884cb0c7ca3a5b31c975ef620c8edc690b9d8032eee1af7ed90b4774ef68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901842, "uuid": "6ae398df-c5db-4c46-bcec-a0a1b42a51f3", "comment": "Malware payload (Mirai)", "value": "10cbcf56b4db4ed468ea140396ad9b3260540786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901842, "uuid": "5fa912b0-34dd-4f15-98e5-d9236271852d", "comment": "Malware payload (Mirai)", "value": "9c74726d2f43398b086696cd99f6794b74361e9639251d75ff35ae5a0c83ea8b3258fa1036ba4a20dde9332e29944e2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901842, "uuid": "ae2eb5d2-2c43-4306-bff6-fa644fc58e80", "value": "T1AB03E751BC829A37C2E1137AB6AE4A8D336167E8D2CF7217DD214B207AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901842, "uuid": "7e1b9267-3e43-4bdf-ac38-4174fcd970e9", "value": "768:kg4QCbvsG5f0OlnlUlQOBFdApwAUb9z/W56v+bgO73HUXoTV/NwwW:kRbEG5fXlUlbH4aScv+7UyLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901842, "uuid": "92405f0c-1f19-4cb1-8b29-1c33415479a2", "value": 40748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901842, "uuid": "1ea96600-c6e3-4c90-87a6-1e1f37f8662b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901842, "uuid": "55d319e3-6629-4b80-baf8-750f0b3ba2f1", "value": "5b36243627dacaa830d09c7cc12ab920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b223df4c-cce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679950524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950524, "uuid": "93ea0f23-df51-46d0-8c12-3cf55ee3c55e", "comment": "Malware payload (Stealc)", "value": "2c054726738094f35cc95395429e5733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950524, "uuid": "c91dd866-699b-4a02-a493-cc9b809876a0", "comment": "Malware payload (Stealc)", "value": "37aa7fbf692cbc7da1f9f233c37cd4e7f1a41e12d61f2c34d6bb1171863d2790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950524, "uuid": "4510b551-1ee2-4bb6-ae04-2426ceeea10a", "comment": "Malware payload (Stealc)", "value": "fd976e82ac4f033077132259318c80789a063afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950524, "uuid": "068769dc-8759-488c-97c1-8126f884d908", "comment": "Malware payload (Stealc)", "value": "c8792fece593ac4e602f3bed7fd260f5d1baaf16635559d2cf42a3056e8a5576f426cb80c6697be6d1e38b1fc73098dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950524, "uuid": "e1116fae-5adb-4e80-99cc-fa8c8ec41a9d", "value": "T17A44D0237791C473DA2A01BA4925CBFA5E7A78304B5586C77B78067E1E306D2CF3A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950524, "uuid": "1d3d60ae-a606-4b14-9d89-40e00da56d50", "value": "22a1312b6eef4a70b0967af8974379c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950524, "uuid": "01e8a1e8-e2d7-4d9d-80a1-58f99f38ab68", "value": "3072:n+6RraN43Uu2xL+aMzi5sHDVOAjkCHtBOlIUnipVH243kuTYwGo3sd5iNQ9SCU3r:HlaNHu4L+3DBjNDuanZ39u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679950524, "uuid": "0770e5dd-7114-4900-97f0-0fffba24ffa4", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679950524, "uuid": "72ee4007-5a67-4011-b609-6c806ab96e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950524, "uuid": "65d51f0a-41ad-4f42-b181-62ab214cac98", "value": "2c054726738094f35cc95395429e5733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6805d6a-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904978, "uuid": "34ea9ebb-c0e9-42b8-816b-4711ee0937c4", "comment": "Malware payload", "value": "66893f8f7574f8523790b3dfeace743a", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904978, "uuid": "6ed2e739-54dc-4d80-8eae-9df4173a55a6", "comment": "Malware payload", "value": "37ac03678bf8ae8ca4ee11ba64023e9d762d93f15619ecf54fe0ae752d193ed8", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904978, "uuid": "466237a4-b87c-4e1e-861c-cff0543af714", "comment": "Malware payload", "value": "de2b6dcac3eb31b4418815cc441bbafe70919c01", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904978, "uuid": "3ff611a1-1674-42c4-b046-e85c6e5e0e0b", "comment": "Malware payload", "value": "738bc09df8a362c8a57896ac250097176e35f9e6b62356387a46712f9e6c05b09c28ad143bbcb1fc2f3301e1daedc3d2", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904978, "uuid": "f76791f8-a82f-4f30-9aaa-c3fc742f4798", "value": "T18C11C019386BDE12837FDBF480B6501CD44BD8507658AA3833D0BA1F925EAB24F8614D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904978, "uuid": "1a6a1a1a-3b2d-453e-b0f4-d5ebc7334670", "value": "24:kAx2kGRV5639qnMKkOtTq4/7Sw/6LTu5KkORO4/rh/6XMCG:kuqr5636MHSTzSvLwHO/kcCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904978, "uuid": "9ee6ed9c-4c9b-4f0f-affb-bd22cc5757f8", "value": 895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904978, "uuid": "0e91e11c-c7db-4a9d-bd5f-781bf7921982", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904978, "uuid": "f4a85927-95a7-496b-956a-47d397ccb83d", "value": "do2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3e3982-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878337, "uuid": "44e9ac52-63f3-4f4e-bb4f-420875341e5b", "comment": "Malware payload (Smoke Loader)", "value": "531b028c2eeec2ea43e2f804c66e2840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878337, "uuid": "5449ad42-7b46-42ed-b804-a75df1f43c77", "comment": "Malware payload (Smoke Loader)", "value": "388811dcd07fe3bd28f6ffabcc37658b9da043e270f396fb68c0336a07cef902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878337, "uuid": "eb5f33c8-3920-4c98-9b3f-bde873b1673e", "comment": "Malware payload (Smoke Loader)", "value": "0586356c9af85f04dfb95ec24c6c24f6eca643d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878337, "uuid": "7c741809-d391-4b99-974b-33ea5e9e1785", "comment": "Malware payload (Smoke Loader)", "value": "372a8024da3d1ec2dfd5499a5e13eae3cbaf234c977b4943708929ccd7defdf07e087b00f503a4738dab4670856fcb1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878337, "uuid": "ab5c8937-6e06-4513-a44c-7b3845797666", "value": "T14F548D2E93F46860E1735732BE2AC7F42A2FB8615D177B6E36486A3F0930761DD62305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878337, "uuid": "f35b43f0-fb86-4e47-a8ec-249c30ba5ba7", "value": "87d886eda68b09da2d904f9205843127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878337, "uuid": "0158172e-c5b6-40ad-939e-5df3fd49d0ee", "value": "3072:M18TzMZC/oyvgN9FTGGrOd97S7GoJ8nX2YyTFXnwrwHW9obEn5w7k+pYin78Ug:rqlGu9Fp7Go8G9ZHWrn5Yk+pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878337, "uuid": "7c099e2e-5b07-4c08-bfb0-a035164549d6", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878337, "uuid": "ed4afd4b-841b-4e0b-9d21-ae94df4d5a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878337, "uuid": "594919c0-6d4a-4ee5-b9ee-a81376c1e8af", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c702c4fd-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912334, "uuid": "4643e325-f64e-48f8-8795-740f7a6ca234", "comment": "Malware payload (SnakeKeylogger)", "value": "fedbc261ff4e365bd324203cc7996816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912334, "uuid": "e02e2543-2eee-43f7-ad0e-ce0fb5c0f373", "comment": "Malware payload (SnakeKeylogger)", "value": "38e91c926eff66b2fec2ae584d21de09d49cb34a69175a883ddb426c6624d13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912334, "uuid": "86ca5b79-1665-4302-8586-d4a3446dc25f", "comment": "Malware payload (SnakeKeylogger)", "value": "75ca073cae8d7cb5394952115b9ce28e3b06bdfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912334, "uuid": "3969daf4-45fb-40c2-a65f-e9972128cd5e", "comment": "Malware payload (SnakeKeylogger)", "value": "05e68c40494db13b1ea2c9764c051cc3a4fe585c65468c8f799121de7392e00732172fb54988de06ddadd870a1fdbaa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912334, "uuid": "70573538-0714-4197-8ed2-e65b9c855131", "value": "T16444128863ACD2E3C42162366E37A18799FAEB359074578F53204B5E7EF1982F91D313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912334, "uuid": "72567245-7a5b-4dc7-a17f-db2f59fe8952", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912334, "uuid": "e6dd3b30-a6c5-4bfa-9382-20aa59d30f75", "value": "6144:/Ya69KOxgJ8ACuj1nXpIBrMBs4/W16STnJXNuvI:/YvFxDAhZIBrh4/kuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912334, "uuid": "ce910e6a-ff91-42f3-8952-81c0f105fa37", "value": 259139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912334, "uuid": "89de48a6-7760-450f-9fcc-5d890660808a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912334, "uuid": "3fd4b5ea-8355-4bec-b40e-5d8a8b531704", "value": "fedbc261ff4e365bd324203cc7996816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade7cf0d-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Expiro)", "timestamp": 1679901554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901554, "uuid": "7a136d3b-3a44-496d-975d-6e086bdef09b", "comment": "Malware payload (Expiro)", "value": "6ff343544f11ca66a5973a23fbf48f2d", "object_relation": "md5", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901554, "uuid": "7b434ba0-862a-468f-b958-e1c9e92c3e54", "comment": "Malware payload (Expiro)", "value": "39d3c917ad8dde00394742844675e21b6dcd5c1bb5ec5b46eb22e70683676298", "object_relation": "sha256", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901554, "uuid": "ad5d9329-582e-4f15-96cc-bc83082b6f8e", "comment": "Malware payload (Expiro)", "value": "7daa32714bc5ead4e66d4ab3741114164b62ceea", "object_relation": "sha1", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901554, "uuid": "4118f481-13d2-4bdd-976a-dde83c949d65", "comment": "Malware payload (Expiro)", "value": "2901bda38e8fb9c833d7818660166d714e910ffdab4ef92a94c316c85bc182c30c6474c4a4636ec9381ebc0963f22c4c", "object_relation": "sha3-384", "Tag": [ { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901554, "uuid": "963a51e9-3303-4235-89ab-db2aba539b52", "value": "T1263533CCB1DD18B93FABFD7AA0301E2D61907769FA10176BFA729F131432C616A2D911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901554, "uuid": "aa062991-1d42-44c5-a05f-237b0452d380", "value": "24576:6om7oMDLoEpu7S3Ze6LyAA/sXTCi5FAPv9FNNKWFrQej6aA2FPc:fMDbuO3Ze6N2SGVMWF8sVPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901554, "uuid": "7de1261b-6c3e-4ccf-8ac3-950e0ac231a4", "value": 1090207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901554, "uuid": "19909ffc-5359-40da-9c71-6a68154ccdd7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901554, "uuid": "c997cd9d-fdb4-4241-965d-90bd8b6490b9", "value": "QUOTATION _RFQ# 1043999_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725f757a-cc87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babadeda)", "timestamp": 1679911762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911762, "uuid": "33739809-58a7-4900-bc51-82ce9a2bd8de", "comment": "Malware payload (Babadeda)", "value": "ce6fbe8631042dc9467b67aafb5e05ab", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911762, "uuid": "6bc3c35a-7ef7-4d12-b96a-0e636d048b86", "comment": "Malware payload (Babadeda)", "value": "3bc6c3d33215f374133948c4fee7ba92e068467d1bf2ea4cfa67b576200fd2bc", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911762, "uuid": "bf830df6-daee-4f3f-8180-2188abd0a7b4", "comment": "Malware payload (Babadeda)", "value": "4ae0e242a455f724abb10077eb63157970b17637", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911762, "uuid": "3bb2cbd6-52db-4ca2-8aec-1fae63bfb74a", "comment": "Malware payload (Babadeda)", "value": "e583b6da782bee15cb6255484d66b4405d0c5c10e6eea3181c0452c5bd0c69edf8c0d62d014df122c12904994462fdfa", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911762, "uuid": "0ba56f2e-5b7b-4877-a1d7-27f6f512de1b", "value": "T1E185A7D80F6C4C96F182FC763675C1229D3988C9864A607ACD195E2BE1BBCECE0C7D65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911762, "uuid": "78e8def4-d1a2-4fbd-aa33-6d06a71a6dfc", "value": "1e2e2ecb4d93f1ff65b44ec294ad861c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911762, "uuid": "c105116f-ebda-4b52-ac57-07c63ec7f33b", "value": "12288:nnCNTWvYo1VFnA4r5rraOVokssOcnh2tbbLqhS8aK3:nnqTWAo1V6u5rraOVouOcn4tbbR8ag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679911762, "uuid": "9b529332-efd4-4d65-af8b-e5df2aacd5ee", "value": 1753088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679911762, "uuid": "8ae80ee4-982c-4534-b3c1-8aad84c0f058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911762, "uuid": "6cdb5c1f-1f0c-481b-b703-995f2f998751", "value": "HURR-DURR 3.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e898df7-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679949928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949928, "uuid": "c5456135-7c76-4741-9a56-6a5ad26d4438", "comment": "Malware payload (RedLineStealer)", "value": "2474c30439dec036419dc66819ea20c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949928, "uuid": "1a46c32a-d0a5-429f-8001-94270bf7f746", "comment": "Malware payload (RedLineStealer)", "value": "3c5c9da960d57282984de53779847d1201d788685dca15ecbf6575860e04901d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949928, "uuid": "33891ed7-dc8c-4d99-bfd5-d986c75edd0d", "comment": "Malware payload (RedLineStealer)", "value": "ed55b80f420cb07fd16829e8f6af1f850888690f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949928, "uuid": "8b31f0e9-5d89-4ba9-9feb-2ecb7b23bf36", "comment": "Malware payload (RedLineStealer)", "value": "1499598edc29bbcd5fcf61c2db66cc6495d7d7abb3cc96ca2621d5718a8d356b6c508a58c4f46715b6d95180e7f2229f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949928, "uuid": "a2087988-a464-46a2-bb67-babe1fe5b6e1", "value": "T1D5352351A7D98073FDA51BB02CF602532B3A7CD65E71468B2B11E86E0C737A192353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949928, "uuid": "cdb2cb31-b903-4ecb-b2fa-bbe4b33a66e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949928, "uuid": "f6297718-be59-4f6b-96e0-b485f6450700", "value": "12288:qMr1y90k3IKj0IhNXCf+YCpi4eydU+x1xTzkpU0ujIdHLhi7P8XAgXwwRcDgb:XyaRIPBpigdUO/Te9hiLIAgXQgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679949928, "uuid": "52971c15-4bc7-4666-9666-f4bf538ce3bc", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679949928, "uuid": "4bfb2d68-c07d-45a3-923a-e3b056a44548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949928, "uuid": "bfba1577-76a3-48b0-9b83-ecabaee73624", "value": "2474c30439dec036419dc66819ea20c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63e56a2-cce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679950612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950612, "uuid": "b55255cc-ed32-4670-9e55-1b3094fd45f2", "comment": "Malware payload (Mirai)", "value": "5afdbebb2811cea65797beb60d7a75cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950612, "uuid": "af27e9f2-2e45-49bd-8cb6-ed6e9d6600d2", "comment": "Malware payload (Mirai)", "value": "3caad7d3527509546edc937e96ca5498c67b708ec5ead014220b6335e1a875e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950612, "uuid": "8d96bfdb-3ff7-4476-8f9c-a38d99c861ed", "comment": "Malware payload (Mirai)", "value": "468406112c30ef0007f46ff5e664a35891f97a2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950612, "uuid": "84f55eca-8db5-40b2-b5b5-c86a4cac032c", "comment": "Malware payload (Mirai)", "value": "d697d247eeba2ad24ba49a5497fe1eeacda45ab08dc7064bacecff5ca6be1e50a158902b24c5c58eeb3789cc76979fc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950612, "uuid": "97b94459-ecb9-4289-adb1-d88cfa706f15", "value": "T107C2E090E05E6ACEF6FBBF714C1AD5E023A34F5A77C085E22151BF220A87C556209FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950612, "uuid": "21540b3d-83ff-455f-ae85-9c42e32dd41d", "value": "768:lO9hyP26EQHtZ4hb9whY368/Q2RUm4cXB4uVcqgw09j:lO9hnzY38bShI68/Qc/JXB4u+qgw09j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679950612, "uuid": "ccd0529b-1fcf-43ca-93c4-0673bce75487", "value": 27072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679950612, "uuid": "5870bf95-b563-4a40-89a8-2b607c6b8d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950612, "uuid": "c7fcce64-ed05-4ec8-8758-645cebfe9093", "value": "5afdbebb2811cea65797beb60d7a75cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f166439-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1679912643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912643, "uuid": "18ded22c-6289-43af-bf55-335bf0bfe79a", "comment": "Malware payload (AuroraStealer)", "value": "027a60b4337dd0847d0414aa8719ffec", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912643, "uuid": "fb3e1bdf-8bac-4b33-8f7b-591f1084132b", "comment": "Malware payload (AuroraStealer)", "value": "3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912643, "uuid": "7579f22f-e0a5-4a68-97d0-f2c4014b01aa", "comment": "Malware payload (AuroraStealer)", "value": "80f78f880e891adfa8f71fb1447ed19734077062", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912643, "uuid": "e25e39a3-ddf2-493f-ac4f-1ab92771f4cd", "comment": "Malware payload (AuroraStealer)", "value": "d31245680cd34e8e2553c0026243d62bf4fa8b39f6cfc3f66f3fe1094e2025e4e8b15b9bf7303059105b0425a66877b3", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912643, "uuid": "85d09833-ba3b-49c8-897f-1deb4ea24548", "value": "T1ACE50890FEDB04F1E9431D310896A37F27352E099B39DAC7DA503F5AE873AE10A32559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912643, "uuid": "b4080983-9a3b-4a1b-bc22-4ec5fcae5761", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912643, "uuid": "1b276581-920f-421a-9fad-95cae7379f8b", "value": "49152:ZRxujKxS2EuSIYkgSc71bdf5k6N21D5MwICiaiSLE6k1/lRr:ZRM282P2jScBbS2lRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912643, "uuid": "ad563fc4-bad8-4a05-a757-ebb624ba53d5", "value": 3226890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912643, "uuid": "db164fe0-d779-4d41-b2ad-dc9795eccf83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912643, "uuid": "d4ac892f-420e-4ba1-b104-4c3a5e515c89", "value": "027a60b4337dd0847d0414aa8719ffec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd560fe-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679912855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912855, "uuid": "f6e1a4b6-05cf-4f0b-b3f0-3b60577fcba2", "comment": "Malware payload (Formbook)", "value": "994934144a89538302535b4135d4c414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912855, "uuid": "290430ba-fb9a-4af8-a055-1357858f7e31", "comment": "Malware payload (Formbook)", "value": "41618cb3eabd9750fa776f31b8117e4025fd3d03af5e30d62100d84ce8101406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912855, "uuid": "d5d67cff-c37a-4662-8669-74684905d416", "comment": "Malware payload (Formbook)", "value": "46497b9718efb3538c0414e4b238e6d70c0f4230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912855, "uuid": "62b732a8-4c23-435e-99a5-d6a5caf03036", "comment": "Malware payload (Formbook)", "value": "dc9c20c0e2f6253dbf00179a275da277b85a426c2a0e6f909c82d9b97c5f8c25493f5db9af7b95c1127f114574c48ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912855, "uuid": "80c07518-b462-4902-adea-da31d0d443f0", "value": "T11B74128771D8DC97D9782731CD6F6B258EE2CC2039461A472B987E0EB633783561E3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912855, "uuid": "6f90c074-8902-48c2-aab6-712989efed2a", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912855, "uuid": "149ce1b5-7875-45a2-bb53-63f40364f790", "value": "6144:H6+/tVa/10URQbxpXRj/7O2KSMlEAYdvrvsNkK+a7u5YX1S/eNPLbQg:Pna/mzbxpBj/7bKTEAYtrupYM8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912855, "uuid": "8af82aec-5155-4220-98d0-00e803894a05", "value": 342953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912855, "uuid": "9775e2c7-8a82-4832-8847-3d20cafd5e83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912855, "uuid": "224d9e27-6e4d-4192-b280-2f048f86373c", "value": "E-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67375e6-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679912736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912736, "uuid": "f4d03dca-9afc-4c82-8a6e-f87ce2330845", "comment": "Malware payload (AsyncRAT)", "value": "870113986bdda1aa22c44ededf987447", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912736, "uuid": "4635835c-9674-4a6e-871c-4bad9a79ba43", "comment": "Malware payload (AsyncRAT)", "value": "417b21104c212d3c6443c30960b43bfa3c65dda72061a5a2c0246ff97930eb18", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912736, "uuid": "c737fe8f-1c00-45d1-8358-dcdad8934b8d", "comment": "Malware payload (AsyncRAT)", "value": "0ad93b69557f0e2b13d9e72f10939527c464196b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912736, "uuid": "acef74ad-bb24-457a-a85d-981fcdb13e30", "comment": "Malware payload (AsyncRAT)", "value": "f5082681a1c0a2916fb9610d88975841e8c99d536d6cf332af08f214f9026265598fca4e4490cab54e8ac92dfc66531d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912736, "uuid": "83ad3d09-e54e-4608-b80f-ce27c863ba61", "value": "T1F38349A2B685C81ACA4D47304CF6C2E63767FC145E7B974F3295F32F2E736808902696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912736, "uuid": "8d21cc78-b4e7-4060-a7f2-098af34cc78d", "value": "1536:pTxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAicmW+oVtHf6az8d53jX2wT5dFBoCrFo:pTxEtjPOtioVjDGUU1qfDlaGGx+cL2Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912736, "uuid": "909a3b6a-6e34-49ee-90d6-790a46f5e123", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912736, "uuid": "a91ba84c-085b-43e9-b90a-1955fe14bccd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912736, "uuid": "4b36db84-4329-46c8-b52a-af62f7a57339", "value": "3272023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9f2652-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894895, "uuid": "07bfa872-b0ee-4543-91bc-7a1d75270ebf", "comment": "Malware payload (AgentTesla)", "value": "127cf929c421b4e1c4fbc1f19a56f0fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894895, "uuid": "b18de681-80d4-4df4-a40e-7cb486247701", "comment": "Malware payload (AgentTesla)", "value": "41f9931ee047bc7ec9709c61dd32812e027c4f927d98a7ad6b66df49f1ac6f76", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894895, "uuid": "f56fa30e-a015-4514-97e7-42cb1c6d2d49", "comment": "Malware payload (AgentTesla)", "value": "5b1a3eed78b24f13f1ed7bac09c75f9c42c607e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894895, "uuid": "fd3cc33c-8145-4bc9-a94f-a73807ac64e3", "comment": "Malware payload (AgentTesla)", "value": "96f7e95adb0b07924a4981ee30b3b08964d06a258930b52a8dbc3613e4f14347f7e66bd5c09914bd081302659cda90a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894895, "uuid": "0d2ee2e2-e074-455d-a3a1-a9a83f0904f7", "value": "T144356B41BFE48A27D26F57B199B302156BB4D0C5E396F38F1F5822E53C92710AD062AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894895, "uuid": "6f6ed7f8-793a-4c7f-8e4e-7ae9388f9b0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894895, "uuid": "9a2ec3a4-3dd9-46b9-b08d-f6920766791e", "value": "12288:y/0R40YaIUmdM6iM8HSArLmMc6QYcmJwDkCTjQFB1q75q+snXD+Efr8:a0LgdTP/AL3Q1mmDfvQFfq75qhD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894895, "uuid": "b86cef23-9468-432b-b421-5164665c3961", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894895, "uuid": "944cde1b-e523-488f-b97f-2f39fcd67247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894895, "uuid": "93174ce6-7107-4aa2-9377-87363ae2a0ae", "value": "balance$405,000.34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6d4d55-ccf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679959856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959856, "uuid": "6a662ff1-cf37-41a4-a71d-8f75911fe9e9", "comment": "Malware payload", "value": "75a6200c7d390852fd4701f6dd8c926d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959856, "uuid": "6c3c5182-94c1-4019-b23a-69a404fca283", "comment": "Malware payload", "value": "4249f415e88c6bbbb1cbb1a6f6ba8497181b3a15d8d66ec4b4e2e9e02726b721", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959856, "uuid": "807b2068-fad6-4735-b9c6-a11f78625dcb", "comment": "Malware payload", "value": "af85c05eaf9045faaf6796ba6c53b90864d41db0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959856, "uuid": "e9075bb1-fd41-4138-b801-444c95331143", "comment": "Malware payload", "value": "43cd69bf3571a73d5a34d44896836976e704b3a6768febf9695b7fd22856979e2af6fc021d3e3c90c73ee30a298562bb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679959856, "uuid": "b6963769-56f4-41bb-862e-d3e42e5aa214", "value": "T106D5226D7FD6C42EE55FA1349337E813A395060CAD48E0672E5E94EC29B1C890F16FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679959856, "uuid": "39d56869-a2b7-4463-90ab-91f9583b1565", "value": "49152:xvZCBs+k8SXM+LEuk7daIg+h98BwEr5qmnSUX0P9iUjAyJNB0lXuqjffTUvswhCF:xvZik8IM+LJkchG8iEromnt0PMUdJb0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679959856, "uuid": "b6a57bef-a7d9-4ee1-9df3-111a82689332", "value": 2787104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679959856, "uuid": "dc473d8b-ea46-4871-a1da-4b7c3fabb5d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679959856, "uuid": "acf86555-9c01-42b3-9567-a782cdebe88d", "value": "CapCut Video Editor_v8.0.0_APKPure_Installer.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ca63e-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679903429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903429, "uuid": "6c3c0682-d943-4a21-9002-eb0644a6b941", "comment": "Malware payload (Amadey)", "value": "4252037a5918453642c6160143c906f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903429, "uuid": "9ecdb801-01cc-492c-a5da-f8908296c0ec", "comment": "Malware payload (Amadey)", "value": "442383819053791fd1d20cfedff61e4ddd39257d4c7644f1ef5cdd9695a52a28", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903429, "uuid": "7593cadd-c139-4c4b-b44f-2b52ba0fbeae", "comment": "Malware payload (Amadey)", "value": "a45397467231eb705ec646dd4c8fea40d4bc9d2d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903429, "uuid": "9dcffb11-5779-48ba-998f-f85b56f11f62", "comment": "Malware payload (Amadey)", "value": "3cd2b201cfbdcffbd88aaaadbaca5499eb215985099fe3c3e39006716fb955af6ea97893fb6c1fc8c356b570e160dab6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903429, "uuid": "f7a2680d-1855-4559-b35e-ff0c9f965258", "value": "T10B252302B7E8AD35D5F87B781CF617C32B39FC614A6D531E27C598990C722819A7233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903429, "uuid": "f68912cd-51ec-4f64-a168-8a20f50fbf03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903429, "uuid": "8808e289-371d-41d4-8f65-0c58282f1c94", "value": "24576:vyEePqIKghHeloLGx0FsNjOCMTMVKlQ0SACPXdoq:6jq32vLCusNmYuZ6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903429, "uuid": "32502875-ebc9-4518-bb62-f949f8262305", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903429, "uuid": "daef740e-b651-4fc9-aac4-b3961704c2ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903429, "uuid": "1c0bf11f-10b0-4b54-9410-0c3ae8ce579e", "value": "4252037a5918453642c6160143c906f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cb50ff-cca7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679925640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925640, "uuid": "b12db0c3-78c9-4b5d-91cd-e8b0ad72ede7", "comment": "Malware payload (Amadey)", "value": "275569f4ac08042997d9941f9b8b4f74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925640, "uuid": "dd749d13-570c-4d74-b156-f86731411f09", "comment": "Malware payload (Amadey)", "value": "445dc1fd56eae80240c6f54b3cb1b379566c739602b5d172a890432a88fd3d57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925640, "uuid": "3f4acd44-c75d-41f6-b224-d598cc869e60", "comment": "Malware payload (Amadey)", "value": "1a1861185c55572c8257f7630c6fe3a35f700dea", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925640, "uuid": "55c220ab-c2a9-4d94-b0b2-73a3f96f63f8", "comment": "Malware payload (Amadey)", "value": "f580228e0bf3152b27d78dd0d8a8e6496592aaaca7ff3b266103c4f9ce5d6c7737900f35fe4d75f276f55ab1c8003ef3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925640, "uuid": "80b05370-2384-4003-9aae-5919e6b8f217", "value": "T145252322D6D8C436E9AA0B7068F703C70B3EFCB66D6547771688A6440CB2BA07571777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925640, "uuid": "24c33741-defe-41d1-825c-834fba98ccd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925640, "uuid": "81a30b50-92de-4769-921c-649b4ec3fac8", "value": "24576:oyLrlCuGCZFxmHFcqZXTzYQSuonZcjn9ahn:vLwsWqGYtuqZEn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679925640, "uuid": "b5e7da4b-a47b-4ba6-b8f6-5753fed79c59", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679925640, "uuid": "9b2e633c-d33f-4765-b315-418e97a5f156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925640, "uuid": "1527d0e6-c47d-44b4-9c08-e9ba0ed8e8db", "value": "275569f4ac08042997d9941f9b8b4f74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe15daa4-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679950222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950222, "uuid": "d22b4d7b-5731-4eaf-b5c2-5cc552e3de01", "comment": "Malware payload (RedLineStealer)", "value": "b3ead806c04ed54a75c3ddb5339f2f9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950222, "uuid": "6ae8a3ed-8a03-4533-9742-0d8196f08c7d", "comment": "Malware payload (RedLineStealer)", "value": "44b258fae2ab8d53fa338a2888df5032af4d2559e807b43d09db623cc50a0a61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950222, "uuid": "0cdd3223-b6af-4287-9d00-1bb543d0abe5", "comment": "Malware payload (RedLineStealer)", "value": "1d4ac76a5cdeaca75994cbc93540f93a7d478254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950222, "uuid": "e9d5de26-3d91-4116-b0b5-9e8df05f1c3c", "comment": "Malware payload (RedLineStealer)", "value": "54ab4696d804b31ef9eda21d67eae27dee40fd74d48f92aa38b9e5175ab8614f9324abfc1ae54410cf6ac9950ee6bd8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950222, "uuid": "f82a1ebd-d4ea-4a1e-9c8a-e4dcf5e95ff9", "value": "T13AE412327691C073E91B16B44524CBB51E3B78354BA98AEB3744177A0E1A3E18F3A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950222, "uuid": "2c1abd89-1bcd-464c-a458-791c6b00e273", "value": "22a1312b6eef4a70b0967af8974379c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950222, "uuid": "b67bba4a-b28a-4562-9f4b-88e877d64fc4", "value": "12288:be42StnJqYU2E8wGHAoYuYvX2M8tA2NLLMcWKdAo:be4tMY9EMHAS5lkKdAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679950222, "uuid": "dedc4fdd-43e0-48b6-b87f-2544ab8b822a", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679950222, "uuid": "8a329e84-0c0d-490e-85ec-fd06e086aef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950222, "uuid": "adf00774-867d-428f-8dfd-6f8d87e78f45", "value": "b3ead806c04ed54a75c3ddb5339f2f9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b738f0c6-cc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679909301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909301, "uuid": "1e1e4b1c-5e1e-45b4-9358-f2ed7aa9b523", "comment": "Malware payload (AgentTesla)", "value": "d444fe22ed3dcbdded0a9a84628a731c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909301, "uuid": "74d05630-6022-4223-a6ee-a558f64e55d4", "comment": "Malware payload (AgentTesla)", "value": "454c784e20e24793d9ed6ea55e6c8b308ced6dbdaf8a3d2de5dd7b1817ed231d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909301, "uuid": "37985d24-b131-4953-bd46-104dcca90399", "comment": "Malware payload (AgentTesla)", "value": "7cc58f8e8f3b979330896ee889865aab75faad4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909301, "uuid": "10004fcd-3a2b-49e4-85b6-1ac7929a7854", "comment": "Malware payload (AgentTesla)", "value": "8eaa1f96a0a5864126b9ff949612767fa384ddf1ad78c31190a105571b55c28c4589fdb820b003374f7d2731bcb9a266", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909301, "uuid": "174f1cef-4c0e-4577-867c-448b883044a5", "value": "T1C305122FFB24A711D7B586F82AD05941E26CB5E15B9BED44AC9C30C706F7B408A93B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909301, "uuid": "4341f6b9-13e5-40ad-bb89-59cb76ce6ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909301, "uuid": "7f1a4de0-a6c9-4af0-a7a6-3b52ea7aa4db", "value": "12288:KUJB0OwKGww6dHoMw1WMU8yHyMqMUh1w4Olapol/c3yb3WLA7JhZ:T7Bzpw1jUpHylMUYrl/yVkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679909301, "uuid": "a1715bf4-6d74-40f5-8390-e6074a418222", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679909301, "uuid": "666763d3-e40c-4577-b8d7-3ceae293c29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909301, "uuid": "445a8267-74a7-4208-a472-b46c8fd30f60", "value": "SecuriteInfo.com.Trojan.Packed2.45096.28476.18977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad18e4d4-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912720, "uuid": "7de67541-9862-421a-84f2-923fea1d0b01", "comment": "Malware payload (SnakeKeylogger)", "value": "808f8ac449669ae3643ffe010adf4702", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912720, "uuid": "16d993a2-c265-41d5-921d-4814af99728d", "comment": "Malware payload (SnakeKeylogger)", "value": "45ba0096ff6b7eea43a7ef2e6af9c32f03dc797f50097c50b56e8b185e057e36", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912720, "uuid": "b49e8979-4869-4157-93b5-1b327beb58f0", "comment": "Malware payload (SnakeKeylogger)", "value": "8d4205b322a39289aabc4b6506abd7468af2b76b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912720, "uuid": "bef2952a-f5ca-4e49-80c5-07a2f4813dad", "comment": "Malware payload (SnakeKeylogger)", "value": "cf5b7242e3b58a61c565ac0eb0332da3c790f6fcc49da2dbf7665e517812e963f57be00963ad12c095a24adbaf8c6968", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912720, "uuid": "bcf104b1-17b0-435a-b890-cb1ead3f4da5", "value": "T16A5512039141DDCBD0E98374BE237DE6450DBD7272E972C32884776B5B32E9B864A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912720, "uuid": "1ab33eb7-ec8c-42ae-bf01-74e40612d53c", "value": "24576:ULKvWQmmav30x2SSMMednE4P6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXS9SSMM2:ULKeQmmQ30wMr6vMMt6SD5HK9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912720, "uuid": "7c09cda9-c5e5-432a-9509-8befa1ecde64", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912720, "uuid": "f6659ec1-010a-4895-b9b0-65f626221198", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912720, "uuid": "d0ed2af3-0d92-49ae-9620-bbe3bcc807db", "value": "QUOTATION FORM #MV. CHIANG LAAN TRADER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa89c3e-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679949929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949929, "uuid": "a4de2b74-b222-4843-a2e0-a1630239f848", "comment": "Malware payload (RedLineStealer)", "value": "13324e2d31d88cea1131b8d302ecd0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949929, "uuid": "b374ea88-8fae-4f0c-b0ac-7b966e9f9e08", "comment": "Malware payload (RedLineStealer)", "value": "470675f8f629c37bb9fb67e5248b2e612f7779258e54e4665b054a69914b7ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949929, "uuid": "0f0e2c0f-efc4-4835-af86-6f5b7b985d49", "comment": "Malware payload (RedLineStealer)", "value": "1fb2f9884c4921ef6e6db1ae10783c8f4c1781dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949929, "uuid": "6b3ae1fb-ec69-4f16-a0fa-ee9c100f7170", "comment": "Malware payload (RedLineStealer)", "value": "65c9e7f913bae07d1281155c12391ef3319ff22110fe1563ed8293747277ee286b6bc32cda868e7041cd72f9cb12531c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949929, "uuid": "c6176949-c51b-4eb1-bd23-1801e4f491e4", "value": "T1A4E412327691C073E91B16B44524CBB51E3B78354BA98AEB3744177A0E1A3E18F3A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949929, "uuid": "f68ef8fd-6467-48ab-acc4-38d8d865ff13", "value": "22a1312b6eef4a70b0967af8974379c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949929, "uuid": "e98c95c9-e613-45fd-a47f-ab8fb4912029", "value": "12288:Ze42StnJqYU2E8wGHAoYuYvX2M8tA2NLLMcWKdAo:Ze4tMY9EMHAS5lkKdAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679949929, "uuid": "f31847c9-d71d-4a91-8952-7220fbb53b12", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679949929, "uuid": "5b0406cf-71ce-4879-b97d-7b0dcca64e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949929, "uuid": "624636bd-9d2f-4acb-a43a-62adb82044c2", "value": "13324e2d31d88cea1131b8d302ecd0b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1a9ae6-cc79-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679905736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905736, "uuid": "5d6e86d4-109d-45be-bfdf-253c644a26c9", "comment": "Malware payload (Rhadamanthys)", "value": "38d3d2a0690ac2e76c6f973dee1b14ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905736, "uuid": "8b1c7051-ec73-445f-8b50-54b4f23151ac", "comment": "Malware payload (Rhadamanthys)", "value": "4728f451f13556ab522bc74a447d90ba474478c886d3b313270aaf44914a95fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905736, "uuid": "516097d0-5e86-41da-b4d2-2af150007f44", "comment": "Malware payload (Rhadamanthys)", "value": "5c3bc25fb02ca7f80c77a12db22f2d7f6069bc4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905736, "uuid": "5ae42f62-66b1-41c3-8c78-7dfe2b4c7781", "comment": "Malware payload (Rhadamanthys)", "value": "3bf592000ee1e5e28cda65e7c110b10b31ef2e00f537191084d370086157376dff3fb1beca54af0c561590eaca46d215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905736, "uuid": "83b28f9c-9f92-4176-9c6d-e782ca6b1233", "value": "T18F44CF12F6E1C832D45A81748825C7F8697BBC70CB5986C77754673E2E317E29E3A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905736, "uuid": "2711c18c-9f66-4e20-bb79-2b266f9cb26e", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905736, "uuid": "7ff9c06b-c1a5-4d6c-b9d3-92310a70d97a", "value": "3072:eT8V91dm2QD9Lh1ayFev6Gh4C8PzaGkndj3xqOwZMcOKKx7vs5xbgVqMsi:eY6D9LyyoXxGkmOwZnOKKx7wMVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679905736, "uuid": "95135492-73db-4de7-8f2c-a3a29c995f81", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679905736, "uuid": "8065ea7b-dbdc-4a15-8f03-64db369b739f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905736, "uuid": "91d7416f-4059-43ab-84c4-14f6f933fe67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b95530-cceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1679954847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954847, "uuid": "38cdba4d-de87-4939-940e-ad1a3b11af5c", "comment": "Malware payload (AsyncRAT)", "value": "9bd557d5267ebfb6baaf4a21a66ed2c6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954847, "uuid": "ef27336f-5b3c-441b-ab24-7be69c9e7b1f", "comment": "Malware payload (AsyncRAT)", "value": "486d9c1f259ee472964bf817ed2b8e218440f7b1145230ff8cbba6a3da3c8f55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954847, "uuid": "52848519-bd73-4e45-ab19-2bd8e0b15231", "comment": "Malware payload (AsyncRAT)", "value": "3c2c2b3bc380622464e99555df6da3a3830b7460", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954847, "uuid": "5833432f-7f3a-48dd-9eea-866a24cafa83", "comment": "Malware payload (AsyncRAT)", "value": "dda975b41b0c69f3c48d41ba74ed266320abf5491c0ee967a4c230962b927a0988991b17e695c76cf51f10a19a3e0d02", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954847, "uuid": "eb21750c-12f3-49b3-8d1d-ccca705ead16", "value": "T139536B002798C965E2AD4AF8ACF2950146B1D5772102DB4E7CC814DFAB9EFC64A137EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954847, "uuid": "d1e18048-de42-42e1-b964-27b3377bfc7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954847, "uuid": "2275734a-31b2-4dfe-af2e-51cc4116e59e", "value": "1536:zhp5LrUwk4Xq0WdZeeiMl8GbbXwI1vNGRZVclN:zhp5LrUwk4XqdMeFmGbbXRUzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679954847, "uuid": "b0ff3f6d-8ed1-4742-a968-caf675a0cfc0", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679954847, "uuid": "cce8d1bf-cea7-4173-958e-cb478200634f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954847, "uuid": "417b3080-7955-4212-b498-109172050d88", "value": "bKUy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcea05af-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878387, "uuid": "ec4ae31f-8696-459c-9753-e9c165ebd008", "comment": "Malware payload (Smoke Loader)", "value": "43a38a47ef483b7b85dbb36fa0942482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878387, "uuid": "6bc65336-2658-4c65-8657-caf0752623a8", "comment": "Malware payload (Smoke Loader)", "value": "48afdf3096aec65e9aa9b03782ec7e6c0d5d947aed98eb334653c77ca574904c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878387, "uuid": "11d4b69c-dbe8-4cb9-b12b-7fdc37e4e688", "comment": "Malware payload (Smoke Loader)", "value": "1c6f40628f2456ced3c4a8da5e5c8c7a4af854b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878387, "uuid": "f49aaf63-2915-450d-91b2-a9b5287cacbb", "comment": "Malware payload (Smoke Loader)", "value": "ffc1698b54fe2778056af886bd4a9ce9af7a32b17fd26973e873ce1879452bd6f4638673ec73fb36ec12086901b4141c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878387, "uuid": "b6e6d86e-184b-49a2-9618-d0b1f4be2f07", "value": "T1E4547C2E93F46870E5334732BE2AC7F82A1FB8515E177B5E3649AA3F0970661CD62305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878387, "uuid": "247cf7be-4360-4374-964b-88d9e51bac37", "value": "87d886eda68b09da2d904f9205843127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878387, "uuid": "e533dd6f-9f65-4cc6-9c67-27711a99e165", "value": "3072:8TEwzIgfuL6iAGx3U+GGxsd1uaepzFkonxZNkEOQLESqY5n78Ug:21fHtE3U/AlOQLESq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878387, "uuid": "2fb98094-0f63-42b2-824e-ce9d9fef3b20", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878387, "uuid": "11561bed-eade-4ceb-9cc7-7b51e0a43023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878387, "uuid": "755d03ed-be39-4026-939b-a35065189257", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3eed11-ccec-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679955029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955029, "uuid": "540d1376-9a4c-4f0b-be5b-607f225daa8b", "comment": "Malware payload (Amadey)", "value": "ada6450fc6efc367222f2a7ea30c76d6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955029, "uuid": "cb808023-671d-4e95-aa84-599662d97755", "comment": "Malware payload (Amadey)", "value": "493081542c3256becb2e4cea2280944660f81395e0cf8d077e4f04bebc3c4bc2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955029, "uuid": "f4bba4a0-6e78-4b9c-97f7-37c134f1abe1", "comment": "Malware payload (Amadey)", "value": "a08ecd3bda65b780c0f94e5341968b53ac73f07f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955029, "uuid": "b6d45c93-6832-4d3e-af5e-82d65ebeb092", "comment": "Malware payload (Amadey)", "value": "8229d87aa775c9d92c23157560af200030ae0870a19bb2d7a70c3da541727124961b16b657ad23ec90786d72efb061d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955029, "uuid": "8ae84cef-e92e-418a-87c7-411826b0aaef", "value": "T1FD35225293E841B2DDF11B7058F712830E36FDF08E6492663646E5A94EB3299E8F1373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955029, "uuid": "63eb219a-a797-4b7c-8d75-32667d5af9ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955029, "uuid": "7b4fcc00-5b9e-45de-98e2-f10b427e6f44", "value": "12288:SMrLy90twnhBFB31r9b+RESnGYiXJCDhZFIy+pZl+XO+/n99O2x3KTI+DskOrp11:Zykyz31Rb+RbnGLkazludCsXjHoiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955029, "uuid": "c7199a14-5968-45d5-bda9-dafc11881a71", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955029, "uuid": "9ba8db77-00a9-4108-bf22-2037e720a634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955029, "uuid": "1746ef89-e1ce-4292-85b2-706cad3d93b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae00b704-cc90-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679915728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915728, "uuid": "d352e021-d160-4bae-a6f4-b9a6121af865", "comment": "Malware payload (AgentTesla)", "value": "685cdb46d2d3d3d835f857c6a72a8fc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915728, "uuid": "11f27c2e-26ae-4579-9639-3a28f4ba9c61", "comment": "Malware payload (AgentTesla)", "value": "49830344b368f82a8125ba389948ec66ba1bc5082a4176ec65fbada1f8c331d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915728, "uuid": "778a25cd-6a96-41b1-99da-4817ebff06bf", "comment": "Malware payload (AgentTesla)", "value": "763b86c8f2250d2370733ecbe459c472d36f79fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915728, "uuid": "35c2fe7a-627c-4b25-99e6-f0cbec5813b2", "comment": "Malware payload (AgentTesla)", "value": "e667383f65bcc7b257cc9c949a605dd1846df0c2b598d14a6fc47c922a6793eda9fc13de9567acca8f1b9e41cb1efb35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915728, "uuid": "f32206f2-23b9-4caa-a22a-474db905bc81", "value": "T114F433778D8E4370BEE5D207C24E39C87C353A4948BE7A091CEB4269BD90AD829DF5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915728, "uuid": "095edb80-b404-413d-9159-2ebe8b31c37a", "value": "12288:pL7Icw2EJp/lWU64OzqhLv7VwyKefeH5GRqS8WsZUAKf1DgTxJ3EjTq918:pL7M2yp/ldOzqbZKeKaqS8WtdDSJ3EnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915728, "uuid": "f76de240-61bd-46d7-bf35-f1eabde20511", "value": 741380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915728, "uuid": "a10d5805-64c4-432e-ae00-b5c4c8d43e83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915728, "uuid": "1da011c7-f7e5-46ca-93c0-72bddb5d291a", "value": "QUOTATION REQUEST 818800369_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc93b46-cc38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878016, "uuid": "50ccf0a0-e9c6-4354-9932-715c4f2552e7", "comment": "Malware payload (Smoke Loader)", "value": "7f821f1dbaf6aef551e3769b3f57fd8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878016, "uuid": "af5c8871-f850-4010-8a0a-2ee524a2654c", "comment": "Malware payload (Smoke Loader)", "value": "49db6a5491ddef53eb912d569fb0a7dd65bafebaf4dafb54e230bd3c13786d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878016, "uuid": "a25b9c1e-40fa-432d-91f2-865eb22f63ac", "comment": "Malware payload (Smoke Loader)", "value": "3795efadb7d163673cf2f1c84b314290175454c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878016, "uuid": "4b8aea19-4947-48e0-a692-a24c694bb864", "comment": "Malware payload (Smoke Loader)", "value": "fa3a59a8281fff3591db11ddf55575658a5436445ea7c980b6e015e4249b846c57963c66c6a6121056086b74f8e43104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878016, "uuid": "177d7afc-e9c3-44b4-a7b3-7631a8c0872f", "value": "T1B8447C2EA3F46860E5374732BE2EC2F42A1FF8615D577B5E2659AE3F0930661CD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878016, "uuid": "224cef82-dbfe-4f57-8a39-5f774f41f6e9", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878016, "uuid": "b488f8ac-5788-4fbd-82a6-247576c5cd40", "value": "3072:lXPhj9wA+FFu5wZvovffVxWnm+Xo+BZnH4l7Sp72+OR/pVsZ/LicvxlYfv0SUIll:VwvI5cvmWn56U2+OR/u0bUeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878016, "uuid": "55432970-9974-48b1-ba80-0a572ff4bd56", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878016, "uuid": "dab2c7bf-f654-43e2-8592-2008d7b36b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878016, "uuid": "0f3803a6-a887-4fa9-8477-45e5aa3c7f20", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a1cf6e-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679912471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912471, "uuid": "a50deca9-a95b-47a9-99b1-5f07ae45b37e", "comment": "Malware payload", "value": "1b7a8ee020db86fe7ea63ea022095e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912471, "uuid": "eaba26cd-dfa9-4aca-9d31-97649804895f", "comment": "Malware payload", "value": "4ceb5b74455b8630d38bdca2d5512779ef2746b5745236bb7e00190a2f6fbed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912471, "uuid": "d8ef345d-392b-45db-bb4c-197a985f5b62", "comment": "Malware payload", "value": "28e33814dc8639c19ada246cdcc1dcad10092be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912471, "uuid": "6e5f4f7c-0305-46d7-9b79-c7ad2ff28a7d", "comment": "Malware payload", "value": "368916d39aac6795f03922daecb2638f1b0813070aa8072d69149624f87b78d2a6a880535745cc6cd8c8d0f1f9625636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912471, "uuid": "98acf119-ebc8-48e9-8079-c083945de921", "value": "T1DA56236752A10158F5EACC3D8637FD7976F70FA39542DC3D26FAADC019228A1A213D83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912471, "uuid": "ec7d1039-32ff-4359-87cd-9bbc41e82e3d", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912471, "uuid": "21a2d2e4-dd3b-4812-b673-dbe7534eee07", "value": "196608:Nzc9rmNK3+4qzI2/YanRhRoqqdH9BxkkN8HkC:J8sKly/RAZbxkkN8HkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912471, "uuid": "cb018cd2-272f-4893-bde1-bd9aa7e3b3d6", "value": 6339584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912471, "uuid": "8ec43baa-28d9-43c9-b9e4-9624e8d5992c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912471, "uuid": "79f0880f-946f-4fef-9476-48ec2d4bc27d", "value": "1b7a8ee020db86fe7ea63ea022095e88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbce402d-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679913282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913282, "uuid": "eb411df3-fd54-4936-afdc-1bdeebe210d0", "comment": "Malware payload (Loki)", "value": "ff814f0221fecd58578c9a0db15d9a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913282, "uuid": "eff619a0-682a-453a-b4ca-c3ba4cc07bb6", "comment": "Malware payload (Loki)", "value": "4e03dfc5f70361b7adea720dcf58b2183dbc3ecab58bc8718c2432cd6a3ff7d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913282, "uuid": "c5736bc5-31ac-46db-95ab-1c2e623c9945", "comment": "Malware payload (Loki)", "value": "d29d0d05fdbd3fe2484d6d17bca4cace4329c337", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913282, "uuid": "43d088a1-5f32-4a86-9208-2b109e98326d", "comment": "Malware payload (Loki)", "value": "c881b3cb6af4af82001b2348b4598e952716081aed6c9ff1d20043d01d6d9595adb21e711269a51a386bd49785666f6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913282, "uuid": "bbc8fffc-fbbf-46d4-9ba7-8a7cb2655416", "value": "T1CBF4F149F3E4A722D376A7F029B09914D3BCB4E72B56D98D4D8960CB80F4B104E53B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913282, "uuid": "1ffe9cc8-117c-474a-a645-4f6f2fa89b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913282, "uuid": "4a102d2d-58df-4786-aed0-118685a26549", "value": "12288:qA5FB0OqE1PX04GbF6nPpFRtVr9X9eKC5+ZVR5d947anJhZ:qA5v14R6RTtl9te3ezPS78D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913282, "uuid": "8d07ce42-c735-4fa2-b39c-7376205e721d", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913282, "uuid": "e0969fa2-6aa5-46f1-ab8a-dcf7e69ea6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913282, "uuid": "88d85967-9d50-4e1b-b737-364b37964720", "value": "ff814f0221fecd58578c9a0db15d9a71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256f27ce-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894883, "uuid": "4007953a-9f37-480a-9193-073cf9b5d005", "comment": "Malware payload (Formbook)", "value": "23cc5925e86f20f1c3c76ed18dc70630", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894883, "uuid": "096c65c2-5372-46d4-b6b5-4b3d21608c9d", "comment": "Malware payload (Formbook)", "value": "4e658306b0e3cfef3c635ce8144fc856bf0de5d1f7c1c7f480a18ba3998fcd63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894883, "uuid": "e1452c78-78db-4c14-bb9c-c53ec116b030", "comment": "Malware payload (Formbook)", "value": "df4b4038f9bfcb320b84d81c49f3ef9eb4c49106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894883, "uuid": "5c4bb61c-0b9b-44ed-bf3c-e5114da06bd4", "comment": "Malware payload (Formbook)", "value": "b1ec290cb19e1510e71026d88fe067e903bebb14d6314ae448de7e70d4170c3eed0e6303ba5e2d3a63f8f8cf51ed6162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894883, "uuid": "ed14655e-9879-4c8d-b2dd-51a524bfc8ba", "value": "T13404AE36DA42C071F2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894883, "uuid": "d7ac6608-da95-4fc2-af54-bda38360867f", "value": "3072:2bX4kQvFJdO43t/c5scFV6hP/zSJRDUweMoeks3jG1ZlRRR:BU2tk5B6hP/MD9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894883, "uuid": "b69adb0c-8083-4b36-85c5-bfd88575e7ed", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894883, "uuid": "fbc71149-fc4d-4689-9353-0f7571e7c981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894883, "uuid": "7c6691bf-621a-4143-b62a-483ca1ceabdf", "value": "4e658306b0e3cfef3c635ce8144fc856bf0de5d1f7c1c7f480a18ba3998fcd63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427ba712-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679880758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880758, "uuid": "ea07f787-e9f5-459a-a9dc-c1d1bcd03d77", "comment": "Malware payload (Amadey)", "value": "9849551fcf5121153f2f7ad4cfd1e4e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880758, "uuid": "b4f633bd-b653-4d40-a530-d4a5a6be048e", "comment": "Malware payload (Amadey)", "value": "4f2d28114a2220a8f0e03e5f596d3890398f59876f9951c140f6853faf945543", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880758, "uuid": "eb7cf6dd-d912-4189-b3fb-fd573c222476", "comment": "Malware payload (Amadey)", "value": "7bbc8c0282ef34725623c474bd05b1e9165dea2c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880758, "uuid": "25c6bc30-7835-4c83-a867-87280048ffac", "comment": "Malware payload (Amadey)", "value": "2abfcf63a520f546d6a1a8b6b293b45ab299751a879c9a95159374c6cd4c522fb9c7ea419162eddb2e9c7ac49c5db1b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880758, "uuid": "1f048c0f-0f61-4437-8977-9a35d855b0ea", "value": "T124546D4252E17860E72387328E2AC7F42E2EF8615E167BFE13599A3F1975FB2C152305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880758, "uuid": "20b8cbc7-9d1b-4b64-b16a-dcd9bd848066", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880758, "uuid": "9e098e3c-e8c1-4b2d-94cb-0dd6bcefa567", "value": "3072:g5lMKzcZ/Y1P9QVuEu8GtpBuk79f7Rn6j8rodsBAlyo/1DdfryguaJdhL9PCJQNA:CETuxtzuk7L8/WClN/FdfrwC6Tfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880758, "uuid": "3ddeb37a-8469-4e8b-9e73-a7f798c8233d", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880758, "uuid": "b653ef33-7bad-4276-a80a-811b3325bd7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880758, "uuid": "456a0a6f-7176-43e6-bf4a-cb8a85a2ef9a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c3af15-cc8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679915119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915119, "uuid": "6eb153f9-5faf-4a1e-ba73-98754596c168", "comment": "Malware payload (Formbook)", "value": "4ef3bfe67588ffebb595fce72889a5ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915119, "uuid": "17e87ada-0a24-4cbf-ac26-616b700f6923", "comment": "Malware payload (Formbook)", "value": "5022496f74264b58155147c5db68f7f6d0396d6c8f4d68e788209a042480a6d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915119, "uuid": "93578be4-ca42-44b3-8bae-af31e1b7337d", "comment": "Malware payload (Formbook)", "value": "0b0f349c581c0c0029f592dd658ad3a6a685a6c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915119, "uuid": "b03bcecb-95f1-4da6-922f-7c0581cf1ac7", "comment": "Malware payload (Formbook)", "value": "168ddf48b389d3ff3f1350e4794716e1c96d7e2670b9e1fc5a6b0bc7d43e6360a73ab58a730d6cac1bf43e07460e0e62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915119, "uuid": "dbd325af-e42e-4caf-9aa2-ef674c285724", "value": "T10E54CE087EC89397CF99053C1DEA5A51302F9DDA39279AE60D493CFA6B33B1D9163B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915119, "uuid": "a31a669c-c58e-4957-bfad-aa8e6a604464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915119, "uuid": "59ad02f6-a1be-4dfd-8a40-4b6e650faaca", "value": "3072:4RErAY54db0bOWl3BN+bFw3EzoZmdEq+B9C6GzlPIOXHt:4qrAY6db0CWl3hEzoWEqNJIOXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915119, "uuid": "a2c60ad9-a252-4d99-8bd1-a455776a2755", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915119, "uuid": "edd29ff7-b676-4aa6-9212-745b873d7dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915119, "uuid": "3cec4597-343a-44cd-97ea-890cfa49a170", "value": "4ef3bfe67588ffebb595fce72889a5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b30c602-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679949922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949922, "uuid": "78f32151-c0c2-466a-befd-01f26fda736b", "comment": "Malware payload (RedLineStealer)", "value": "3c21487478306bb0e48ae27cab7c9465", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949922, "uuid": "5ad439d1-be10-45fc-9daf-093b1d6d4787", "comment": "Malware payload (RedLineStealer)", "value": "503ba0174224929fc89facfb25050d0d39f0cc88f384ebd9d717ec7f45680d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949922, "uuid": "2605b97f-0e72-4c27-bc45-981a0d549a59", "comment": "Malware payload (RedLineStealer)", "value": "5947976e655f52f6411d2022fef7fb9d03a901e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949922, "uuid": "6a1f41cb-5ecd-4373-a9c1-e12d365fd070", "comment": "Malware payload (RedLineStealer)", "value": "f76366a86d2179c60c6e524fb964096450bd432ed631061bc3fb452f856a7b013c221b0f831e68e779ab3b807a101afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949922, "uuid": "87b0428b-0b53-44a3-823b-806e36fea41b", "value": "T134E41202FBE88477DAB62BB048FA02831F34BD615D78525F3B95D4AB0D73A50A53235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949922, "uuid": "cf1acad1-6844-4433-ae59-e1aa60c510b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949922, "uuid": "3ce59cdc-6473-4b84-bb13-1bc0c401fc26", "value": "12288:+Mr7y90dAI5mSsIkP00dAbqGxIjfSCPO0gmRnhvATAChIger/CW:lyfIYCd0dyYjaQgmBhvAMCyPOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679949922, "uuid": "6e1c4ba9-8aae-4846-baf0-c41b592c46ee", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679949922, "uuid": "69643d32-607b-41de-bdd9-a698f4dcf177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949922, "uuid": "75b47673-8761-416e-a85c-43307ef2e043", "value": "3c21487478306bb0e48ae27cab7c9465.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2052f56-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679912755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912755, "uuid": "0281fe59-c9b0-4980-8da4-474097fbe6ee", "comment": "Malware payload (Rhadamanthys)", "value": "c81a0ca221d403ef573c70776ab89afe", "object_relation": "md5", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912755, "uuid": "41f03a98-d7d4-4433-bc02-8156301420b0", "comment": "Malware payload (Rhadamanthys)", "value": "504eb5b56f45a2ae56fe242b656682da9ef5e300218e53c249bbe7deedb70c54", "object_relation": "sha256", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912755, "uuid": "96491d93-3cde-4371-a4b1-a3d125ca9b55", "comment": "Malware payload (Rhadamanthys)", "value": "4612884836cb9e0ce43e4d36ef95f03553707ced", "object_relation": "sha1", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912755, "uuid": "32df9552-9faa-4fa1-9341-f983f3b2a2e1", "comment": "Malware payload (Rhadamanthys)", "value": "7d97ef0cc9fa399067504f5010f0150a5d7ce0f34a00cbbd7b50ee79f7156070473170ab4474568163f75025be07c817", "object_relation": "sha3-384", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912755, "uuid": "03ea99c1-f02a-4223-a7b9-c42de4a6fd7e", "value": "T15CA3F168B795E129D18989350CE4D0C76BB03D62FC5A8F03BA95772F1C38A54DD23369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912755, "uuid": "aefec4bd-e3b9-4d30-8dd5-9906a04c7e97", "value": "1536:XgaBBp8ddw3H14MxkgGGBI3MxLuH4lGTzpvcoeYJXLVjEHJjAc7:XtBIde9xzZI8xLa4ladc0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912755, "uuid": "8c13591c-fd28-42ac-a7d6-182b82fa2778", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912755, "uuid": "2913d1e4-3633-4346-a6ac-1323d9f8ae37", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912755, "uuid": "e138d6c0-acec-4fe5-85c2-0a25dcb4b7ab", "value": "shipping document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04a3dbc-cc73-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679903357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903357, "uuid": "c506f638-5c23-427e-a57a-4e768b607553", "comment": "Malware payload (GCleaner)", "value": "aaf24782f26291074d3b401f9f527aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903357, "uuid": "ccb3a993-cc07-496c-835b-5efc878e0cb3", "comment": "Malware payload (GCleaner)", "value": "5230f63d9733c5ece45053225a417e89fa6c9b7e81a0eafd467a5f7adc5fbb50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903357, "uuid": "f9eeafed-8270-4113-af41-ff990cac59e9", "comment": "Malware payload (GCleaner)", "value": "b3fadc97f249fca2df575dd0fd8290141d1626a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903357, "uuid": "548d00fc-3d91-4826-8390-59b11deb4f2f", "comment": "Malware payload (GCleaner)", "value": "1ba15be386b1b4a7ac648d3b2246a7d8eed1d6532d09b4a943832933dd28dc634d6ebe8fb2de3176b4fb249030cc012f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903357, "uuid": "bfba355d-f81d-491c-810f-1fbe613888e5", "value": "T1989533129BD24DF4E6728B322D78D655AE37FB161CB930AC22DC9A4D4D7B293805D30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903357, "uuid": "919b1f3f-fa4e-4447-ae5e-3a4549157ad8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903357, "uuid": "2014698f-610b-4b59-9886-d1937af1ad3a", "value": "49152:EGlJfs3ZLgiHewImlSHeXP7YOWTjamG5Kw3gY+UA5dlLYp:58LfHeYKQYDTjam+bHMPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903357, "uuid": "567b8f89-d856-45c3-a508-e6b984130316", "value": 2022389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903357, "uuid": "06138365-a6fe-47d6-8452-dc35e80ff86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903357, "uuid": "6fdbd5f8-14b3-4c85-b5ea-b7e9bc468302", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5369a8-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679901552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901552, "uuid": "01dab310-6117-4170-8f72-c94bfa0536fb", "comment": "Malware payload (AgentTesla)", "value": "6b6e2901c1ffa7a191594531c76cef47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901552, "uuid": "13bf256c-36f1-4d7e-94ef-b7c3596430a0", "comment": "Malware payload (AgentTesla)", "value": "524635dc6235eb608f2d975e636386c5e159d3104b21ed0e343b6981a36be622", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901552, "uuid": "3d1890d2-3732-4320-893f-4f476b8175df", "comment": "Malware payload (AgentTesla)", "value": "773ece85c3def9114b34092b0ea2f601bdca2383", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901552, "uuid": "3360cfba-ca68-4323-a1c5-66cade395306", "comment": "Malware payload (AgentTesla)", "value": "ce21c022eaf65320627a67cfd1239d530e1f965bc2f8e82b96f2b403eb755f9ead890ff43def582d10bf44a1eb890797", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901552, "uuid": "090ac136-03bb-4702-a246-86f609e4e8d5", "value": "T13A0522457F9D4D31C7AD57BA27B2D1DD93B479279358DE2818EA10ACCAC7A4282803F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901552, "uuid": "1ead2b19-e09b-417e-8585-b2e6845f86ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901552, "uuid": "9e019fa1-2f6b-4520-84eb-288fed947fd3", "value": "12288:7va2SUvKSgmsOkobT+fQrYFIctURD2d4+Yp3ILuiPy0d5imHcel/IfscYQULX:Q+4OkobT+fQoIG8H3IiiAWcpfsh5LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901552, "uuid": "f0f5616f-9e59-4aae-9acb-420a5be9261e", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901552, "uuid": "f4391d42-b5a6-41c8-8f58-487c14ebf4b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901552, "uuid": "97df0e61-758f-49c5-a43c-4198f88a4a4a", "value": "QUOTATION REQUEST 890125667.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7b9886-ccd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679946117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946117, "uuid": "0f24c0dd-9e4c-43dd-bffa-ae6ea95e5b99", "comment": "Malware payload (SnakeKeylogger)", "value": "97dda9477c75520715b9f892bb9dbcda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946117, "uuid": "42c14625-f3cc-4abe-8d3d-0a20131b2222", "comment": "Malware payload (SnakeKeylogger)", "value": "53186731a63a71683ff6672b8fad44b2d8df96dd8c11b9817eb2a37422d65860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946117, "uuid": "75a192be-aedf-46cb-ae0d-421e8c1620aa", "comment": "Malware payload (SnakeKeylogger)", "value": "5f808069589336be86d65ddd34d0301af0331e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946117, "uuid": "590adad9-8286-4b73-8c5e-fc7926aa0950", "comment": "Malware payload (SnakeKeylogger)", "value": "d283f0e8d9fc977855edb93a65f8d3a859c377449b457e4d3b717b6deb22a51381ce5be4487c3d4891ca33c56a0969d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946117, "uuid": "c3662619-3521-44fb-a4db-fc7141340311", "value": "T177F41229B79AED02C6BC6A79C7D7012403B569875233C74B3FD9228625067F66C09BCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946117, "uuid": "f24177ec-865d-4d5d-8941-250ee0228728", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946117, "uuid": "ebb4e972-9e18-4e27-b6fb-3b067f299b92", "value": "12288:td7w9YO/R3rM52Wi/ODakc2MJR2Mh/SGLuYj26wH6Mulz4fr5TtiGELCAEgiV5xg:Dw9YOqg/ODFYR5tLDj261Mulqr5Tw3Vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679946117, "uuid": "7c23f1e5-c6e1-4088-8d2a-c57060008a14", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679946117, "uuid": "e30aaf52-6c52-4e51-b1f1-1f14adbad108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946117, "uuid": "2af0d647-7c49-4f02-825b-f00a9304da77", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd066796-cc5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679894762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894762, "uuid": "4e2f95ba-e6db-4c32-a42a-f96a31bef253", "comment": "Malware payload (RedLineStealer)", "value": "b9ea399bd157594c396ce789339aa8d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894762, "uuid": "8775c2c4-f8bd-43d9-86e2-cb3af07c66b9", "comment": "Malware payload (RedLineStealer)", "value": "53ff660378078278aa3b128165e190dca83bfbb9e90d8328734184b8cf01272a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894762, "uuid": "58ef2a55-b983-4e15-a86e-abfb2770784f", "comment": "Malware payload (RedLineStealer)", "value": "9c4822c2d007be59bb77335d764fa24d989d9674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894762, "uuid": "e58b4398-b289-4e62-ae13-a399f33df1e6", "comment": "Malware payload (RedLineStealer)", "value": "0f29da64aa9b39ab1d935573a9e9cb0bc1b01168159657f433e237df6ff40926076bf9f8d29921c649d161fa0f0d582f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894762, "uuid": "1705ab09-6493-43ae-b466-787c29cbc2c1", "value": "T19CF41352BADC4173E8F517700CF543870B36BCA19DB9875B2786688B2CB29D8987137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894762, "uuid": "8b1da87b-9661-42a9-a178-293c1f1606a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894762, "uuid": "bbb3b39a-227b-45b7-97e8-8438b8b2f37d", "value": "12288:uMryy90t879wVndfB/1Kwn6JWQjQxk3BNZ7f6g+ScZsVSayg4g1zAmfh67g3vYB:wygsw5NRWTjQxefi/ZQSvg4gl/JhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894762, "uuid": "23b69ed4-f206-45c9-86ec-78134af9e103", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894762, "uuid": "06249b31-4711-43c1-9df8-075d5cd6aaee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894762, "uuid": "f27b1fb1-1fe3-43fc-850b-59598fc0b84e", "value": "b9ea399bd157594c396ce789339aa8d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db10709-cceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679954543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954543, "uuid": "415eacfc-805d-4430-b216-2145517d6173", "comment": "Malware payload (RedLineStealer)", "value": "66cc39066025dca6a6e5e6d50cb8a7a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954543, "uuid": "718a02f8-85aa-4b4a-ac12-7709e0b94f5b", "comment": "Malware payload (RedLineStealer)", "value": "54ec09c94cad8063383f7ada6d865a66ba1003307e16f4da6bb5417225461dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954543, "uuid": "eec9fc00-eef6-45d8-a735-38418f748cbf", "comment": "Malware payload (RedLineStealer)", "value": "488423737bc8e626a4b8f460c9f52f1f7b1f91b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954543, "uuid": "0f57a28b-8d27-413e-af1e-23dd9b20ae05", "comment": "Malware payload (RedLineStealer)", "value": "8fcafabe8a13f8873c5c52ba67991de7667345924df6baaf2ccae854c65e99498c513dea50f7c22ef4b56c7cf28c255a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954543, "uuid": "97c19281-a228-4a47-9241-084a2a5aaa0d", "value": "T12E54071B02E48E2BFCDEDA79919A22509C5F39E3ABC5C2CE179C954B0558B5C703AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954543, "uuid": "a613175f-14c1-4375-ad1f-58a0cab6cd7d", "value": "67a13e475a7159590c30461a3c5d1a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954543, "uuid": "4455380b-56d6-44c2-b115-a09eb478f076", "value": "3072:4U1eLwDEgPVolVANyXtQ15lnJhP7Rt9rW+RVWS6L8RKVS/PwfUL6L5RR26l11UqO:649o7tQflLP7RtJWkVWS6sdPzj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679954543, "uuid": "28c22a7f-56b5-4df8-a884-3698d1d135d1", "value": 302344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679954543, "uuid": "1565df06-865c-473f-8c31-5504cc715a49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954543, "uuid": "c12a44cd-b55f-4a61-84ae-c8dea37f5b11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b58436c-ccb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679931883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931883, "uuid": "18f83e77-7545-4216-882e-f472c3edb258", "comment": "Malware payload (RedLineStealer)", "value": "32249c38e8eaa4157ceecddc64e6378f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931883, "uuid": "62e6158f-f980-4385-80ed-ae45e293b9b4", "comment": "Malware payload (RedLineStealer)", "value": "54ee8f707bb6d8a12d33a1652d96d089b54b032329364f22faa6436066dcebb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931883, "uuid": "55f311d6-0253-420a-b607-0b530d1455db", "comment": "Malware payload (RedLineStealer)", "value": "2b408451d3e31d4d5f1381bf414ee0b6edde59ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931883, "uuid": "53e17424-c8ac-4da3-87ee-6b0ef7bf4d3d", "comment": "Malware payload (RedLineStealer)", "value": "5e4ab59d79cf963c844ae2897451d293cc6630b6b9b6fbc6eaf9db11de5fb9f3d93198601f60e208e755c2bd0c8dd46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931883, "uuid": "5cd1793e-08a7-4231-a337-921100a39790", "value": "T182352700F5D38C71DFA5153F3EE48A678966AD3C062FC7EBA3644E2A5B342CC852E525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931883, "uuid": "e6f9be8a-5cce-4e88-83f2-19ee6a3a8ee5", "value": "0687d0d0d948483526792bab9d2b83f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931883, "uuid": "9bd6ae0d-d870-492c-9fef-e58ed334a97a", "value": "6144:U+/ljQhToWxUIvq7w1MLBkZEAO3jLTeGdyHhVhx/pIW4:Uij0ToWx/vREZLTBCIW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679931883, "uuid": "2646df78-88ba-4fe0-b597-691ddc948a47", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679931883, "uuid": "a31cce71-8029-403a-9329-de00145c82e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931883, "uuid": "f3f03f47-f1f5-409b-aa38-13b1403fe836", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3cb304-cca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679922919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922919, "uuid": "9a3d473a-0d5a-492b-8e09-3fc4d13633a2", "comment": "Malware payload (RedLineStealer)", "value": "6e1c8047cd8888ad27dd34d430cf1485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922919, "uuid": "ea836c0d-3fe2-466a-8ddb-e13178e00370", "comment": "Malware payload (RedLineStealer)", "value": "56d8611936d8264b3fab9451f57ed8ef5bfcab43a2a1d14c6faf5556bedbccf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922919, "uuid": "49c1e271-8afa-43b8-9d7c-5d8d3d40027c", "comment": "Malware payload (RedLineStealer)", "value": "8d56c99a6ca73e88e6e68e90ba9435a622451726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922919, "uuid": "3b7adcad-26a4-4582-b1dc-a9bed14775b8", "comment": "Malware payload (RedLineStealer)", "value": "4b7f0d38a4899d0b59a8878f518b88ba47cb9f1f46008a3382a4e5e494051e4434e4e770429e62d70310e8897a0aee03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922919, "uuid": "299dcc97-53c3-4731-935b-88e78b48bb04", "value": "T13584B6F0D3879F66F83F8CB9DD0B28EA03386DD58C690D8699769D6C528048D7067C6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922919, "uuid": "a7eab939-a894-410e-a6e5-e130b203dc95", "value": "647411109b04481ccb858ac68f47ecf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922919, "uuid": "568ce7f8-0058-4b00-a696-d07c0b4411bb", "value": "3072:J/YVvMvV9YX80mAOMQLFyXQPkuOev5fjCYNDHUk0MSCM2qGW4W3Itqggax:J/i0NslOWevxjBD0o/bqhkqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679922919, "uuid": "b0b793f9-e00b-44f8-b00a-573dbcf8b5c9", "value": 381040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679922919, "uuid": "eab8f6b3-517a-4a49-a9d3-fd4a47e06ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922919, "uuid": "2aaa41a5-194b-4c1c-ba5f-734047da9822", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886f82c8-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904928, "uuid": "6851abcf-a779-428e-a4a9-e6dc6e7bdf92", "comment": "Malware payload", "value": "c3018e75cdd601dfb8c3bfdf91d6b9ee", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904928, "uuid": "f01bd3df-cd40-44a8-bc58-4089e1053bd9", "comment": "Malware payload", "value": "586de38b32eb50859c7aeb84b26fac5cb77a7dfabf1237613ca4cfb1354c9dbc", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904928, "uuid": "5c2f36a6-6820-4474-aa29-b355958a888a", "comment": "Malware payload", "value": "5b9f4db834a3aaef946da59c063f1a8ebb8706ae", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904928, "uuid": "44500d54-03ff-40f9-bb78-0b221ce58564", "comment": "Malware payload", "value": "9de4cde1a18976130e03575b1ccdc163521f6c945ebf83eb21c831bd4001d48bdb7ed55d43d7138d6a55eccb2aff1a93", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904928, "uuid": "35fda602-8ef3-4924-b012-7f001e07d5eb", "value": "T14311AB97780322094E524D6023A6B3509E000DC4672FB5A8E1DCA8E82C6CDDFAA033B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904928, "uuid": "21f13b21-ca7c-460c-a847-72fd9e4c8ddc", "value": "12:kxVk6QclfXaOsifiQsAqVYVtZ4tY6BF7kCGW1I8c73feF0J1r/3bg11Ov7a:kHksBxaQHZGYq7kC11IN7hUOvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904928, "uuid": "fbdf3cf8-51cc-49b4-9896-489d47958093", "value": 1029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904928, "uuid": "1c8a072e-4e34-4709-8b20-f3b55913a2d2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904928, "uuid": "788460f5-5c0b-4243-8322-a7daf5060bf0", "value": "doc(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a84cb1-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894905, "uuid": "3c2a9a6c-a9db-4ffe-b7f0-9181f4b641ef", "comment": "Malware payload (AgentTesla)", "value": "2884714cff1a0216c5f4f77ee71395d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894905, "uuid": "9f304118-8ae8-43ca-80f4-3636166c4050", "comment": "Malware payload (AgentTesla)", "value": "58a85cfe922eb0bb8e061c88c2a8ff1572aff1aab8950a575435fc1c3a4d5dde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894905, "uuid": "7a8e59af-222f-4278-b050-2b9af7aa2d1a", "comment": "Malware payload (AgentTesla)", "value": "f658c442ba9b94cca2f9062b72c10b1b02e3b925", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894905, "uuid": "949ee944-5e91-4e4c-b6a1-ca4ad4e58f5e", "comment": "Malware payload (AgentTesla)", "value": "b30307d0316bf5626434adee710b0be59d8a52fb5803e83fc3915595e66c1eda7d6e0920b24f3c811634bef62e682387", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894905, "uuid": "3e96daef-96be-4256-a56e-f7ab42eaaaea", "value": "T14524BF9A755674DFCC17C936C9C95C24A7A0E3A3A317D207B00B2399890E7ABCF490E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894905, "uuid": "4ae84e36-7d3a-4e0e-864f-088fd9f8968c", "value": "6144:8wA4sC8czQU8UQONgHd5YV4QjTELGY82vn4:8r4sCjzQU8UQONgd5YV4QvqN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894905, "uuid": "9598686a-a73f-4992-aebc-3d97b6091f95", "value": 217672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894905, "uuid": "90396a66-7acb-4eec-a089-521be8f9282d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894905, "uuid": "4db90e13-98e7-4586-87a6-fd6f188cff7e", "value": "e-Dekont22-03-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a62705c-ccae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679928473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928473, "uuid": "5d1575ec-948a-411f-b925-e2063cf82277", "comment": "Malware payload (Smoke Loader)", "value": "28676ee6929ed8b6d7082851f6933bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928473, "uuid": "6d42c7a4-99a9-474f-97c0-a74b3fdc9f2b", "comment": "Malware payload (Smoke Loader)", "value": "58cc5482d7de511b7adc6819c858b1c6de067fec262813396e0f580ada1e1ecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928473, "uuid": "cd621328-dc94-47ff-a6d4-56f4a1c0b2df", "comment": "Malware payload (Smoke Loader)", "value": "f391a10869df832a3942b6f3dec017819c5d2e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928473, "uuid": "ed06fdd5-faaa-4813-9db9-aef2759354a0", "comment": "Malware payload (Smoke Loader)", "value": "3375ed0efe547a94585aaa69f1fdcf3bfe3c9436a1b5f95a788ceb762d0ba125959fdeb3066ab6f0e04cedf5c8e381da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928473, "uuid": "b376765e-6df9-4727-8759-7ea5a1ceb1f4", "value": "T15B44CF227691C873E8A745354822C7B86A3BBC709B5585CB378C563E4E307D29F3A74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928473, "uuid": "431ddde8-299e-4c74-969b-1ba8c59c159d", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928473, "uuid": "bf2eff6e-6df1-43f9-bf0b-9d0972949e0d", "value": "3072:01XwHn5/TE2zdkzLuw/y0/IUIOIMzZ/4+DeuYOXSGEreU23ReOAj5qdqDb:cAHC2RkzLj/d/IKLxAreU23Ms4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928473, "uuid": "5dab9e9f-fea9-4994-9943-908622316f39", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928473, "uuid": "c148b8c0-ec46-4c4a-8350-7dfc9f815c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928473, "uuid": "3a72cf75-355b-440b-b8d5-e8115ccae20e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60142bb-cc3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679878778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878778, "uuid": "d4eb597d-11b0-4452-87a3-7ec6d9392cb2", "comment": "Malware payload (Amadey)", "value": "8766c5f2748e04e7edb4ad8a8eca5efa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878778, "uuid": "e19c7647-c781-491a-acd6-826b329f8d3a", "comment": "Malware payload (Amadey)", "value": "58db89cb50b7dd18e00aae6b126e09bcc718f5dba3c06d27420c8528ab05f52e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878778, "uuid": "44588ec3-f751-41ec-8990-d5aaf52b6c1e", "comment": "Malware payload (Amadey)", "value": "b2198c1281f1f8105aa2b866864ec59fdf37470f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878778, "uuid": "36affcf1-f97b-4983-b518-0cf3d1454339", "comment": "Malware payload (Amadey)", "value": "a6617e6352f565d2aae32ac018c7975d5ce1c40ebd88804edda5f9db13a8f9e089495b0e6e89859f507cbc69d61bddcd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878778, "uuid": "aa59699a-6449-47a0-a2f7-2ea2f275da50", "value": "T1AE547D2EA3F47820E5334732BE2EC7F42A1FB8605D177B5E2649AA3F0970661DD62705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878778, "uuid": "4e72d59e-29d1-45da-b72b-90f5be97798d", "value": "87d886eda68b09da2d904f9205843127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878778, "uuid": "b134762e-5d26-4db8-b3fc-1bd94a303434", "value": "3072:BKoJzMMG/AAyO4wFz1GYQDdlcwdmftb9dCfsuP1QWlK8KTNTn78Ug:tf1cnFzy+bifHP12p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878778, "uuid": "1bc8fb39-c359-41dd-8181-f55dabf5a3ed", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878778, "uuid": "d879cd3b-265a-486d-88f5-d14cdcf815c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878778, "uuid": "85711a0b-dd81-4ffe-bf06-12094cf0881c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7ad495-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679894923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894923, "uuid": "7af6e07f-29eb-4315-93b3-b637e6fd9c8d", "comment": "Malware payload (SnakeKeylogger)", "value": "5b5aed75a685cb2471094633e6814bcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894923, "uuid": "dc2a5ee4-8b8c-4055-b939-f65ad015e927", "comment": "Malware payload (SnakeKeylogger)", "value": "5950b1a61395119d915e3f08dc3bd0ea19b7aa186b13523351e73579e44c9d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894923, "uuid": "e9596919-925b-4810-b426-bb8a0dd08d45", "comment": "Malware payload (SnakeKeylogger)", "value": "ef8199e6f16bafc81fd17450d701adc25dde218e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894923, "uuid": "e16c0836-74ef-4691-9e21-cd148968d6fd", "comment": "Malware payload (SnakeKeylogger)", "value": "e21b66bde402e8522f591589431e9061e6b37140a50584a5dc23787a11023a9aa5e10d18d8d39d84d35cdc865c7e80a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894923, "uuid": "91017cfd-528e-4b7d-bda8-105462e63965", "value": "T1404512256BEB0739F93A57BD90A432825BBF77637B03C65948F612CA4633F014A90637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894923, "uuid": "d7a4fa55-7f76-448e-ba7d-2b6e47280335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894923, "uuid": "74ea28c1-652a-4043-96b1-068cdf4d8b1e", "value": "24576:Mv4Vz1U06mrVcXsKQ7IbfPO/eNbtczPPvnKTR+jXVEG25:zx1U06mriXjQ0bfWmNbtYv4+jXL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894923, "uuid": "cb99db68-2257-4994-8dba-a47834a09659", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894923, "uuid": "9cb12d0b-be46-469a-92b3-6c68798a0aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894923, "uuid": "444da857-3870-498e-ae1a-ba32ac343a24", "value": "PO 2300030351362.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee07075a-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679920560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "b3978cef-77af-42ec-9618-ee8013cea862", "comment": "Malware payload (AveMariaRAT)", "value": "9759cda218b7cb9fa1a7df976d721027", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "cc3cf73c-e3f6-480e-bbd3-30ad53020187", "comment": "Malware payload (AveMariaRAT)", "value": "5b69da44236696fcd58a56ae7085b1f357ba9c763e6c0181a175db0411ce7e29", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "80df2731-a3e8-420f-b189-01ba97438792", "comment": "Malware payload (AveMariaRAT)", "value": "85b3bb7cb020afc5c264fb8fcabca4d7a355ee99", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "1600896e-87be-437e-a5ba-6a3a2e55c6d1", "comment": "Malware payload (AveMariaRAT)", "value": "f2bda2d98311dfbb7e38d72895f47bb910b05c8e849c4d1b03d37d8bc95b8b76edabf51ebb0038054de4a00ba0417aec", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920560, "uuid": "7a52382c-beac-4906-a09b-1c82a8e006b4", "value": "T1B634232033C0E3594F7AB8528E855B5D8E6677B3C5A72022EF42170B1716AF7C85AEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920560, "uuid": "53f10b1f-abd8-4d7c-85ba-c6ba8fde6b4f", "value": "6144:LGXQitcpgp3d6ZRBMyNHmUBp9Hh3biqkvdR:LGJ6mp3d2rBXheq4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920560, "uuid": "04cbb33f-c007-48c0-b228-beaa4a096eff", "value": 238005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920560, "uuid": "86f8f447-3627-4466-9f4d-126319036403", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920560, "uuid": "71ab62b4-911e-4fb6-8ec4-08ee59f10109", "value": "Purchase Order list 58732.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e94c98-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912708, "uuid": "3e0e8813-b3ca-4f45-8e42-070c598c661a", "comment": "Malware payload (SnakeKeylogger)", "value": "467af03029c4d46d5133a22e340f0b32", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912708, "uuid": "a3e54926-4082-47f8-b168-0d9682afa660", "comment": "Malware payload (SnakeKeylogger)", "value": "5b7ee6d3514abf3f5555f3cbdaf931b47ba11f1c8c9961dc21c1ef77ed0a226d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912708, "uuid": "b833bdf2-33c5-4566-8122-42c787044f8c", "comment": "Malware payload (SnakeKeylogger)", "value": "0fc58dc23fc550ee2781621bd00c08bff48a97a8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912708, "uuid": "d559cb5e-3afc-4ecc-b135-0502727eba2d", "comment": "Malware payload (SnakeKeylogger)", "value": "b4abc423f7e0eadb0534b97dcdbfd0054a0242778810670765077ba0a409bf3e5e5e54634ff5bc523612e4aa019a3ed5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912708, "uuid": "46ac0293-b10e-49ed-8762-6691287bd1e9", "value": "T196F2815AE79E0279CB411273231E0A88A6BDB23E735055B1386C837433EDC6E46766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912708, "uuid": "9cc40aca-96e3-49b5-899c-d1681a143b11", "value": "768:gFx0XaIsnPRIa4fwJMVhVzpHt4tXzbGvYqVTeoLsn+dEw:gf0Xvx3EMVh14NOYqZ8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912708, "uuid": "6746f644-d379-460e-8449-96876e79d288", "value": 35604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912708, "uuid": "912b24b1-8239-4ad6-b461-8f4fd5efeb03", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912708, "uuid": "17302825-dca3-4b31-9326-c80dc9be75b6", "value": "Qutation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3b09f7-ccb3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679930546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930546, "uuid": "9e4fd1e5-56c0-4315-8cff-a10f7073d944", "comment": "Malware payload", "value": "ec7c37ae9c0377f3240a274290c9c214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930546, "uuid": "00767a9c-dd2d-4e06-bcf2-3eaf0fefc1e5", "comment": "Malware payload", "value": "5c11c170ecb5809594f68e860f910f6d004e356d067be232c3c856c9ed78459f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930546, "uuid": "8fdbb276-f1f5-4c41-94f6-3e4857274ac3", "comment": "Malware payload", "value": "432915cb9e9e860a84e142719bf0e82392c69a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930546, "uuid": "2f240747-9519-41f9-aeb2-98b202e10b57", "comment": "Malware payload", "value": "ac18dbc5238e1b2af4ea7155df5b02aba3e1d6678b843f866efa393c154f8607c52623d899512a9fc5f33973c786b15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930546, "uuid": "1ad70941-fcd5-4e48-b4ca-f0f6ca9cc8bd", "value": "T1C835222BF604F527C36581F805C28D88E2FE69E95751EE888D8D319391FBBA0D983747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930546, "uuid": "4fe0bbf6-d847-478b-95cf-ca96324003ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930546, "uuid": "f588f349-20c6-4d22-a86c-0dfe93dd25c0", "value": "24576:KZUu39V1vMSb4gz1o5Ti81zSdyrjLDjFPR6KrXmTDa:yltsSkW1o5Tiouy/z6KrXmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679930546, "uuid": "ca86a21f-7fdd-423b-919e-533b722c6593", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679930546, "uuid": "bcfe8749-3293-4483-8146-1da05d367b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930546, "uuid": "b369dc8c-fc9f-4093-9c81-c6305d7e1bce", "value": "PAYMENT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e8ba5a-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679913033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913033, "uuid": "c0bf7a0e-1921-4583-bf3b-f5d49d15b603", "comment": "Malware payload (RedLineStealer)", "value": "143f83400bbdb8dcec65ee44ba40004d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913033, "uuid": "dc38ae36-efd3-4af0-8b4c-b6e09ec48003", "comment": "Malware payload (RedLineStealer)", "value": "5d0c2c3b7c8aab7ad532b6c0b5ecd7b88f33106125d0fe5b5e4ea7136520e8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913033, "uuid": "1fa67cb8-a29d-4fe7-b51b-ec1b58a523e7", "comment": "Malware payload (RedLineStealer)", "value": "3df1c0ff151a4052f4e1592e83a7763e175576a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913033, "uuid": "8dd5aa9e-bb2e-4245-9553-1a9bc21cf195", "comment": "Malware payload (RedLineStealer)", "value": "39a6002e4d47c9a818d22af11599058f59b79599cb86c0cbf95d1c3446df9d6dd6e419bf2ac5ca14c2b8500db2eff376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913033, "uuid": "c8ef375b-a54d-4a9c-937c-68e76cfdae29", "value": "T150E412617A90C571D89B01318866D2B9BF3EFC35D711898BB3681B6F1E303A16B6E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913033, "uuid": "4d5b76de-7c67-4eb0-af06-57409f85af3d", "value": "70b9c76aa3fa9a17cebfd084a934f864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913033, "uuid": "beaca725-d0c8-4ef3-be61-ff9b5916f22c", "value": "12288:FGNYtummB4EOqbovM72A8pog+cf6zfRIpLUewq7Y4bQUefBWe9a8zyuOu:mQm6ExbovWUpJ+cf6zapLkq7dU5Znw8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913033, "uuid": "a02f1a74-7592-4a71-b3f9-da97129e8b0a", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913033, "uuid": "b736d2e3-f8b9-44f8-b6e9-311cbe9d87b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913033, "uuid": "6410b4c7-ec14-4276-a185-ffd10c9e7375", "value": "143f83400bbdb8dcec65ee44ba40004d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd8ff79-cc9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679920048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920048, "uuid": "b84b9e7e-b5eb-4ec8-8ecf-d9bab511eda1", "comment": "Malware payload (Formbook)", "value": "49940e3497ab4e1bdaf5fd2e1a061042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920048, "uuid": "908f2a45-ad48-42ce-98c5-bc64078c9a79", "comment": "Malware payload (Formbook)", "value": "5d163e55bd7c46b256aa7c5e93496781c83622bfd5deb0ccafb18c0f88d7e748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920048, "uuid": "5093ff33-d63e-4116-a2eb-59315189cc39", "comment": "Malware payload (Formbook)", "value": "8af158ec3ea85b78285e163b9d0e51b45087d44b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920048, "uuid": "28ed6dbb-629f-4853-a580-ac6e45c0ee2f", "comment": "Malware payload (Formbook)", "value": "bb5b38150a9315ffeb5f23cb5b509d331c763be59af33d538adb42abee9a7ea292de95be1c0e03f528118f1a7af78ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920048, "uuid": "66e2243c-a95f-4a22-bfaf-a1f0dd05c626", "value": "T1722402E62AC0E157EDB3833021B55DAAA7F3AF1B14A51B8B73415D62B8733814727283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920048, "uuid": "8951bf1c-e5f0-4e3f-b5b4-2b11e6f6f647", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920048, "uuid": "d0d04d0e-17fb-4a15-afca-4cebc3fc6795", "value": "6144:wPX7iN1Ocsd3bNJpo+xNvqGNudPWVMhB97Bw5QMERYRq:D1OcsdrNJCunNu9jBpeiMxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920048, "uuid": "ff8480b1-eb30-4642-ab08-e498380d1a78", "value": 220656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920048, "uuid": "8c5db088-07a9-499e-b57b-e448bd765a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920048, "uuid": "cbc9bdf2-f4f6-45ba-a1b6-581c79f0a4c8", "value": "Designernes (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b91105-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679912894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912894, "uuid": "4f6a24f1-b032-4daa-8e3b-503451a1259c", "comment": "Malware payload (AgentTesla)", "value": "453c7e522d7cc7b41ac7f221df374df0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912894, "uuid": "da9f97f8-d94c-448b-ace0-8c6e592b2e72", "comment": "Malware payload (AgentTesla)", "value": "5d6b5d750a9deb1407a0d3953dfbee824ed6544255a78ff027627feb1d589744", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912894, "uuid": "ed264b64-67e6-40c9-aab4-9129b4b05980", "comment": "Malware payload (AgentTesla)", "value": "24849b738ca0db0ba78c7a47f7d53a67c1deab24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912894, "uuid": "6be40dd8-cbe9-4622-89e9-6d2d020634e2", "comment": "Malware payload (AgentTesla)", "value": "859dee000a1773add3693ea446a4f21e48ba58e0ce3a64646a2cb8bfd05e98e245ad6835a4bb3bcefd88883a3fa2c1a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912894, "uuid": "bf1b416a-cb36-4eb0-92de-180c3ab6c159", "value": "T1DB258B47B38452D2FE669FF0C8A146FAB2EBBCD66A61C94C0D45F0F243B127E4902D56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912894, "uuid": "cb1643a8-714e-4b6b-8cda-6377842489af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912894, "uuid": "9031b5ff-43f7-4fa6-a908-ce9a9926028f", "value": "12288:3A5wB0O9JhZNTPjtNTQkRzh3xciA/HfzuC8n8pzqfbBj21Ah+OBgS5lc57:3A5I9DNPtX5pxg70fbBjBhfBg8l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912894, "uuid": "c188ecac-e46a-48d4-8946-811a495d2f8f", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912894, "uuid": "4f96340d-136e-4e2d-b82d-c80a769b6b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912894, "uuid": "a5cb54ed-c0b2-4b8d-9fda-bfee71e64554", "value": "Halkbank_Ekstre_20230327_075616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a21f5f-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679901801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901801, "uuid": "e4344818-cd79-4f50-a324-5e6dc6481ab0", "comment": "Malware payload (Stealc)", "value": "2c1e328b464224e1a573d18a7028b846", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901801, "uuid": "dd9c1d85-b145-413d-80c6-b9f217cd59c3", "comment": "Malware payload (Stealc)", "value": "5dfb1e4c32c994d72e8a7553a3bde80ba2e35e5dc4c38553effa8331849297a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901801, "uuid": "a7e4afd9-09be-45a7-a2b1-b9031012a2b7", "comment": "Malware payload (Stealc)", "value": "1fb43ef73e258175fd0322d3e0b3f25631238464", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901801, "uuid": "80c9d753-ef03-4e3e-ae52-e55f06fede14", "comment": "Malware payload (Stealc)", "value": "8cfb38b10a13f6d3f299d1ba8b3f7ea664e31d81b855dba4b3410be5916207207d5a47858211f2bd26027962127100ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901801, "uuid": "4fbb3dec-a7db-4851-a316-464c63a416e4", "value": "T1FE44CF2276D1C872E95B06754821C7F56A3ABC704F4582DB77842B3F2E317E2AA3D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901801, "uuid": "9005bf6d-2758-4eac-97a2-bce9e4d2f776", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901801, "uuid": "d570d818-09b1-4092-b946-7471d0152bbd", "value": "3072:RO/cw5LJQDXLjV62Fe5k5B9wGISpzay01/z8QcSv4Fs5xbzQ4K:OADXLI2SMeKp+dh2SNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901801, "uuid": "92514b10-0ed2-4c0b-b8bd-387466823047", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901801, "uuid": "7b3d1d5e-1220-4707-a5e1-2a075308a377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901801, "uuid": "2af144ee-9958-492b-bae2-967a1daaced6", "value": "2c1e328b464224e1a573d18a7028b846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a486b7-cc3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679879747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879747, "uuid": "afe5ecf3-1a8e-41a3-ac04-fdad5fb140fc", "comment": "Malware payload (Amadey)", "value": "cb1634c185646114dba3a4ba9681138b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879747, "uuid": "419c7767-a794-43b1-861a-e192a719ae03", "comment": "Malware payload (Amadey)", "value": "5e683773368044e569422c9afff74812780bf7f3f2a6fe2cb29961931ac46bea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879747, "uuid": "84180c7e-453e-4a36-99b8-8f64b033a25e", "comment": "Malware payload (Amadey)", "value": "c0dead7c947382982a27d301b0bb4170f79761f3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879747, "uuid": "42ecafcc-b532-40de-aa67-106fbc54da30", "comment": "Malware payload (Amadey)", "value": "e6b1b54134e7fffc981e2f9e7414ae4866b4765b69946fdb34021a5af3f64a4219be08e819bbb284706c6a623b4417ad", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879747, "uuid": "0dd732e4-c961-4ff3-8c5f-e2016632a630", "value": "T1A8546C3262F07870E553D7328E2BC6FC2A6FB9619E166B7E13495A7F09702A1D172334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879747, "uuid": "54c40553-6d73-47ce-b918-834bfa90bdfa", "value": "59edcf4038e73a659a2ff6e04ad467ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879747, "uuid": "23c66f51-0210-43ac-a4a6-35b626e8d7df", "value": "3072:fF4dSHrn2ZBFR6i20MR8sS1Lyhgw0vUSRDm4UOhNG8+kiFZU/enj/3+WepNN4TJY:br2/7a0MBtL0sMmqa8SZWWj/rUNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879747, "uuid": "78595fa4-e0ce-4f19-9b20-93097c09eeb5", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879747, "uuid": "093b5c29-0a5e-4b39-86bf-b9b84b2e6b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879747, "uuid": "c51f27fa-df6e-420d-b529-7c4a787351a1", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd621dd9-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679928209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928209, "uuid": "8d344403-3d3b-4690-8d45-964e11913fbc", "comment": "Malware payload (Fabookie)", "value": "fe2bdf1fc5bef5478a85d3905cb9842d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928209, "uuid": "27ae28e4-0b20-42d0-86d1-006f99beca4d", "comment": "Malware payload (Fabookie)", "value": "5ec0525cc78813343d141e78ddd54e506e34df03399c95aff9fc308531c74dc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928209, "uuid": "de755e86-1940-4d9d-aaf8-b72c186af6d9", "comment": "Malware payload (Fabookie)", "value": "d39853196dd7f2c06c52718b417178b75a6767f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928209, "uuid": "dd109076-6944-41a4-a406-fc5b23d45fec", "comment": "Malware payload (Fabookie)", "value": "550f59fd0acea3c04c8c074febc5ca28b255f1e1f485e82355b967383bdf51a53238c2cebd9e8909e95d68b031af0005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928209, "uuid": "88af9195-dcad-4334-b9f6-906f9257028a", "value": "T1D7643B156FB91DB6C016B43F0C6E84524B337827162783F7E496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928209, "uuid": "1bd93f3e-246c-4c87-9b6a-6e5596c86f15", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928209, "uuid": "6678c3e3-42a8-41d8-8b92-adae9d0a2f50", "value": "3072:P8k/TMYQ0qIN6NtVcOXEK5ULtGyUPj09vJqxEm4x1ESuQG+3SeyRS6CSfKVu1xgP:5Mnt3EPRAPj2voxEvTEPp/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928209, "uuid": "94ce0ef1-d55f-4ee9-b0b9-f27cf73a4efa", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928209, "uuid": "090a2285-86df-414e-8ef8-2b1cc7e52adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928209, "uuid": "36c3e780-61aa-4643-b4d9-25a0b31df31f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64252978-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679912598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912598, "uuid": "2c8d530d-45eb-4b34-8aa9-3ec6085a2c0d", "comment": "Malware payload (Smoke Loader)", "value": "cb1e287cf9c2ffc7eb312be208333a28", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912598, "uuid": "41eaaff5-3f14-466a-8810-d4e5e33a8fa3", "comment": "Malware payload (Smoke Loader)", "value": "5ee793cd180c512f57d8f29b75c2782a8441e69a4c94ca6c9e1f846c7a09b189", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912598, "uuid": "2f1e0c67-7eed-4dc8-883d-cb775f603bed", "comment": "Malware payload (Smoke Loader)", "value": "7bb0cea3833596cf48e01ee6cfe6c435ee8ff5d8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912598, "uuid": "1dd01ab4-cd5e-4b8e-9d89-76188fbdd9c5", "comment": "Malware payload (Smoke Loader)", "value": "4166cd781b955f05f8feda240306409aefbf992f0590867477117d60f3e8eec59c8881713debd3d81c5e0177cb18bef0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912598, "uuid": "18f0b9c1-6f15-4cfe-8897-d0206695ae58", "value": "T1EB447E1EA3F46870E1374732BE1EC7F82A1FB8215E577B5E2699AA3F0930661DD61304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912598, "uuid": "960de846-2e5d-4408-a577-dc643bfc82e5", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912598, "uuid": "95ad457c-9b0f-4d9a-af6e-2d855388db9d", "value": "3072:i3BLbpwA+dFGTOxXqS+jK+N1QfBa30ArX4EFcx3fGiFjNwvFRn78F:EwnYTOxXV+j20E8X4ECxPFFjgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912598, "uuid": "827ed4ae-7bf6-49b1-b148-95ed729db383", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912598, "uuid": "4893ec30-6492-4ad6-894a-acfd86e554dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912598, "uuid": "4f37c73f-80d5-42cb-ab16-1419b156b1f2", "value": "cb1e287cf9c2ffc7eb312be208333a28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae061b7-cca1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679923132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923132, "uuid": "9768fc36-3f86-4c39-be19-1923eed14e25", "comment": "Malware payload", "value": "a0427b3112d000bd3d8320790e8d845e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923132, "uuid": "f334b5c0-152f-448b-85d5-2455870e9eea", "comment": "Malware payload", "value": "5fc17acd6b01ed2759cd95be8716c0031bd6c7aa7ce18dcc8ede379f369568b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923132, "uuid": "635a7ad3-e5b6-493e-a416-bcc27e720f02", "comment": "Malware payload", "value": "15a9c91dc74afb8c7676499506f5110fdc0f632f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923132, "uuid": "a7c350e1-5ccf-4875-a950-6dab497bb536", "comment": "Malware payload", "value": "10b569e8377ecf23408bd9385c45959832a6f01bded9abdf323f107dc25d12d7c94dfd1531ece418a01ae17843d7d9d8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923132, "uuid": "9ccd2106-7fdb-4a6c-80a1-df4e0b0ec392", "value": "T117D44C775622F4374DBFB3BCE2D7417C06860847F883A9AE93C28C169E1AF51A2441DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923132, "uuid": "3e994a4e-17eb-4699-8f02-60ddb9631ce5", "value": "96:qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrfd+RL57mLqqqqqqqqqqqqqqqqqqqqqqqe:dd+RL5qcFXK0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923132, "uuid": "1101b8e2-b8df-4c1d-a079-c93992762250", "value": 636498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923132, "uuid": "df010f2f-b9d3-43fd-a256-f4cdb3b52e7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923132, "uuid": "fb1c71fa-7d95-4767-83df-4d96c0549055", "value": "invoice#91273.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5cd90b-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912507, "uuid": "a2bad7c8-22a6-4b42-9008-7571f2dd38b2", "comment": "Malware payload (SnakeKeylogger)", "value": "9d864ba0a340d0ddfd4f97a5dcb45ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912507, "uuid": "41ff73c7-72bd-4e8a-9ea6-3c76612c4818", "comment": "Malware payload (SnakeKeylogger)", "value": "6001d99cd11f8cf5e5421e6246b0e38a193059e32b76583fe4a66642b343af0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912507, "uuid": "b1c25515-13c2-4334-a4bc-9ca0d5cca0e7", "comment": "Malware payload (SnakeKeylogger)", "value": "af68e83b7b14839cebd22de1bef929158f375083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912507, "uuid": "85012043-bed5-4af9-8042-0e3193a54021", "comment": "Malware payload (SnakeKeylogger)", "value": "a2237cf492ca105460c6702b6818f62843d7df730d1c4ae6221a3b3cc5a953818432739c7df6c3ad5d8e837d4f32c405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912507, "uuid": "9f71416c-85ca-44b5-b8cb-75faac82ce27", "value": "T1D4753D21BDD7903AF1B3BE754BF97A96D56EFA322F0240C7109403964A226C1DEB127D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912507, "uuid": "32f9b854-c215-4601-8b34-3f6bdb4f6611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912507, "uuid": "44c4f76a-6933-441b-a14e-84c98e517670", "value": "24576:Su5LaupPh2kkkkK4kXkkkkkkkkhLX3a20R0v50+YNpsKv2EvZHp3oWR:rZbazR0vKLXZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912507, "uuid": "8d19938c-aea8-4a39-b829-f19280d81b91", "value": 1649428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912507, "uuid": "9f908589-9156-4e9b-b664-b3be1077055e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912507, "uuid": "23a656c8-95f0-4c9c-b494-3b614c9f22f2", "value": "9d864ba0a340d0ddfd4f97a5dcb45ea0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a80b92-cca7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679925638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925638, "uuid": "0f388e49-d393-4413-8086-33cd6c9790e7", "comment": "Malware payload (Amadey)", "value": "0161b44615068b3af2425cebd0d8e584", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925638, "uuid": "cb0f3455-661e-4172-987f-e6a12368fd43", "comment": "Malware payload (Amadey)", "value": "601207ff2909da97272ca4d22cd8ba62012fe4292e902df7b0c3af0b1940c46b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925638, "uuid": "0f4c4203-f356-472c-9584-373a4ed6513e", "comment": "Malware payload (Amadey)", "value": "f221f8a49194f63c75e168e39bfd95897825851a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679925638, "uuid": "c28b979d-54e6-4174-9c70-e3e4966f3fd9", "comment": "Malware payload (Amadey)", "value": "648779b9474718e04d243c0a70d616a023b36159504b50908ac1360d0ee79c88ef06b820a2c0c197d8e9e1d5a5ca07df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925638, "uuid": "92beb365-1ccf-4c0c-878b-2931bd8391ff", "value": "T19A25230797E88021D9A567B09DF207D31531BCF269708BDB379869DE0E32A9065327FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925638, "uuid": "95431203-bf9d-4a75-894d-08cc7894e397", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925638, "uuid": "32a061ab-189c-47b5-80ab-2698897b6cd2", "value": "24576:oyyT/1XYqWCKBjNfUS5idDS/m/+fEcQTa0SYtrzejaBF/:vWX5KBBfdi9mmXcIaXo3BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679925638, "uuid": "8b674b67-efc8-43c6-874f-2e37531d62b0", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679925638, "uuid": "68ccb808-62a7-41b9-9b18-faeadf44005e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679925638, "uuid": "ebfc42e4-530f-4a7d-822b-02611a3ea1de", "value": "0161b44615068b3af2425cebd0d8e584.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e832da8-cc80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679908830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679908830, "uuid": "2d1769dd-a8ef-4a96-ab81-aadf347fecbf", "comment": "Malware payload (RedLineStealer)", "value": "daf98bba382dc0d33a2c948cf6f5e367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679908830, "uuid": "5b179b09-3505-4faf-b80f-ca4ea0e72808", "comment": "Malware payload (RedLineStealer)", "value": "603a78148b4d2eb02e7667ad7c14f5c788f77792c7fefa4f2400d789785446c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679908830, "uuid": "9a9fd618-54d0-44d7-9ea8-83bd7cf7bac5", "comment": "Malware payload (RedLineStealer)", "value": "133474fe49894aa7f4ecedb5497dd1aa049876e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679908830, "uuid": "c9d9da4f-bb32-4fe9-ba45-ae5d7cd9fa51", "comment": "Malware payload (RedLineStealer)", "value": "39b0c0b80096f7cdb3f88eacff1dc474d861710057759d96eb3de0c76b0a7a8db37df073d80fd49267d7fbf972b3fb21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679908830, "uuid": "22755c0a-c50c-4e18-91a9-11bba93ec6fe", "value": "T1CDE42312FFD44431E8B52B746CF20BD31A367CE05978836B27CA999D0CB16D4A63276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679908830, "uuid": "b56c875f-c757-4a04-9bc3-ba03af6a3f95", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679908830, "uuid": "be98b916-bdf5-470b-885d-d48a360741fa", "value": "12288:uMr8y90VtHgb9dzKW8F/m9ypsv/mRHhE5433v6HH0hxbD8Oxs:my6tgb99KW8F+ySvO1C5kv+wxbDbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679908830, "uuid": "369a105c-303a-42bd-921c-651d927f1f1b", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679908830, "uuid": "095639d2-ddbd-4e53-b5c7-cbcb45a01491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679908830, "uuid": "d7a3fcd5-4393-49cb-bef1-cd1173de023c", "value": "daf98bba382dc0d33a2c948cf6f5e367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8eda8f-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912504, "uuid": "e0ee08e0-acb3-47e9-b472-f038f5528d50", "comment": "Malware payload (SnakeKeylogger)", "value": "eefe5fd283e75eceab969b0a401cf423", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912504, "uuid": "f1dba666-9beb-445d-9804-f59afa864492", "comment": "Malware payload (SnakeKeylogger)", "value": "60483940a75246c07988c5afb07b67643ece46456bdc37f6bf43d772760e7a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912504, "uuid": "7b698d38-e3f3-4645-bc9f-85f0a4176bbb", "comment": "Malware payload (SnakeKeylogger)", "value": "fd46470d87827b1a34bda7d778d5e62494dc5397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912504, "uuid": "f6fa1591-e27c-4372-a27c-827158a20f3e", "comment": "Malware payload (SnakeKeylogger)", "value": "c1640ce9e7eb5e8c35fbe892c4fcc48d1e14ecc0cf4ef9bfb775704d470d09d67ca10201664dbef842e9dfdcbf5fe8cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912504, "uuid": "161e30c0-1111-4539-8474-37d758c6993f", "value": "T1E35412483AF1C467E9F21F721D3A27167EA5B92A0D78834B23A09F4D7469383590F763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912504, "uuid": "bd6a9b10-c8fc-4594-8986-9adddb7989d3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912504, "uuid": "2c199dd5-81ad-48d2-ac88-b7f48e53056c", "value": "6144:/Ya6FYVnwifEsMdPzPaGFYhyPUU1w5EllXYPQ/73xF9PKezGiaF:/YPYeK/UPzP9wyPJsQj3TWiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912504, "uuid": "1b8baec1-3b59-47ff-abf8-5896e3ac03ac", "value": 293318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912504, "uuid": "ec2eea07-841d-4662-906b-c6aad2bef6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912504, "uuid": "612f29ed-8a88-4946-815e-8ce84efccad6", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9204fe6-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880931, "uuid": "9d08989a-efc0-4f3a-89c2-83d2db127e16", "comment": "Malware payload (Smoke Loader)", "value": "a45d645ce21a186c88833fe06b066176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880931, "uuid": "b0a0ab33-6d34-4649-add9-eea4f6901c91", "comment": "Malware payload (Smoke Loader)", "value": "607d8c9c1e25fccf42a4bb34e5528f03421875ac6311290e15199554a7f81e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880931, "uuid": "6b227e47-1f27-4830-952d-70dbf7a03335", "comment": "Malware payload (Smoke Loader)", "value": "d2421e926d50c06de37049a28931d3e067085d70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880931, "uuid": "233f65ec-dd26-4306-a499-3f74dedc1833", "comment": "Malware payload (Smoke Loader)", "value": "1d8595b3c480193b3bba684ad3a7ccbf6c2e8f121b805cd0b00a8e3dd9407b959ffcac7a7efd5910412598f98df0fb4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880931, "uuid": "2a3e4fb3-4cb0-4ac7-bda6-250b10a32681", "value": "T1AD547D0253E16860E72387328E2AC7F82E1EF8615E157BFE16599B3F1971FB2C162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880931, "uuid": "7cd20a2d-420b-4bea-869a-2798d49156d2", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880931, "uuid": "7fb4c594-b66a-4e47-8877-98f276939645", "value": "3072:tFfVzc5VWxk9wmu29OGx5dOyi9c7hqrY9lG99kpLZptSOyjJj6swaShx/w9gyCJT:lh+9Lx/OyiEG6laOyjkswaShXtTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880931, "uuid": "e3dfb909-a76b-4b03-9515-14d3f030a3e8", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880931, "uuid": "ed3d5db5-10e7-4cfd-b83d-99bc88ebb027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880931, "uuid": "ae2b9ea6-7490-494e-88a5-39459869e955", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e97df2-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894886, "uuid": "0b458bdf-9406-4540-abbe-63f641d5d66c", "comment": "Malware payload (Formbook)", "value": "804ed16d25be0e661279437f545148b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894886, "uuid": "1ec59d25-8520-4a9d-8753-958929187180", "comment": "Malware payload (Formbook)", "value": "6147af8263840617beb21652bb8db0fc7683a9e62a084254e548a884c8fa9a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894886, "uuid": "57e9ab9a-19ac-4e45-90ce-747e63f2efb4", "comment": "Malware payload (Formbook)", "value": "fad4bfd47598ee39c7b52045df76900d19428cd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894886, "uuid": "a5a4c8c5-ca16-41c5-964a-1f2e4b86c027", "comment": "Malware payload (Formbook)", "value": "a6cbd1d4be72282d9ffcbe076cb5e99028fb1797461f7a55808ce871d5615c47586c753fbe8f413c1876d0198e644a46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894886, "uuid": "991b26d3-aa4d-4e17-9edf-ed09c6197bb7", "value": "T14604AE32D602C035E2F201B4F6791B7B883E0E343294A4EAA3F225E16EA55D5F57931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894886, "uuid": "bbd6fdfe-ad3b-4cda-8b61-0e7619885fa9", "value": "3072:jkGpvkIuA/rLk3cxK12P4sav3lgRWLJiW8fWs01LhUyu1TkV6L3hB0:b9Kc412gsav3lgRkkq967NL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894886, "uuid": "515cdf9e-a83e-43ab-a091-a0bdb6c1595e", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894886, "uuid": "8c47b4aa-58d9-4c24-a6ed-c003a472dcd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894886, "uuid": "09b486e4-2bed-40fb-a3b3-6d9d923c20ed", "value": "6147af8263840617beb21652bb8db0fc7683a9e62a084254e548a884c8fa9a31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392c4c96-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920256, "uuid": "afecf5bc-fa82-4e27-88bc-a35875416727", "comment": "Malware payload", "value": "d8182895946298e77f8e0e9c9a201e5d", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920256, "uuid": "408718fe-686c-4e80-a5ca-4596b689c196", "comment": "Malware payload", "value": "61a6c148fb6f17686092a0cf52c62af97c798773accbc01d341ea84e44c9258d", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920256, "uuid": "59f2a617-d60f-4717-8b15-9072122a0a5a", "comment": "Malware payload", "value": "49f02de499dcbab435f43b88581373509d880321", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920256, "uuid": "75957f0e-a844-4b74-85a1-61dba2028768", "comment": "Malware payload", "value": "b902cb1cf44826f7e0215a78f7b4e292bca703f735105a2b574933ed67cf51ed1cf53bb06873ecc85f3fd1d57f5908cf", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920256, "uuid": "bbc01584-06fb-47d1-910c-a756d4f6138d", "value": "T1441370095D4A996B9573B37AEFA38448EF27122702665231FEDCF2041F7041896B1FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920256, "uuid": "1557d763-ebe4-42ae-9a83-adc1dd232b0c", "value": "384:WxKdZHW0MyTWTt+RIGOEc1sgjzQvcg84jw4uppBlthxVQ0PLFA/oJzkGrZ2Ltz3:ZrWLySTt9EQzQvUrDAg5kC4tz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920256, "uuid": "89e7d231-e943-4dac-8468-74120353b882", "value": 42482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920256, "uuid": "20b8f549-e334-4d5e-bce6-d2bb3db9213c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920256, "uuid": "06b8a232-91b0-44b3-91e8-f53371a65ee5", "value": "7gKS6818.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a868e2ba-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679901545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901545, "uuid": "a8ef7079-c668-43a3-b5ac-e9049043ecb4", "comment": "Malware payload (AgentTesla)", "value": "a52aeb48d6f0bbf0ff41432319662a34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901545, "uuid": "362ee156-34c3-4cd3-9b71-229f3a78bf12", "comment": "Malware payload (AgentTesla)", "value": "61b6cb24bbd6da618ab7edd013fb5c2228f98d30e0fff826d4ba420a65f26d9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901545, "uuid": "3ab8c4f9-1103-406a-83b1-0550e58c3197", "comment": "Malware payload (AgentTesla)", "value": "67bb4ba6768bc581b7795597202eff4386071fec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901545, "uuid": "42255349-1750-488d-bc73-f5a6f50091c5", "comment": "Malware payload (AgentTesla)", "value": "2c217c406d4d8f2654907205ee9615ed239ae59b19a47804171e72eb70660ee7a4b41aa8d837725e07ff4d259ea3cb8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901545, "uuid": "aa4dadcb-bd49-42ec-b7f0-e4fff05ecc30", "value": "T12905330DC2FF418468709CB00356BF89C4392D0AAE7BB532795169DD2153EA2BF93772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901545, "uuid": "040746f6-a685-4086-80ba-486e8f024db1", "value": "12288:GzLe8zof2wXbMyNFaOKPyzkPeqnZPgp7pL4Dgo1qMsnd4wg5WcVXuXTDmc1IZ:GzfC2wX9sOKSkrZYptL4D6d4H+XTSc1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901545, "uuid": "ed41b753-8430-496e-acc7-32f966230317", "value": 814621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901545, "uuid": "9aec91b5-26db-4586-9cb9-78f91451f28d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901545, "uuid": "acdd3304-9a56-42d1-95d4-a45577e40341", "value": "DHL Airwaybill & Shipping Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d944e7-ccc6-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679938845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938845, "uuid": "a92f250f-aa6d-4beb-948f-1f6837a51a04", "comment": "Malware payload (njrat)", "value": "b7dc88755d70e1ecae9672d6278a52bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938845, "uuid": "3a259e1c-dd40-4dbb-81ec-91e31a8fdd3a", "comment": "Malware payload (njrat)", "value": "61f3f6b2e8186bc072917f390fa663019bad82797749a3eff085eaef1aee75f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938845, "uuid": "89f511ae-c315-489d-bf26-928d3891e1e0", "comment": "Malware payload (njrat)", "value": "5817f32e876d0f70961246eb8564d00f99595354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679938845, "uuid": "8b4ac325-57d3-4239-96cf-399157cbc1e4", "comment": "Malware payload (njrat)", "value": "d99ec43594e5611953b18d245962759aaf79e71239c3c33702e5e7d3065a62de6dc451cb09ce0f9c70c5acb86b57548d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938845, "uuid": "a63ae79f-d409-4596-8329-3c5f56c99e67", "value": "T108544A262F9A8C4ACD5918791DE5E239527BEFC4D81F9E02CADD3C5BFD27EA62C40140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938845, "uuid": "5fa881ee-c569-472b-a697-570cadbb4a62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938845, "uuid": "a1090daa-baaf-4451-8cf6-3a5d60b84f3e", "value": "6144:8Yofp+2vNzef9qHdykAYlqG2l3Bm7G+9HRoIVC:foLQ/GmxYRRVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679938845, "uuid": "8ca2ad24-155f-474c-93f2-95daeea05f31", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679938845, "uuid": "893d84a3-0342-414a-94dc-1d27bd15596c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679938845, "uuid": "cd737f0c-3205-4f48-9fe9-4a4542c9ac2a", "value": "b7dc88755d70e1ecae9672d6278a52bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a80520-cc52-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679889052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889052, "uuid": "d30b8e3b-f29c-437c-8b44-af85fb50f926", "comment": "Malware payload (RedLineStealer)", "value": "af33bb7f698fa232013aaeadf847cc4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889052, "uuid": "ad0d2136-f12d-4941-bdb2-8fdc3f109d86", "comment": "Malware payload (RedLineStealer)", "value": "634915b5a110d6feba5ce01b0c7f0053d5bb86e1644ddeafbed09bcf00f26754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889052, "uuid": "f52b6714-1454-43d1-90be-c07a112a842e", "comment": "Malware payload (RedLineStealer)", "value": "da8f204b032c900b8e82228c5ae23b0b9778ba16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889052, "uuid": "bc9bb6c1-ed9d-4ecc-a678-b8026f0e54ee", "comment": "Malware payload (RedLineStealer)", "value": "74cda59859670235fb4868b1e0b5bf307edfbb37fd209c1d46e4207597e0e8d55c4ae743a67cc9fc1c6ad8016fd681e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889052, "uuid": "c0df76cb-2ada-4327-b37c-9e21be8c2c1b", "value": "T147F4F02A93F46420E5734632BE2EC6F43A2FF8914E2B7E5D36596A3F0974361CD22705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889052, "uuid": "31d8a9fb-a49f-47bd-a400-452ce1b03d9a", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889052, "uuid": "4b78644c-58c7-4e87-91e4-c578b06ccf24", "value": "12288:2igbj4bqd1iH1qtonjJYQ51VcCFglxNeZvadJZApInO:SEbqXpijJYQmCyxNeZS8KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679889052, "uuid": "a3fb100b-f725-4ba9-8a47-e778652eda92", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679889052, "uuid": "860a8de7-dc55-4b48-8d79-888130fe1b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889052, "uuid": "a7b0c3ba-929e-4229-a439-1075029dd269", "value": "af33bb7f698fa232013aaeadf847cc4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a11d4aa-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679949920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949920, "uuid": "871e9e7d-1db4-4546-85df-d364c6d4b477", "comment": "Malware payload (RedLineStealer)", "value": "b1b9edba3110d3f6e1d37249f7c69ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949920, "uuid": "d08bfb73-7225-4300-8608-b9f26c97433d", "comment": "Malware payload (RedLineStealer)", "value": "63b4f86f6e094ed68e2da3ecf003605e743105d3fab1f1992d3896bc9bf0c3eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949920, "uuid": "da3a04bb-7720-4c6e-bb90-560bf67cb455", "comment": "Malware payload (RedLineStealer)", "value": "805be968dd146cb68492d9a6759ba6551f555008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949920, "uuid": "c06e3c9d-6301-452c-b841-6e5f7d81e118", "comment": "Malware payload (RedLineStealer)", "value": "cfde6291d52730c1f95f9104a5528853912d73f96251b01e0ea6a255313ee9875b65a652b8d3d9e49646e746df6f32e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949920, "uuid": "47fb9897-2e90-424e-b48e-525923de6502", "value": "T138E41242EED88477EDB41BB018FA13830E317C918D7456673B985D4E0972AC5A13ABAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949920, "uuid": "d4a1a481-4154-4d92-8f3a-6b5fc1784411", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949920, "uuid": "a5d7b0b6-9617-491d-80c1-8b74544a7462", "value": "12288:uMrsy90rGERgVYhFUUuG38kMcXBkFzW3WzNVNbo8kYZ0rWwaEJU46/BP:GyuiuBPRMcWFzbzTpJkvrWnb/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679949920, "uuid": "85e5b6c5-8c3f-4410-a232-7679923538e6", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679949920, "uuid": "544d73df-1b59-44b2-8a76-85f67614acb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949920, "uuid": "445d2e60-f004-4367-b5f8-c76c0790a59f", "value": "b1b9edba3110d3f6e1d37249f7c69ea5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a581623c-cca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679923445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923445, "uuid": "dc3af7c1-0837-42a8-bfc9-076cb8504f41", "comment": "Malware payload (RedLineStealer)", "value": "0118d41e2d441f57ed8b2b54fc349592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923445, "uuid": "c2293bb1-4e19-43ab-ac10-79d6c01fc218", "comment": "Malware payload (RedLineStealer)", "value": "63b898d7aa9abb97f071c3af1a5109c613b404e394c07f85a73800a9d5920d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923445, "uuid": "0f3a818c-4fa1-4346-83ff-272a4d391e4f", "comment": "Malware payload (RedLineStealer)", "value": "7a11f93eb03aa673ed24af9882b272241b3db860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923445, "uuid": "807779c1-692c-4343-b352-e35f03903339", "comment": "Malware payload (RedLineStealer)", "value": "9e44e8a86b70b0e283ba6a49b1762a9b6bf772b5e18fb03bcecd5fc99f5341b1ab57afa3f5d32bfa26a6faa5ea5d2cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923445, "uuid": "9792b70c-f686-48ae-9eff-53516f9fa75b", "value": "T19C740B887670FD9EC867C83F8A581C24E6636466570BA203B05317AD993D79AFF170B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923445, "uuid": "79433125-814f-4d22-ba09-645e672c4504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923445, "uuid": "c52c5aaa-7d15-40e8-8841-e94526cc7a3e", "value": "6144:NxGmL4fTHydAcPL/2faQXyHEXvIxgJ0bT9AGWnTLIhGE:/bMfTLcNkXvIxgJ0bT9AGWnTLIhGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923445, "uuid": "94172022-c21c-4432-9d01-eea5610bbc09", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923445, "uuid": "e34a19e3-d9e2-4253-a811-d981fe3b2ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923445, "uuid": "04c32de5-6995-4837-97de-8532b2c32b91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617ca82e-cc4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679887253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887253, "uuid": "ff859478-b609-4221-be0e-fa08b5431bc8", "comment": "Malware payload (RedLineStealer)", "value": "3bccf152a1d5c62851aafe3036f158f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887253, "uuid": "0666e22f-5c91-4ecc-a5b2-65fc60bbf41f", "comment": "Malware payload (RedLineStealer)", "value": "6468b1cbd0c1de3f8dda0fdcca9c585ae8c33c6e60a1837e3435e7d364cf3708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887253, "uuid": "4e9b7273-3867-4933-8839-7e5c22b6273b", "comment": "Malware payload (RedLineStealer)", "value": "af7f703d4b5b2a9b1e99896696a019204dd48424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887253, "uuid": "d1a7b1ed-dddf-4efa-b840-38a8385edb07", "comment": "Malware payload (RedLineStealer)", "value": "9685ab815f2e98737a7009d4a34e06408cbc85275f9af995b31025dffa0fd67e2ac95328a9e57b0bc61be3c80fe3a135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887253, "uuid": "09373764-798e-475e-9b26-2a773e8e535f", "value": "T194F4F02A93F46420E5734632BE2EC6F43A2FF8914E2B7E5D36596A3F0974361CD22705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887253, "uuid": "9a1082ea-5701-4f47-ae77-2c945ce7d685", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887253, "uuid": "b24e8b31-4313-4ca0-a3f4-e88d1d22e294", "value": "12288:Oigbj4bqd1iH1qtonjJYQ51VcCFglxNeZvadJZApInO:aEbqXpijJYQmCyxNeZS8KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679887253, "uuid": "338f6cad-7ecd-4415-b20c-c69d05243d94", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679887253, "uuid": "328f26c7-e1cd-4c38-ac08-1bcbc0f05ce2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887253, "uuid": "d4c561cf-5f10-406e-8a19-ea6f47e69b4b", "value": "3bccf152a1d5c62851aafe3036f158f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7d410d-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878087, "uuid": "bab12a8f-b983-42d3-a8b6-bc077fe8af8b", "comment": "Malware payload (Smoke Loader)", "value": "09529691c435ed46a0422708924e0472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878087, "uuid": "7c56d64e-5435-4c2c-b300-e308858fa25d", "comment": "Malware payload (Smoke Loader)", "value": "64b2e7b56666743d248603e9c949e06576732047254ad4b886a9f85acb43d4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878087, "uuid": "58335cad-2027-4d97-9001-74bccc303d1d", "comment": "Malware payload (Smoke Loader)", "value": "ad73084360e5ffb5e9a9746657f54d3d82833c92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878087, "uuid": "8f44a6cc-42a2-4472-b45d-3c02f47027d2", "comment": "Malware payload (Smoke Loader)", "value": "1cd5bf466b1acb61142280c77443e0695484491ce778922b3c2b86cc2645e98f2ae9fb72bf8a6f0fa2a5fbe551c76150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878087, "uuid": "35679257-8317-48a4-b4fc-d261a916c7ca", "value": "T174447D2A93F56820E6734732BE1EC7F42A2FF8215D177B5F2649AA3F0970661DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878087, "uuid": "a2ea3d0b-e6fb-45e2-a6aa-69be250ef2b3", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878087, "uuid": "c459efbb-1572-4fad-897e-1a1faaf0d344", "value": "3072:qq+PI4A+RFAbbczH88n+vMhkBnNYKjLwWqFyW3XptpUn78F:x4LCbbc788hQpHcyW3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878087, "uuid": "c83a5d92-6ecd-4ea4-9321-d45c30a60817", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878087, "uuid": "49925fc3-a153-45bf-98a4-f57c67e81b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878087, "uuid": "489df78e-4e1e-496e-bd0a-c4198fefb8b3", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb653c1-cc86-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679911542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911542, "uuid": "db8fb0da-1df9-4262-95e9-51c15e0ddf55", "comment": "Malware payload (TeamBot)", "value": "765a6672caee39b596dc33685bd56f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911542, "uuid": "87b31b5d-ce77-4df6-a283-7409ecaf00e4", "comment": "Malware payload (TeamBot)", "value": "64ca65d71fa8db3699aab3a274c05c0308777f7d4edbe2a5f6286f81feb85e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911542, "uuid": "7052b4ae-a01a-4f28-9218-af5af371a0f4", "comment": "Malware payload (TeamBot)", "value": "6f244739ff9e10757632eb6c2ac13b3cfe2f3d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911542, "uuid": "55202ef7-451e-45c7-a830-63ee53c40175", "comment": "Malware payload (TeamBot)", "value": "e94544fdb96fda0085bf41ac733b0a52f31b7dd20e44357564025c03a1b46f91adba6aecaeb0cf8dd0f9cccd6e7f0c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911542, "uuid": "ab399da1-be28-4a15-9a74-8df357ccbef3", "value": "T18A44CF1236C2C832D5A600794823D6F4693FBC719F9486C777983B3E6E307D2AA36356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911542, "uuid": "304a9505-7401-4aea-b5ed-406355ebc74b", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911542, "uuid": "94fdd588-02ec-4869-966b-8ac8481af9b1", "value": "3072:xfDZspiH4TQzXLJixaF+xO8Ay7btd8eW0hvne7hUWWksHM6Mqs5xLzNNPnN:p+wzXLnqODyftd82hPWWkss93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679911542, "uuid": "f08cde05-10ab-4593-95d7-a2c049758414", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679911542, "uuid": "404206dd-ddcf-4794-a28d-ca6fc5ce6935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911542, "uuid": "86a169e3-f9f2-4ae7-a76f-9677fc74b813", "value": "765a6672caee39b596dc33685bd56f13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e64871-ccf2-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1679957730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957730, "uuid": "c3aa02d9-cb0d-429a-8f26-8d62858396bd", "comment": "Malware payload (NetSupport)", "value": "ae63b342d6211f00ff9e256b1e2339b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957730, "uuid": "b7496d68-95a6-45fd-91de-9e80355e7e97", "comment": "Malware payload (NetSupport)", "value": "64d3eef726267d18037a898e65f9a98aa609a37d6cda7762013f9362ef424dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957730, "uuid": "6dd9ccb8-71c5-41ad-89c8-4ebd7285cc48", "comment": "Malware payload (NetSupport)", "value": "f2cb5fef98dd61c96e79896bd9ee84f258f3e856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957730, "uuid": "8236043c-30f1-44c4-bc1b-3ca25495238e", "comment": "Malware payload (NetSupport)", "value": "4676b33b10d49d8ddd2ffceec7c9146100383d504e80fe2a3561d34d826c48e04a0e132960eaf10a9bd8a7478eb1bdfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957730, "uuid": "368c489f-2c77-4715-b82c-594895a41cd5", "value": "T1D7C5CE2E7E0CC157E5D25533E85A03FB61B64C28DAD5A00B563E3F7BBBF15A001A2D26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957730, "uuid": "59e537e6-6e97-4da4-ad76-8a5b5c45756e", "value": "1f4f257947c1b713ca7f9bc25f914039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957730, "uuid": "223d073b-bd4e-4487-b285-fb9b10de35b0", "value": "49152:xdoHdxkp92TMp2OSSyWi/TlV56nNeDyQ41Huw9If8DQtqKPi/VBK:id6Ugp24+6UyQ41uw9IkDUii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679957730, "uuid": "cde2479b-4d85-47e3-a8d1-6d29c0617701", "value": 2573819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679957730, "uuid": "71a328cd-92ab-472b-854a-fa2e8b47bba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957730, "uuid": "81333919-f6e6-4acd-a082-8b9264d4e9d2", "value": "ae63b342d6211f00ff9e256b1e2339b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7392dd-cc51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679888452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888452, "uuid": "252b84be-b7d7-40a6-9cff-170e78a4f0ca", "comment": "Malware payload (Amadey)", "value": "fa98eb18971a3e168035fe4fc7b52656", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888452, "uuid": "f75544a8-cabf-4a1a-98ec-754dda3ffef8", "comment": "Malware payload (Amadey)", "value": "64fd046a49f125efe3475274248f92e7c8165d46038509a97f53b8046e1cdc7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888452, "uuid": "786814d0-62b8-4755-9b24-4fd3f8ad7fe4", "comment": "Malware payload (Amadey)", "value": "3d94cc7c885d9b36c0c0feb6d05709e295592db1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888452, "uuid": "0b06d10f-f6ff-414b-8a08-807dd97a7310", "comment": "Malware payload (Amadey)", "value": "362971c0f1f54d5f989eebc04abf703e8f16305a31f5f56113c3ae122f0f6da3ad9e658e8a2180fd6606489e66b6dc02", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888452, "uuid": "c2b3671c-c56b-4598-9ace-0a9ac976cacd", "value": "T13B252323A7E9852AC8B417B058F713C71A3B7D90A975532B6345D8AB1C73348A63633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888452, "uuid": "79adeebe-1b99-42ff-8120-5ae574599059", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888452, "uuid": "99e7d8fe-9780-46de-8f1e-0ff9d7a042ee", "value": "24576:UyeNsNaqCfpKeU6wDH8kDCpURmhvg6LWOJU:jeNgziUJ8kDPmhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679888452, "uuid": "635d0b49-25ae-41eb-a659-df2421cdb0bd", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679888452, "uuid": "48c0a8fb-d406-4f3a-b876-a887847f7a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888452, "uuid": "5b94750c-323e-4347-8212-1671084d703f", "value": "fa98eb18971a3e168035fe4fc7b52656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1a969c-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "db20a40a-ab40-47ed-bafe-eab66686cce6", "comment": "Malware payload", "value": "222c2690838ee955a35df352bd817a46", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "7113ecf1-0b7d-4465-a6db-acf88fb3ea50", "comment": "Malware payload", "value": "6597cce3f0bfa69acb824be6b9a1564d61b015219eb5b408b03e28073a069cc3", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "ee643f22-3cee-4d56-80a3-e7b2d639f800", "comment": "Malware payload", "value": "5f9b6d52c709d8c2408acb5262ee5f84983efb48", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920560, "uuid": "c4f52fc4-5de2-4443-8b86-579ed53a6bc8", "comment": "Malware payload", "value": "de4cd7d06efe21a02ae4bd3c13869decf8b56d6e1640ec15528843d113a62ff068190228c4fb3f5a174247093ee127f6", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920560, "uuid": "d55d735c-50aa-4fdf-b55c-88e1da85c6f5", "value": "T1BD33A4094C89595B8273B37AEFA38559EF23116303665630FEDCB2061FB445846B2FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920560, "uuid": "3f17ee95-d92d-4391-84d3-97e9944d934b", "value": "768:ZrWLySTt9EQzQvUrDAg5kC4tzKBFQJ7h45:Z6ySTt9EiQcDGC4tzKBO345", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920560, "uuid": "f7954b33-6bcd-4cb8-b941-b90e8daa43d7", "value": 51586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920560, "uuid": "573b4b9e-b612-46b5-8111-970763c11fe7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920560, "uuid": "b69240fe-fe35-4ad5-98a0-e7e6ebb72577", "value": "Z6z9CQjT.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706fc28b-cc9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679921638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921638, "uuid": "5877db0c-a029-40ff-adc5-209264d7a54a", "comment": "Malware payload (CoinMiner)", "value": "27a71ca98bf0136e20b7e7a20a59882e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921638, "uuid": "22bf3f75-b7bb-4008-9f65-a5daff8e2419", "comment": "Malware payload (CoinMiner)", "value": "6658d9ff2c6f57b948f1a4f0b66ee5bc19246f32102e60fe6503b3127e7041c3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921638, "uuid": "d221d675-3af0-4ab0-ac0e-6d4ea220f953", "comment": "Malware payload (CoinMiner)", "value": "06094ebd972ad233e649350872eda88b29cbffd7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921638, "uuid": "f7531853-2cb4-420e-8f19-96b9769d619c", "comment": "Malware payload (CoinMiner)", "value": "2a3c018b7c94352ff646f57a13d78e3894db630cc817c3407a70d3ab06a0aa03b4f302a55e35c6bdf82950f6242bbccc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921638, "uuid": "76fe402b-6c50-427f-aa47-4637c4b9522a", "value": "T16044CF1A7298CC71E95641764831CBF96A3EBCB08B5486CB37942B6F6D303D2EB35742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921638, "uuid": "b9e0547f-2957-4b9e-ab9b-9b9246d367c8", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921638, "uuid": "efbac3a6-8014-4d00-ac92-8b2ea86eaf5b", "value": "3072:nZ1JP7IfDzrsBrxknL2H0ZYlDJ1iAX6euVG4zE8E1m8L4QQXRb/YRj5WzXv:nJDIQBVknLM0Z2DJ1zk8481P4QQXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921638, "uuid": "fe391207-84e0-426c-9856-e67f4de0f2a9", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921638, "uuid": "541225d7-893d-41da-9f4a-f83258456660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921638, "uuid": "d33178ab-d8bc-4851-a22d-ff1c404defa0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6c70f1-ccaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679929150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929150, "uuid": "061849d0-ab0b-43c0-aa8e-083d24116cf9", "comment": "Malware payload (RedLineStealer)", "value": "baf757079b4291ebfe81ced936147a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929150, "uuid": "db3a08f8-5f41-4e0b-84b5-58caba14f43f", "comment": "Malware payload (RedLineStealer)", "value": "67b2bd2f0e0ab30e5a10afea217bdbd70288b344453f4f4a1d745ca285b6c704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929150, "uuid": "103fddd3-b09b-4c2e-ba97-268335c7497f", "comment": "Malware payload (RedLineStealer)", "value": "8e414f76e2906809bb997a8916d49af01e86d5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679929150, "uuid": "c8ab5aba-979c-45c5-98aa-8ae76c22b585", "comment": "Malware payload (RedLineStealer)", "value": "79c5c87c4c7fbdd6ea42d1402280bc89b26d8919bf90854c5198e123fd41bafb5b050fa8d0a711f73d6f802097f77bf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929150, "uuid": "99134171-255f-4d69-bfa4-fb9d94bb2045", "value": "T101863342A8D5C0F3C2360D7E0EEE7395553A7C021F58BA2537842D2CE97A445AB397FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929150, "uuid": "5d3fa72f-eb6c-46b6-9fe3-35a943b7fb6c", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929150, "uuid": "2ea8922e-496d-4500-a262-20ad5eb68372", "value": "196608:V/lZGuSmrUiFY9wVbKuJg78/8ypOs+sg087RkcMnChr:VPOmYiFpRK8g78U1s+pV7Rkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679929150, "uuid": "c21edc43-bc31-43a0-bc99-678775e2938d", "value": 8574792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679929150, "uuid": "1421cdec-4c6b-4596-ab1b-a15bf73424f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679929150, "uuid": "89390076-2a45-47dd-aa52-d6808dd2d972", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bde5e9-cc78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1679905279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905279, "uuid": "ebd2bdfd-f194-4a1e-b8be-575e084cebae", "comment": "Malware payload (Adware.Neoreklami)", "value": "63926a5ec17e0838207346060ea15fec", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905279, "uuid": "434dcf58-12cc-48e1-a256-8fa7bd87efae", "comment": "Malware payload (Adware.Neoreklami)", "value": "67c3aedc80696d9f2bf64ec4a4c7c461605d54f169f83babdc8b90993afc500c", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905279, "uuid": "0e5fe7d6-a914-4394-8316-f2b908fd845a", "comment": "Malware payload (Adware.Neoreklami)", "value": "d30179fb24c18f9d49202f5110d38ed7967fa836", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905279, "uuid": "35254be3-fdf2-4bfb-9b37-eefeae94418d", "comment": "Malware payload (Adware.Neoreklami)", "value": "7c392c79d5348ab42c9b0191aa338c09437e0f6ca5a9387f9e9f78856da3f9b22f729b70569f10c4399b7c81bd910a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905279, "uuid": "ffa98c04-198f-413e-8112-648184ce57bf", "value": "T186763301FDE0CAB9F1510173538A7FA4A6BDC31A5E32C8D337CA8B1D7E6764E4124A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905279, "uuid": "dc818c56-47ca-4c16-9c57-0bb039230eff", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905279, "uuid": "1a708ffc-1d79-4dc4-8908-397994c35fd2", "value": "196608:91O6DEFZUlN3lPS0XJjoF0Kx0iroV8H6RrzJFAkN:3OAEFZmVqBFV0iroOH6RrHAkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679905279, "uuid": "bae619a5-b147-4f86-943c-2268e538ece0", "value": 7645589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679905279, "uuid": "e8a4db24-bfcc-45ba-a938-c9f02026b2d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905279, "uuid": "f021cb9d-6273-46cf-b436-6b35e5280a0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3751736-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951412, "uuid": "ab6fc10f-9bb0-4e41-8f4a-b0db90b35f07", "comment": "Malware payload (Mirai)", "value": "e6f15529db00a9d81b5b15c8ae7bb7d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951412, "uuid": "0a7daeda-0cc5-4942-91d2-4b198f54b799", "comment": "Malware payload (Mirai)", "value": "67e6d71fa0321b6a1aa07eba7334c94cdcb1d70c67676ce2803b34aec6255f8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951412, "uuid": "5fc92ade-1082-4e35-8008-5c46bdb9232b", "comment": "Malware payload (Mirai)", "value": "09eae90d7df242c989ad576aeea577714bf97d42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951412, "uuid": "8e632024-6077-4ee8-9c57-35ad25bb256c", "comment": "Malware payload (Mirai)", "value": "2dc8590e80acd61b428dabfe90c36c3ea1a852c0ff3809ce648b2d8099f0ce3656deb611336a96bf4e8c432bcf0cb961", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951412, "uuid": "2d833e32-725a-4465-a70d-6f08a9678cf7", "value": "T16B33F136DC8A7423F4147CB9FC2877C7B3D20A294876365A1B64C660C9694453AEB3DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951412, "uuid": "ce9c51e4-d207-4921-9401-8ee2fed7aa2d", "value": "1536:9Ebfy+Uoh0jVBAwFXXsjL6DpZOJ/NoeLob:4fy+VujhJ2LNNoeLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951412, "uuid": "9b6e258d-8047-4b74-aa9a-f61f9ec1c21c", "value": 52508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951412, "uuid": "376a89c7-dc71-4a8a-b25f-c7e0b12bacbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951412, "uuid": "ce0390a2-32ca-4e5f-bc91-94944b574cd8", "value": "e6f15529db00a9d81b5b15c8ae7bb7d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c30094-cc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1679909198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909198, "uuid": "3dc9d1a3-f6e7-4c88-9ae1-51503f352e7a", "comment": "Malware payload (CobaltStrike)", "value": "57736120aa9346d8c52a7331f7c9f625", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voiceinfosys.net", "colour": "#F00A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909198, "uuid": "6a7503c9-28b0-4095-873b-f5b7c808a134", "comment": "Malware payload (CobaltStrike)", "value": "67f83398e4b96573dd999384827d0441f8b3face1e8395f5533c1d95e9c3cacd", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voiceinfosys.net", "colour": "#F00A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909198, "uuid": "40ac50d1-e51d-4f89-8743-1a017833a6e8", "comment": "Malware payload (CobaltStrike)", "value": "e3e3bd59139948d00401184aed5ddf393cb7cd12", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voiceinfosys.net", "colour": "#F00A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909198, "uuid": "1017cc4d-f3ab-4f1c-9e17-9ec0041531f7", "comment": "Malware payload (CobaltStrike)", "value": "d862fb1c110e08d9d2e628973aa27ab966c693ac7e4f74b1208e39bbdcf0df1d362186d65655f9bab2f60cc42e022e5b", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voiceinfosys.net", "colour": "#F00A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909198, "uuid": "ae60e520-357f-44e7-ac29-ad80e3f7fea3", "value": "T18534238109C9EDFE7D34C709DA4F28988D906F84D60CF6ED729D08E3C2953526B8A776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909198, "uuid": "d6fc52b0-5200-47ef-b68f-fffe4f38b9de", "value": "6144:+q/iX4GAn/aN/R01/u9apA4L25kaG8TCGcyvp0QgY1PCG:9/iX2/GI/u9an25kd8TCGrvp+YYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679909198, "uuid": "d20e5cee-cf6f-4787-9319-c70eb6a59452", "value": 231476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679909198, "uuid": "ccc94c0c-329d-4598-8ff4-e00bc8585725", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909198, "uuid": "83c3b048-c69a-4eb7-9f57-a69b910b8696", "value": "forceupdate", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443ba639-ccc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679936166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679936166, "uuid": "fd26b365-17ee-4cc7-877c-3b62db88fa49", "comment": "Malware payload (Formbook)", "value": "b63ae78811be4eae8029f9fb4e7fcd97", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679936166, "uuid": "bcf18a94-bd19-4d33-9223-b7cfa7c1a9a3", "comment": "Malware payload (Formbook)", "value": "68865948019b62922ee525a02afd575fbfb8bbd6b30587c795b94f9b3e584c12", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679936166, "uuid": "3f40cc94-6029-4aee-b891-0d422004873f", "comment": "Malware payload (Formbook)", "value": "6bc00df660e50b78e2605a132b055d529def4ca8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679936166, "uuid": "6ce1ffd9-8ee5-4e48-a567-9bee7bfd7087", "comment": "Malware payload (Formbook)", "value": "ccb49acff0cfa621d5cfd0e1727d474cfd304d1bbc052a8caca9a3d0f2c72822af476fc013fae84726e2a31598803388", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679936166, "uuid": "b1ca63b6-1185-4aef-8930-0a646b4faa1e", "value": "T18254230A80D9FEF550CCEDC0B4F8EF966609135129E04D68FD5ED58C0AB4B22F9EB691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679936166, "uuid": "a96401f8-75c5-4877-8975-19657984a00a", "value": "6144:jyEq+hjpLuqtv307I3JtkOZucv5Xd9Cpb7ymm9djM6a:xq2jpLuqtv3cI3JtR/5XnqPW9dwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679936166, "uuid": "77cb848c-7e41-4ae6-b40e-11cec8ee6432", "value": 299148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679936166, "uuid": "c0a0f226-9439-4582-b15a-9290cff217fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679936166, "uuid": "91bb4203-ee21-4c0d-b77a-89a7afc125c1", "value": "new-order-PO21019612_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d958135c-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679901627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901627, "uuid": "23adf011-da7b-406b-81a0-94d85d4b1af7", "comment": "Malware payload (Amadey)", "value": "4a7c39301b4eb4d0d04265c6bbe1f4f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901627, "uuid": "a6f612d7-dda3-4c8d-b44f-d319c1e67002", "comment": "Malware payload (Amadey)", "value": "6998af1d9f903ff953b4d0ad8ad7fbcc9a257f786d108a13a0a3b308a4e1c3b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901627, "uuid": "aa7a964d-9dca-426f-ad66-bfb07e14c102", "comment": "Malware payload (Amadey)", "value": "3b800fc7cd7561677ccf080d4b24cbcb0172f183", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901627, "uuid": "f0a52556-43fb-4d37-bae6-2e33163c0d4b", "comment": "Malware payload (Amadey)", "value": "cc24fafbd57712a1ff01c654bd738c89df1d54561d874be0aa988da77b1334bde8564bedb29891da76420b21328206f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901627, "uuid": "12f9e8da-3003-4db5-af0d-9a241367894a", "value": "T1D5252312B2DC8066E5326BB01CF307871B3A3D756D7946276727A96E68B3AC0D07173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901627, "uuid": "558bc82f-6165-41d3-8232-33e59443f96e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901627, "uuid": "ce973ae5-f5b8-4946-9821-568006341d62", "value": "24576:ZyzgdjCYi7MRslgaa6BrJk51qEmMNv7wtUfgYko0WNWZtZIE:Mzg9C7gqiaNBu7mMhBpUZtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901627, "uuid": "ced85186-286b-4959-a352-55bd594c909e", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901627, "uuid": "d0c870c2-98db-4b09-ae02-346272dce4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901627, "uuid": "2bac9a82-d4db-4839-949e-096021e64c72", "value": "6998af1d9f903ff953b4d0ad8ad7fbcc9a257f786d108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab68080b-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679912717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912717, "uuid": "88840034-76a1-453c-9549-43c24fa831c2", "comment": "Malware payload (AgentTesla)", "value": "29c631a55a0a2839b8f4c0cd3cd7405b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912717, "uuid": "b23f431c-3218-41c5-88ee-72540481122d", "comment": "Malware payload (AgentTesla)", "value": "69c44e41e59c4e3d5c4dc5c36d59c3931c1a81bd905caaea6b75dbae6d1aa058", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912717, "uuid": "42a733d9-6edd-4b68-ab45-3a891347e459", "comment": "Malware payload (AgentTesla)", "value": "dc3ebea6f70afd37a72f2e79488354187808c95f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912717, "uuid": "3069e585-6a57-4e28-afae-7a64888f5bb0", "comment": "Malware payload (AgentTesla)", "value": "c4f5910ea56ff47b7cca33440190defe129e3e0e7cbbc3381fbf67071f90f4a1f8ff0eefc2d60582febca8a0c9f00771", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912717, "uuid": "03ac340f-09a1-44b4-ad39-efaa0dbd671a", "value": "T1B7D2A552E79E02B8CF9511B7121D07C9ABBDB23E335051A174AC927433ADC2E467A6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912717, "uuid": "d4861415-5480-453b-b941-9c8d53b3d83f", "value": "768:NFx0XaIsnPRIa4fwJMeAdEdtngHRswSXH/jAep5fX1S:Nf0Xvx3EMeAW02Aep5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912717, "uuid": "c163e852-d804-4406-b8ef-15551500b5dc", "value": 29365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912717, "uuid": "6cb41de9-3553-4a8a-b7b2-eccbc4faf9be", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912717, "uuid": "f37b5b77-1614-4006-815f-3d52bec439e5", "value": "EX771623605317.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376c70ae-cc9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679921113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921113, "uuid": "5e48af30-a9e0-4164-a6f3-1ef366af3b88", "comment": "Malware payload (AgentTesla)", "value": "6a528cfff5999cf090f5794fc86cadcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921113, "uuid": "1d14aa15-3bc1-4261-9c06-520339afade6", "comment": "Malware payload (AgentTesla)", "value": "6a0087305c0345b6a7323d488f9d9e57d0ee4972ebb132b89f1192994b8c78fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921113, "uuid": "4a187926-839e-4c14-b7ed-3332d880bf81", "comment": "Malware payload (AgentTesla)", "value": "d8dd1639f879dd0c6af6bb308d4558e42c0979f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921113, "uuid": "9942617f-8a38-4317-aed2-fed7d52b040c", "comment": "Malware payload (AgentTesla)", "value": "76d54ce65a691589fe407d9cf2c884945797eb687b179c8909f3f579a0600797c8bbfdae58165034f482413232278058", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921113, "uuid": "c1e517c2-8487-4234-b7d2-4193f44956fe", "value": "T162050189E3E56722E7B66BF02D704900D3BCB4EB5B56DA4D0D8A10D7C1F5B108E43A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921113, "uuid": "8850ecf8-e878-4590-9136-26c6a6bc147c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921113, "uuid": "8586ef41-61c1-44a2-a502-1d182b8bcf0b", "value": "12288:pA5iB0Opa8o7k0yMpuNzrq5hhcSqVRYIwHott85c3t4JhZ:pA567DdMgNzrijewxHinID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921113, "uuid": "03ab4d17-8b9c-4ba9-9194-ffcad227b449", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921113, "uuid": "176a9b68-1fa0-493f-854d-364b1376826c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921113, "uuid": "38ce8600-62e7-41f1-b533-4b3b033a577e", "value": "ohoyeczx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b6174c-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679903733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903733, "uuid": "51f95daf-5c89-4031-ac32-cbf00e5f953f", "comment": "Malware payload (Smoke Loader)", "value": "cae491f6d3dc1a950ad4d692b2dfd0ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903733, "uuid": "0a746370-c0ee-45e3-9eae-72f87212b179", "comment": "Malware payload (Smoke Loader)", "value": "6af4563c44b382abb15ff783f1e79014c50835c32fc1f5177c55dc642172dd74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903733, "uuid": "3d2bfede-3e35-476b-985a-51898e7b0e7f", "comment": "Malware payload (Smoke Loader)", "value": "1f381b2999a1c27f1677b1622582d256b2cf306d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903733, "uuid": "a21ab394-4b4e-4f15-b918-2105711d9c75", "comment": "Malware payload (Smoke Loader)", "value": "9670791a37351752178c517a94685c0229314005677619c3c7c159f1dc1a7ceeaa6205059a87a5249a456312722a0f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903733, "uuid": "27ce9b7c-dca1-424f-b6df-4929564f3fe8", "value": "T1C244C011B2B1C832E4B645358821C7F8A93BBC705B59CAD77780EB7E5D313D29A3A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903733, "uuid": "83580b30-c44f-4986-a760-fa64993341f4", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903733, "uuid": "4dfbf31b-ed6e-42da-8756-2d55b5a2acaa", "value": "3072:GT5ccekQRcQDWLipM4Feu/LUwcpVBLgR+y1gVGYceGr0RHEiGs5xbCymI:GG1pDWLV4VT3cF2+bSeGrkEEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903733, "uuid": "181e4b5a-e8d7-467c-9ed5-403b60c661db", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903733, "uuid": "92e167fb-03aa-4b1f-8757-ad9df5674b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903733, "uuid": "e44a083f-dd4f-4eae-a423-5f64f1d725aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466474ae-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679912548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912548, "uuid": "3bed84ea-952b-4db0-a4a9-ce1235e9ec55", "comment": "Malware payload (Smoke Loader)", "value": "17117c9fbb783c92646768b168ef82e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912548, "uuid": "c14ae464-b57e-483f-a493-7040bc09e592", "comment": "Malware payload (Smoke Loader)", "value": "6af7977d999ee1941c3d96c21e05b5ebb7d94196d198df333c1287e57700d33c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912548, "uuid": "d26c5707-5416-4bc0-a0d9-1e7a02f0cef0", "comment": "Malware payload (Smoke Loader)", "value": "fd2cf118b448d57fc3560e96472eec109af3e661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912548, "uuid": "2c389ee5-7b7a-44c9-95d1-350e078bc3cd", "comment": "Malware payload (Smoke Loader)", "value": "77169c12aec8916429d4bfa77ca0dac954a908f5842d3242ea8abadc5732f62fdbbe63ff8e0f60adccb3616fecfe808d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912548, "uuid": "f96b8a99-7da3-4816-a727-80644b720c14", "value": "T17A447D2E93F46860E5334732BE2EC7F42A5FF8615D177B6E2649AA3F0970661CD62301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912548, "uuid": "02e0ce1d-3a75-4db4-a225-e3073af6cbe2", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912548, "uuid": "e1850493-63ed-4295-8603-797a80d9a2a9", "value": "3072:u8BLGwA+dFG3xjn9+jK+vdBBNtHsDlltDKFRIoTfK9g/Ix81ejVfWOmn78F:AwnY3xj9+jt2lfKa6g815O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912548, "uuid": "52abfaf5-9d9e-427a-bf06-68c62eaa84ca", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912548, "uuid": "90d3199a-fb09-4359-b502-b05db59e4fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912548, "uuid": "9bc12c1e-a112-4831-88fb-3b4b24951255", "value": "17117c9fbb783c92646768b168ef82e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321c4abe-cc43-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679882449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882449, "uuid": "0237e45a-2803-4091-980e-37bf37b32442", "comment": "Malware payload (RedLineStealer)", "value": "a4c282d3487459c9cb2a0ed00d12ba82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882449, "uuid": "cc66966b-b892-4c9c-b09e-6ad325d35fda", "comment": "Malware payload (RedLineStealer)", "value": "6b461f6d0e734652d07e41d896922672778eab5eabfd775b7bec54683116f67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882449, "uuid": "98024150-1ea9-476e-828c-abeee05fd6e4", "comment": "Malware payload (RedLineStealer)", "value": "aa669438f74973760526aca78a253c7e163c430b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882449, "uuid": "9b708371-3737-4f28-b7f0-2a4a7e158686", "comment": "Malware payload (RedLineStealer)", "value": "d4a27788b4a4c8ea835440efff53944eeda5a1ef652da067d0d8fbf43cf3c39960a36b5f7bbfdf71e020f6b9a2bed98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882449, "uuid": "38b6c6e1-1d0f-42d3-ac29-a44725a95add", "value": "T1B5E412475AE84073EDB2277118FB06830A39BDA21D74839F7785DD092DB3A89A53533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882449, "uuid": "9814cb75-ae51-4e53-afe2-6358f3936bc8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882449, "uuid": "40c4f58e-b391-4884-b438-070efd5b42cd", "value": "12288:aMrfy90+O8Fj79ZRpNOEkApjSkdBruHXX9cA3kcqYlpJOM:pyFOSj79L6lApjSQrgH9cA3kcqYlpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679882449, "uuid": "c26c4c20-7c4c-4318-bd6e-8542fe0dd0b6", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679882449, "uuid": "7239b3d6-1430-42b5-842f-2a7e8ee80e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882449, "uuid": "ebd948e2-7dd5-4707-9094-689c77b0e855", "value": "a4c282d3487459c9cb2a0ed00d12ba82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2536edc6-cc5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679894453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894453, "uuid": "5bbe06c2-8761-4a93-8e21-021a83299a86", "comment": "Malware payload (RedLineStealer)", "value": "2b8bd1ca586c07f3d8facd15e7edc01a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894453, "uuid": "62cdb3a3-5943-4717-9cbb-2c33b4e7e00d", "comment": "Malware payload (RedLineStealer)", "value": "6c616ad906eaaf5380c6c3343e5b8f4b25291d2d8c101a4916e3eae1276ee927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894453, "uuid": "919ffcb6-04c3-4a00-bef7-d21490040db3", "comment": "Malware payload (RedLineStealer)", "value": "456baac9989ab2510bebbd72b00bc0e3a9eb2c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894453, "uuid": "9ea2c8f3-bc27-4421-a0e1-cb20e54ce67c", "comment": "Malware payload (RedLineStealer)", "value": "a02a84d3531e3ccd2ee1321b4fd235a5ba5e0c4a3c2dc2cd5f08e8bd574b330bb03bfc3f7cee64cfc190d1eb88bc55bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894453, "uuid": "adddc17e-91c4-47c2-bd21-67c5f70565dd", "value": "T1532523127AEE4133E8741BB158FE03972F3178B2496587691786698F0DB2ED1E4B2373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894453, "uuid": "e204bb57-886a-4558-955c-397a4765f208", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894453, "uuid": "9672542f-baa4-457b-a95e-18c1c0fb4a3f", "value": "24576:RyOcpduMB5p+iuvS5tQ6yaiK4q9qjCPwUJgHKhAL2FKLfs:EOqdnh5axK4bECZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894453, "uuid": "35c1315f-1955-4c17-965a-964a6c335e82", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894453, "uuid": "091e6bee-8843-4ef8-8c24-910a1a55950c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894453, "uuid": "78cf0d15-338e-4550-b000-1ba7bcf02acb", "value": "2b8bd1ca586c07f3d8facd15e7edc01a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da28b4a2-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679913225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913225, "uuid": "a08745b7-4cdb-4c2d-aa99-91be1aba0e29", "comment": "Malware payload (AgentTesla)", "value": "4519de9e3f5efd9400ddfdea287b5daf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913225, "uuid": "25bd7a7a-a519-43bd-ac2a-d367969d48f3", "comment": "Malware payload (AgentTesla)", "value": "6c8b93bdd0153dfe2c4ff9e4c758ec44f3e01fbb77cb54b51e7ed07efa734a44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913225, "uuid": "e97e4c3e-bd74-48fd-b289-55ef868b405e", "comment": "Malware payload (AgentTesla)", "value": "3caede68f0bd9e89b241c73064dd75a29095b422", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913225, "uuid": "44ff9a1e-4701-43a3-a536-984eaf5d49fd", "comment": "Malware payload (AgentTesla)", "value": "7a8b75cf0fb774c84279d982065e15b00282908c76fe768bb394859ba1149cd123691235829c50e8df954d722fe11493", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913225, "uuid": "20d532a7-5102-4e8d-a275-7eea96239b70", "value": "T10205F094E3E0A726E77667F42DB09500D37CB8EA6B46DA4D4D8A10DB90F1B204E43F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913225, "uuid": "2d482d84-4ce6-4ff4-8e81-7a2f1495fc90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913225, "uuid": "4a5c4d7d-2c35-4ed2-9d2e-5d85496c9031", "value": "12288:cA5xB0OpJhZDrxDzJOzrsj8O8wluaUVnBNrRs94SQnzd9Gwg2ZvRDM:cA5rZDDN5OkIpwldUVBnsqzzSwgiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913225, "uuid": "1bcff854-558a-421d-96e2-4d37fe884a64", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913225, "uuid": "a4b4f30d-28a3-48f2-a8a2-a3b0836975b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913225, "uuid": "4c32bfc9-9f35-4e1f-92ea-d89b636c37f1", "value": "4519de9e3f5efd9400ddfdea287b5daf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34880a2c-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894908, "uuid": "55b90c06-db98-4d45-b43b-747d94cac92e", "comment": "Malware payload (Formbook)", "value": "f6cf8bf74259e4cf8feacbf5b4d7a86c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894908, "uuid": "dca7ee87-7150-458d-9d46-62ad20c4c370", "comment": "Malware payload (Formbook)", "value": "6d481e182171f2ecd8842f6fa904656313640da4477655d0732a378809d58d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894908, "uuid": "bfedff93-53df-4d2d-bb26-95f51f792711", "comment": "Malware payload (Formbook)", "value": "629472079c3022ff904ac46705cd03808194722e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894908, "uuid": "2573812b-6cde-47eb-9572-e10d6de013db", "comment": "Malware payload (Formbook)", "value": "cf22212da7a2e9f1a21ac8f015cd615dc7bd0299f24eb6c91ba703ee091173be2fedaefa8d47576efa8cda90fb8ad6e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894908, "uuid": "9ea3e7f6-246a-4c03-ac29-39fe6c59021f", "value": "T1B625122527BB476AF57A6BBE81A036455B7E7BA37703C64C09B110CA4733B021FD162B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894908, "uuid": "6d206f60-0046-415e-86c2-7414c134447e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894908, "uuid": "632f37da-cc9c-4a9f-a025-82424699527a", "value": "24576:b/PiwOvFzdvwe0PZe+LfnQpbZnN4LgDFr9lv6n:3mFhZ0ZeiPQPnNpDR9R6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894908, "uuid": "90793449-4f99-4336-8203-c89c3d3cd41d", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894908, "uuid": "12380899-43eb-4ca5-8eec-4d02953f8d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894908, "uuid": "ee81c79b-c097-4871-b315-c1e9708032ff", "value": "EEcbDKtUD5MqK0g.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddfd742-cca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (WSHRAT)", "timestamp": 1679923244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923244, "uuid": "d8fc72c8-2d1f-40e4-9dc2-58f11cbcfa47", "comment": "Malware payload (WSHRAT)", "value": "82190aff405aa674adf49568649fe52b", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923244, "uuid": "39d7abfe-526a-4b38-a530-7f5c15cb3888", "comment": "Malware payload (WSHRAT)", "value": "6e23d208c9821f239e6ad6c52018a201e0a53842c3885b0aa4017c01518bd247", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923244, "uuid": "eff47c22-eaa2-4462-9022-58b8ea1fb6de", "comment": "Malware payload (WSHRAT)", "value": "966d1fa684290305b77cebad19f70ebedee66f3e", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923244, "uuid": "1e7eb6a1-e303-471b-974a-c493172b1abf", "comment": "Malware payload (WSHRAT)", "value": "aa64faa3ed1628ecc8044ebb52e53c8b81975075213e795cc0c75d4e7f5785125e294c7631c81353f42187e14f6bce3f", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923244, "uuid": "d03f83a6-a2ea-4094-991f-8dcae876858b", "value": "T15544F4023E8BFA3C555F2D0065392E768F5EFE64C11951A62A496FB9C37B08D137F828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923244, "uuid": "1fe7faf0-6cc4-4dcb-98a3-4f13b337b902", "value": "768:9+i+03whqCx8CG5CsJRxhcxSLeK5BpmamOD5Z3rxRQ:+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923244, "uuid": "7c88c8dc-1f71-40ea-a09f-0fee0d97e8dc", "value": 261495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923244, "uuid": "de4d2196-1e3c-4cbf-b9c7-eaa48aee76db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923244, "uuid": "2a0a9262-eda8-4214-b267-26d54bcae8df", "value": "ORDER230327.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c74199-cceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679954723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954723, "uuid": "28ffd36b-51fc-4860-aea4-03740e61d3d5", "comment": "Malware payload (Amadey)", "value": "932b6212cb60c008058c5fecdf94a829", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954723, "uuid": "b36184db-7223-462d-b587-392a20561658", "comment": "Malware payload (Amadey)", "value": "6f21fda1e2399643c4535d9493e79ae35f7eabccc5605590a969b545883ae507", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954723, "uuid": "c4f4e0ed-c084-4da4-9e64-c9f9fd5e75d6", "comment": "Malware payload (Amadey)", "value": "10ba752fe71439b5d7c1b33c21e1a5743f86516a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954723, "uuid": "4a554fe6-6724-49a1-b44d-7dca8b3532f1", "comment": "Malware payload (Amadey)", "value": "aa41cb977d33e43949173d2f52b59a847f92d096d714b1dfe8decf3cd2e612d91108044760e358405168d45e33088df5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954723, "uuid": "dcbcb2c8-dfb6-40e3-b352-6fbce2050be1", "value": "T182352312BAC98473C9F007F058F746872F32BCA18E7D525B3749665A19737897870B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954723, "uuid": "5be52e03-5bb0-4612-aa72-244afd08d9d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954723, "uuid": "7638bbff-f564-46c6-ba37-0bbf3ad02521", "value": "24576:wydXT5bQZtXGb591ormmnEmKlDwTxEf4KL:31lFb7qnErE04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679954723, "uuid": "75e15079-db28-41f5-b339-9a38813e851c", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679954723, "uuid": "c4612590-d744-43cb-841a-9a0099df004d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954723, "uuid": "2de748dd-b1c5-4ecd-ac66-333c48dedf5d", "value": "932b6212cb60c008058c5fecdf94a829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a892470-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679894918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894918, "uuid": "afd17f88-34a5-4553-bc76-a34ba0b46815", "comment": "Malware payload (GuLoader)", "value": "0b3172fe7f074582d0de172300881701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894918, "uuid": "17e7476a-ee70-418d-88e0-7c852d25cf6f", "comment": "Malware payload (GuLoader)", "value": "7136249249db3d970775998b54eb855fcaf4e53ebed0591a6754ee0c604bb534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894918, "uuid": "20f77ff3-9abd-4718-b967-94be643dbafa", "comment": "Malware payload (GuLoader)", "value": "08b2f1e6f5c67c095a5521444f83eb448d18a31d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894918, "uuid": "0939ff95-ec5c-409d-8e1f-b7ba086de22b", "comment": "Malware payload (GuLoader)", "value": "0df15f253cc0a06d712f516bcee0dbd037a834f1efac631d93ed77c01f0d16d2e6883e74a9b3d32ae0b30744c4e2eac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894918, "uuid": "5c18a324-57f2-4991-9d3c-fe80e52c23dc", "value": "T1D874F1D27701C1EAFE7D8835F0AF9417AAA6BC7A592509D5338CBB4848F25120E4FF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894918, "uuid": "d6c7d80a-b86b-44e6-bf1c-c5cfce33443e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894918, "uuid": "15cec012-b36c-486a-9491-53ef6ec40f5d", "value": "6144:nQ606xUAK/TxV595DDVNv/QWZ1VLEg7eiz2qEM85N6BelLGsNzkZhcFJJ0VmFa:k3LJZNHQWZ1Ryii5UBexGqUSnmmFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894918, "uuid": "b85dc3a2-33fa-461d-9632-9327191054db", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894918, "uuid": "e355ee12-304a-4951-bdf2-c1f23d706573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894918, "uuid": "47ced092-0af2-45c2-928a-c45ab14e288b", "value": "JUSTIFICANTE DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a6bd91-cc75-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679904040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904040, "uuid": "5968d77a-64c7-423c-9593-5c12c5b31972", "comment": "Malware payload (RedLineStealer)", "value": "bdf20af4f24907aa4760bbd8565d83aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904040, "uuid": "15ae17a7-9f3f-472e-a465-564d2c56ff0e", "comment": "Malware payload (RedLineStealer)", "value": "7198cbc5c7b54029162e4b607a4dd8c1dd85a36db4d60b38af70a10e8ab99812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904040, "uuid": "e806ffaf-0150-424d-a5d2-54ccf778808a", "comment": "Malware payload (RedLineStealer)", "value": "88b7dffb631d74e2bb33bc582ad1a5caec7ab90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904040, "uuid": "1157c55e-1849-4d31-b301-eaf21042005c", "comment": "Malware payload (RedLineStealer)", "value": "68c95dd4fe7da5f39684f150c678fe26a62d20e25ef9bd122c6310fa9e9078ba1fe829f854bf73d2274cd345659ff829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904040, "uuid": "d69e110c-30cb-446b-aa96-23713417bb25", "value": "T19C252217B3E08572D0B45F704DF647831B3A7CD658B4CB372A869D0918B2698AA3932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904040, "uuid": "f2c9af16-e3c7-4827-b94d-04447a601872", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904040, "uuid": "bb328ab7-00c9-48d1-8548-6ed0635529f4", "value": "24576:LysEDHNQFUDq/kYNNSyOrClFIH2FMAvAO4RaHWF:+sEhQFIq/khr2lho0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904040, "uuid": "1151ed64-b277-4d47-a6fd-634774ef023c", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904040, "uuid": "92b4fcde-31bd-471e-8237-aef7e1fd05a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904040, "uuid": "890952a8-2d07-48f1-a45d-ed4412ebfc63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ab3558-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894932, "uuid": "233adf02-6c7e-4b4e-af56-9ba0547485ba", "comment": "Malware payload (Formbook)", "value": "d69a6800100677afe7a231fe90b46d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894932, "uuid": "eade66e9-89e3-4518-8adf-50e3030a1958", "comment": "Malware payload (Formbook)", "value": "74918059a600f724964e71c9c698e6d46090248c16f29909a9de9a8b290af4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894932, "uuid": "a89e719d-983a-462b-8c3e-371d492cde15", "comment": "Malware payload (Formbook)", "value": "601740f9e814280108c35b552f4a8133688d1780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894932, "uuid": "29901fb0-0a6b-44b7-bcb4-276d9c1d6499", "comment": "Malware payload (Formbook)", "value": "fcc9dbc7052b188ac81fb0df599f287fee0440dc8365fbc1779174ba117b457077244e2f62f110acdf9e9f9a40863889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894932, "uuid": "f95437fc-b35c-47d6-99bf-43109327cf65", "value": "T12A2512287FE75026F536273E85E1255107BAA3D3A717C84E15F621CA8763B824EC1E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894932, "uuid": "39cbbdbf-3855-40af-b93a-ffe36eaf9fe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894932, "uuid": "ef92d6d0-6bef-4067-99d1-60aa6bbb3400", "value": "24576:3rsN8xDcRl65xDsqhDMGdauwygv9bv/xcg2l:328BcfqJav0K9bv/xfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894932, "uuid": "28fea638-4bb3-4876-8583-f5834a3af13a", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894932, "uuid": "8dbb484c-fc62-4c60-b703-bd1f6dce884f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894932, "uuid": "9c743985-bd77-45d3-8baf-2df25e4124b7", "value": "Statement for HADCO S.A.O.C As At 10Jan2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e23d4d-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912711, "uuid": "40bb98c5-4996-4027-a7be-902f797f0ade", "comment": "Malware payload (SnakeKeylogger)", "value": "3598624bc0b493794d01a351110da247", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912711, "uuid": "af2f24d3-d25a-4c8a-87b5-0a8411b55171", "comment": "Malware payload (SnakeKeylogger)", "value": "74ab7164330c640ea03e184339b6a3ed1be1c822cbdceeac2d2e0017f34c0045", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912711, "uuid": "6a10b452-bebf-46e8-9a6f-7b4b8d2c8088", "comment": "Malware payload (SnakeKeylogger)", "value": "2a6f882b14608c633acaf62f94ed33f648b931e0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912711, "uuid": "9f19375f-fe56-4dc4-be41-19091a82a5b0", "comment": "Malware payload (SnakeKeylogger)", "value": "5c06956f39fd482f5f1a12bc347930a6d72dfb9ded81727959656625ef151ae78ccd1ae51fc2e6542993629545e16d86", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912711, "uuid": "1c0c2d1e-e1f1-4a41-8511-3ac6229f1f91", "value": "T1D9F2701AE39F02B5CB411277231E0A8997BDB63E735191B1746C937033EE82E46766F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912711, "uuid": "1c795c8d-dce4-493c-b783-688ce6d6bbcd", "value": "768:4Fx0XaIsnPRIa4fwJMBawt4IZNlTyTQWlL15XJJUrVJYseQ:4f0Xvx3EMr4IZNl0QWlL15ZuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912711, "uuid": "e3d8149d-c2fb-45e1-b32f-5738d5f76e06", "value": 34502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912711, "uuid": "f028fbae-2f03-44dc-8c5a-0526fb8e8dbc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912711, "uuid": "b97e289f-a139-43c2-b885-e1009c3fe0fb", "value": "Air Freight Shipment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d230a1f5-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679903763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903763, "uuid": "27ce82c4-477e-42eb-bb73-d27d8ac0c7cc", "comment": "Malware payload (RemcosRAT)", "value": "8192d3f751321ad7162253260bac1e89", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903763, "uuid": "eceb7676-4ffe-4402-859f-0b86ba51c583", "comment": "Malware payload (RemcosRAT)", "value": "74dce63d8a1e4ce23537b32d616da77aa281b595c6c07b78cef3ec6bf074348f", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903763, "uuid": "0bbbe338-501e-46f1-a244-1faff9001a98", "comment": "Malware payload (RemcosRAT)", "value": "803a088c7a802968c8c22b5e60addab6c9dc1f98", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903763, "uuid": "bcc9e84f-c649-43d5-a84d-c1385d631ce9", "comment": "Malware payload (RemcosRAT)", "value": "9877639cc43442b7a4eb11afcba0456426fbd4e8e0ec11ef4083a4c3b0df0093cafc3dd889d4c479a1f8b7dbccdb29b9", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903763, "uuid": "16c41a06-27d2-470a-8ca3-4590d0ac2a96", "value": "T168751249F7942722E777A7F029B04900D3BCB4EA6356DA8D6D4D20CB92F5B104E83E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903763, "uuid": "bf363e70-2e6a-4b3c-b1c8-ccfa1ed041d0", "value": "24576:vA5Ix0j/0Yw6gDYm+T1Nk/iEYaEr/pa7qvjSUJD:Y5Q0gGg8XxNk/i8Ej42SUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903763, "uuid": "64b68088-8a0f-47a1-ae1b-55e92f6df062", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903763, "uuid": "11ccad8c-61f4-47b1-87a4-6c7bd9fbb2ce", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903763, "uuid": "d80f2b57-494b-4ef7-b918-67886491f8f3", "value": "Proof of Payment.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c074e3b0-ccf8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679960427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679960427, "uuid": "5f8ec735-8f14-4902-bb8c-0845111a3995", "comment": "Malware payload (Amadey)", "value": "34570af15eb16642bca9f6b085ca83ff", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679960427, "uuid": "c75263fb-9066-4ced-9616-9c33bfc63fe5", "comment": "Malware payload (Amadey)", "value": "75264f0bd3fd86b38e9d586e46c33fd3067c0c67b7a4f67a475a5a3f0c230941", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679960427, "uuid": "abd68174-74ba-44bd-a0a8-e5a83f32ac7a", "comment": "Malware payload (Amadey)", "value": "e60f037fbde591c0547f79ecb65bc8a583b98da4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679960427, "uuid": "dfb6959c-030c-4a09-a144-3c81d6e3ebb5", "comment": "Malware payload (Amadey)", "value": "4e80cd8aa7675427aad187b5efddb9b1ce77ddd08ff7ecfa84fef7cd410983ba08f1d6d0a8a8ca9ae21c8c6684e71fa9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679960427, "uuid": "686dd7de-2efe-4e3d-a912-cea01c0d19d2", "value": "T12A352347A3F84171CEF42B7518F723832E35BC944938836F2B99B91E1C716A5297272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679960427, "uuid": "252c6344-a367-4e6b-b5d5-79bcb11e32ff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679960427, "uuid": "60146485-5f3f-410a-a159-bfe3b907ea5f", "value": "24576:by/dsg8gtbQ0OLXCwroDdUw1ZePmKEWhEj:O/btbQbrCNDuzmKEWhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679960427, "uuid": "2d436745-42a8-4350-9216-66a50eb37d2d", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679960427, "uuid": "0a9ce0b3-0b05-4f04-9246-8fce79f0bf88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679960427, "uuid": "f7d00a26-f41e-444b-b97f-31e414688156", "value": "34570af15eb16642bca9f6b085ca83ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619b6fa8-cc3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880381, "uuid": "45640688-76b9-4982-8f94-cbb70a163dcc", "comment": "Malware payload (Smoke Loader)", "value": "2e3d381b125b407306e84e910b5e4e20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880381, "uuid": "1bfc678c-3de1-41a7-b6a8-24d2770c43a6", "comment": "Malware payload (Smoke Loader)", "value": "754f002afd6f92d540aac8eca92325f221217e2f09d4a1a261fbeada5a910c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880381, "uuid": "5d957a62-d739-4d74-89cd-06f926382828", "comment": "Malware payload (Smoke Loader)", "value": "dca14f7557e337042b61b5ed8406b093af4325ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880381, "uuid": "ef5fc23b-d6f6-40f4-bd08-9317ab0b7b65", "comment": "Malware payload (Smoke Loader)", "value": "4adb6e4500a9f1d2544663c716e6cab528161dd29ef2d0e627cdc925813c6e639f62df0abf50b3e4501c5ce895eef523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880381, "uuid": "6f676783-ad72-4526-9555-80ba799df2c2", "value": "T1DC546C3262F17820F563D6338E2BC6FC2A1FBA619E156B7D17495ABF09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880381, "uuid": "cfc07a21-b4fe-4f1c-9715-d307de835f10", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880381, "uuid": "c9a3dda4-2512-4f93-b750-5490fbbf3e62", "value": "6144:ERvmGp0Ow5xaQJGUpvS+hDDkdrs//bNN4T:ERv3Jw54QcUpz2UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880381, "uuid": "c258974d-0be8-4085-9347-17384083073b", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880381, "uuid": "3eb6694f-10a8-44d6-b263-aab87ac866df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880381, "uuid": "5d39d1db-040b-43ac-b907-b93feb28632d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e33edb8-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880698, "uuid": "8a924da6-8422-451d-a172-68edcd0c4ffc", "comment": "Malware payload (Smoke Loader)", "value": "632e116a94ae0651ac52257f872ec41f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880698, "uuid": "6bdca51a-75b7-4ddb-90d0-45a52553f8de", "comment": "Malware payload (Smoke Loader)", "value": "75f296934d1279d8fa1a085146047e3f90ae07f48a571f0a58acb8aabab29feb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880698, "uuid": "453e11fb-2d8f-4848-977c-467d37660a68", "comment": "Malware payload (Smoke Loader)", "value": "2e728d2c5e20cbce479faee5013823a1232029a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880698, "uuid": "752034d3-d6c1-4859-9856-c01d98ca0fac", "comment": "Malware payload (Smoke Loader)", "value": "c4cd47396a607b2cd013e98be93aabbe5b4b6508157675177177c3a19c15f53ae6275b0009557d595ef83355afa3d515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880698, "uuid": "f01d37f9-d176-4eff-ab44-39671cce3058", "value": "T14A546D0253E26420E72387328E2AC7F82E6FF8615E157BFE12549A3F2971F72D162715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880698, "uuid": "d20832e1-bc51-4aed-b4a9-c0503443d08c", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880698, "uuid": "19a7b2e9-c347-4121-b5b3-b90bb5f06bd2", "value": "3072:j4PzYzAy+tBQ2jd99Q6RikGdh8fUxpKu9pH70VXN1n2SCQFCsJgtAE1gywCJQN09:zWXiZdEUvKuT4dTgsqt/jTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880698, "uuid": "fab22f8f-a391-4340-9d60-7fe29c42a53c", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880698, "uuid": "1b4058b8-09c9-4c41-8ef2-4d368f10a2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880698, "uuid": "2719169b-01e2-4c52-b4ab-d6420a9b06c0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a41a57-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894887, "uuid": "0f1e1f78-d7f5-44b8-a911-16047d900c16", "comment": "Malware payload (Formbook)", "value": "5812519a33170bfd5ddef343c157c4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894887, "uuid": "c2a81db7-5f7b-4e90-97bc-eb86c1b35ee1", "comment": "Malware payload (Formbook)", "value": "75f95b9c0daa55a9d00d3fdc76b74a142314da0f225e6a7fcec22a0582d392d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894887, "uuid": "be4dcc81-a80e-47ea-9835-7f27130f31ed", "comment": "Malware payload (Formbook)", "value": "a28910e96900903fabf0cbacbf6b70f911b8d121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894887, "uuid": "751eb775-c930-4235-b1e6-6e9528900e16", "comment": "Malware payload (Formbook)", "value": "66c8bcea3ba0353bae3d704d03ef409cd033141cd3b1182489c52f55217a5d21783c0ec2bc3ae210d16e9ddc9d660b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894887, "uuid": "8bd9c1e4-f5bb-4ea2-ac1d-61b24bd54113", "value": "T11D04AE36DA42C071F2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894887, "uuid": "57fb6147-1573-4cfc-b1c5-468889f46876", "value": "3072:MbX4kQvFJdO43t/c5scFV6hP/zSJRhUweMoeks3jG1ZlRRR:zU2tk5B6hP/Mh9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894887, "uuid": "ed2bfbed-e065-4d2c-8fdf-45f66c1cc761", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894887, "uuid": "b8b45e07-172e-4224-b174-f9123782e55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894887, "uuid": "b69d7511-52da-40a9-88d8-558b352a33f1", "value": "75f95b9c0daa55a9d00d3fdc76b74a142314da0f225e6a7fcec22a0582d392d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518b7e9f-cc8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (N-W0rm)", "timestamp": 1679915143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915143, "uuid": "003e0bde-f2a6-47aa-bcb1-bc77bfb47291", "comment": "Malware payload (N-W0rm)", "value": "a11ae57c068442f751c4a7f4f5f542b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915143, "uuid": "866780eb-4d33-459a-80cf-b79f1d3a9b80", "comment": "Malware payload (N-W0rm)", "value": "761f42f03e50ef9b2eb1b1041c81cc6ed24cbc8ce2d6df3c87f193493b4a4772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915143, "uuid": "2bfceece-8520-4560-9eb5-eea7596d681e", "comment": "Malware payload (N-W0rm)", "value": "131eaded2b2507fa0b1fbf5677705a09496d0f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915143, "uuid": "eae41e8b-60fd-4ab2-ae93-8eacaab92e8e", "comment": "Malware payload (N-W0rm)", "value": "b73c40b70aff8655ac14813acb79d1a06d045eee289a404704b7103a21f988db6563c3e09e77fe5f99e65eb289260a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915143, "uuid": "2f5271ab-3454-43eb-9ca2-d6f6324e23db", "value": "T1077401CAD3D602F1E1DB65F00E7AA63FC712AEDA56A64687D708CA0175F3241CC1B672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915143, "uuid": "b8771bd1-5e1c-4efe-8694-1d1dd5bacb18", "value": "469a28fd506c4e9127d8283ad9556834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915143, "uuid": "dd425103-054c-4a66-9131-f107a68f12c2", "value": "6144:5P8U5dPZDa/iuqO2pi14MlxYSCG1H95dp4kq5bx4fbJr/CYzCIbeY3opBMc:F5VZDaj5xZC2dGkebubJr/CIbbopBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915143, "uuid": "86c54a6e-7578-4804-825c-dde4abdc88f3", "value": 342643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915143, "uuid": "f3d5169e-9fa4-4658-8a05-f04a1942c922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915143, "uuid": "b45c1846-4d87-4510-b53c-579eff478e8f", "value": "761F42F03E50EF9B2EB1B1041C81CC6ED24CBC8CE2D6D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2a2c76-cc4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679887643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887643, "uuid": "eb90348e-38d2-4c82-95fa-384a9be0c807", "comment": "Malware payload (AgentTesla)", "value": "f15bf35bb4015114bd6463dd215d18b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887643, "uuid": "6ea5adfd-a8a2-4cc4-a916-cd36f885914a", "comment": "Malware payload (AgentTesla)", "value": "76f94696cfc03fbdfa120a515db6ee17f543a3bf0e4079496ebc04df0bbdcb97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887643, "uuid": "6923f0b5-e386-42d1-b052-55e0e33dc549", "comment": "Malware payload (AgentTesla)", "value": "1e3cbd3d3646fe5685cd570f62b3b3f61dd325ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887643, "uuid": "a107bb99-fb46-4106-88dc-de91c55b7204", "comment": "Malware payload (AgentTesla)", "value": "53d44e653021c243333bd92637ebf18077c5ffdc5dab30df42c921db8cc176286fe3e1d4da07451d0a1b2a5cc5e0df11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887643, "uuid": "f0fc0a00-0094-4a6c-90ad-f67cb6ced9fb", "value": "T160050154E3E8AB13E7B6A7F029B19500D3BCB4EB5B16DD8D4D8A10D784F4B108E93A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887643, "uuid": "3429308d-bae9-47c8-8a75-c37a2f689a75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887643, "uuid": "26411110-1d5d-471e-9ade-4671b3aca2e9", "value": "12288:OA5PB0OIywKyBREk5g9BVIAp9uz3TFCSAOJMLQfzRSzJD1GeKxPpJhZ:OA555Tzuz5CJh8VGtKVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679887643, "uuid": "5fd34ff2-4504-487e-872e-97fd2ed51387", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679887643, "uuid": "0bf5b5a0-c4f1-468e-ac06-ecaf925fa993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887643, "uuid": "2a37b27e-83f1-4682-a62c-d2f837e95d1b", "value": "SecuriteInfo.com.Win32.CrypterX-gen.10949.27991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2402be9e-cc38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679877701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877701, "uuid": "816a86d9-1cf6-465c-975d-f44c472a87a2", "comment": "Malware payload (Amadey)", "value": "369e7a430bab9b7a043b5ea1bd1496b2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877701, "uuid": "a91c706a-9b66-4eaa-a929-061f23d34098", "comment": "Malware payload (Amadey)", "value": "78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877701, "uuid": "f3f20ff6-470a-4ad2-a387-fbb96145f45d", "comment": "Malware payload (Amadey)", "value": "23eb3090bc77349f079ef516024bac184c9afdcf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877701, "uuid": "97f5b31b-253a-496c-b53a-881f85782dd5", "comment": "Malware payload (Amadey)", "value": "d71f4d8f3ef0635d5c9722bdb46ec6d50b3b2385d2247d3d60a28c9b62cc366b82fbca7074b6a7d5084655733dfd5d1d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877701, "uuid": "503a8a17-b290-4180-beea-c4cbe02ec43c", "value": "T12D26AB2808B3D433E1E5CFB69434371A91543F4E0A78F8E8AB565AEFA443770BD69931", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877701, "uuid": "7b41574d-4d41-486d-b0de-75039945052e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877701, "uuid": "28e2de0e-a5cd-42d0-b450-75a2e9412db2", "value": "98304:RS8Xb8gXnHsttAjzt9p207rzQHZpAF7wIBECqHto:JXnMIB2IUpLIBEvHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679877701, "uuid": "572ae693-db6b-411f-9e99-805db8996fc8", "value": 4757504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679877701, "uuid": "d5eec1e8-1043-410d-9cec-00cb45010942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877701, "uuid": "c9c861ef-ea4f-48b8-9832-1579341a9c77", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5dbb45-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679901550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901550, "uuid": "b6740680-f5ed-4366-840c-78ce1d8cacca", "comment": "Malware payload (AgentTesla)", "value": "9e221d70bc385c9acddbc4078445ad61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901550, "uuid": "d95fa2ba-4695-4126-845f-65653ea53a9a", "comment": "Malware payload (AgentTesla)", "value": "78ba92aff0a6208d848f2ad9dc3428d5d94da757f80a8eafe777c6261f707802", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901550, "uuid": "bfaf1d67-59ae-4c61-96df-3b3a2521a12d", "comment": "Malware payload (AgentTesla)", "value": "ae822095a3379c7591e27bc44752f6bdff8ff235", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901550, "uuid": "1b68d175-439c-498c-9ad3-c55ccd86b362", "comment": "Malware payload (AgentTesla)", "value": "6a96cce33fbc74fdd7a1f9f1fa54575c8b69ee457f9bde17f7b4e5f9c67c2a168b6626714f7ace4106ac352fe2e9e13a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901550, "uuid": "f40148a8-b3cf-493d-b5b6-e1796ac79e87", "value": "T158F43317FCCB1D98D7E155A23B72853A1D7AEA1A93146E7CD0FA90B1E703497A2C0273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901550, "uuid": "def30ed6-185e-45b5-9dc0-a1bbcd81efe8", "value": "12288:e3Z+a2BcvKMFQlACW7lc0mKOkWrT+fUjYFI2HyRDsd40YT3IFuSPy0d1amHcQl/a:eoaKmhFQlACWZceOkWrT+fUQIEGZ3IQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901550, "uuid": "deb69bc5-7aee-4169-9c19-1be4f0d28244", "value": 753554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901550, "uuid": "ee9baa23-76ee-4932-a976-dc7d61a2356f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901550, "uuid": "69257274-6c4b-4929-9251-d5225fb7b52b", "value": "QUOTATION REQUEST 890125667.PDF_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f264af-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679928192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928192, "uuid": "4ed0b6d8-7667-43e0-9d6e-c0500648bd6b", "comment": "Malware payload (Fabookie)", "value": "eafb7a0308b02a2a5a4aa507da675ae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928192, "uuid": "6fb46fa0-865a-423b-9cfc-6e1ee7354a5e", "comment": "Malware payload (Fabookie)", "value": "79579197324316922818b2b47d2104332f026970ea4bb6a3259078a96805d67d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928192, "uuid": "7ba54487-a5b3-49cf-a984-0226468c1978", "comment": "Malware payload (Fabookie)", "value": "6c42dcf4e9479d3684773343502ec340dadf7cc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928192, "uuid": "b2f75d5a-df44-4609-b013-a7558f555c02", "comment": "Malware payload (Fabookie)", "value": "628e635cf8b0ac0c382198365b676f5b0362b8cd6c7269beb6ccb416f4b53ca807337a3eeb4f0a61a23f6db47c4d2a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928192, "uuid": "b966b83c-78ac-48ee-a530-c22d07b8c68e", "value": "T15E643B156FB91DB6C016B43F0C6E84524B337827162783F7E496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928192, "uuid": "3e5fd37f-4c26-4cf2-a2a5-2225c8eaafb6", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928192, "uuid": "89324048-d54e-4fdb-bf24-468be6df2d90", "value": "3072:P8k/TMYQ0qIN6NtVcOXEK5ULtGyUPj09vJqxEm4x1ESuQG+3SeyRS6CSfKVu1xgP:5Mnt3EPRAPj2voxEvTEPp/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928192, "uuid": "65ec4d50-85db-403c-a964-1db096b9a777", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928192, "uuid": "5348ad21-e5dd-4119-9b11-dd46d02b6d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928192, "uuid": "19568885-eee5-4285-b93a-01fb04e078fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad70e3b-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679928232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928232, "uuid": "d1a3e091-e37c-4e75-9bb3-1a70f0e3a422", "comment": "Malware payload", "value": "8f9dd1bddf4d5f744a68ff41f2e66584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928232, "uuid": "51eb87b9-0728-4a33-80ee-30fe678b40a3", "comment": "Malware payload", "value": "79798cd455143c5f2a6f70b87bd3e7b05ce5f68ee39409da1b4480c1842f842e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928232, "uuid": "2192c4e6-5c76-4b02-b6e8-be63752913ee", "comment": "Malware payload", "value": "85b60f054c2f86c71b494ed5c2db003ab4e8e731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928232, "uuid": "a422d087-f968-4f87-a497-6abab3d96065", "comment": "Malware payload", "value": "d5504708a0f0ad0f715850356ed068c31e21735a2ce3a1046fa990c68d4653293765738f9110fa438c780e1e0817ea10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928232, "uuid": "9d2dfd7f-5840-4956-8ae0-7052b0837370", "value": "T1BED58C32BB049132F5D211F1981D1B6F894C993403B940D7E2D67AD929E0FE36B36BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928232, "uuid": "09592ab5-2e96-40fe-acdb-2ab8f7e5793c", "value": "4825ef56a06f7fb58d67dc608871939b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928232, "uuid": "337e6e42-0e7f-4a17-968a-5c912188d144", "value": "49152:VN8HBrq0eKtmrma5wB7Uzq+UVhsuAYfzgGele5wDUQ/Vh:P8H1qBYIzq+UVhsuAEYle5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928232, "uuid": "7aace063-778b-4753-a49e-ccf594a10039", "value": 2819072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928232, "uuid": "04555e02-725e-4ffa-a7a7-2bc754cdd08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928232, "uuid": "8edf8003-f76c-46b9-8b39-e53db8c4b50b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fdd876-cc90-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679915681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915681, "uuid": "0da85282-5370-4e47-9404-fa545d2f8b25", "comment": "Malware payload (GuLoader)", "value": "6110a44ed03fe3be9bebb860417d81f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915681, "uuid": "7f066594-9b3b-49f0-a3b6-42e380ce4ac7", "comment": "Malware payload (GuLoader)", "value": "7ad5d6556bce29cc5fc40ad9a797f1c8981403653e05b34cc748f6aa95d20250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915681, "uuid": "9dfdd03c-5c04-4da3-ac53-005236990635", "comment": "Malware payload (GuLoader)", "value": "457326af3b33618ec1aafda523d7e25cbaba7e08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915681, "uuid": "15dd360a-f334-43b9-a786-9d871137f93f", "comment": "Malware payload (GuLoader)", "value": "34e250651c3a1efb698dc0d79ed102f3e717680290ff7950a5947cebe1ef1f02deb33a89346342e340511e91219438c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915681, "uuid": "a96344ff-380e-4988-b90c-6689fc7059ab", "value": "T1A7D4D092720098EFEDB60BF048A7CB1566782FB5D9E6102F37CDBB2D20B37520527956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915681, "uuid": "7c870888-f8c6-4d76-85f0-94f91783ba55", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915681, "uuid": "c56481c9-ec34-41ab-af74-f6cbd2f96a42", "value": "6144:R92Nj7FNKuggE/ZsIMg+Emf5U5+G4slLVcHMD2dPxYMkX+ZHqXsOGAk5qPHVj4YL:nsxupLVcu2R2MkNXshNhYUjb3nhhhSB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915681, "uuid": "97df692f-c890-4239-9db5-5165e796c7ff", "value": 613352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915681, "uuid": "a9c911aa-9916-46a7-8772-cb3e7e1a5722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915681, "uuid": "906b05bd-cb56-4c69-9321-a17044ecd849", "value": "6110a44ed03fe3be9bebb860417d81f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72c3a3e-cca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679923984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923984, "uuid": "b06766c0-0ea5-4c64-97de-f81fce3f13e8", "comment": "Malware payload (SnakeKeylogger)", "value": "6215c21244930ce9ada085fa2b057a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923984, "uuid": "c4c07a1e-175a-4e2d-951b-be6865977b6f", "comment": "Malware payload (SnakeKeylogger)", "value": "7bafa941839aa64bee8e75e02d68b800d0dcf5f19f981eae5eade5b99d657de5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923984, "uuid": "eeb73553-7eff-47fb-85ad-6bc9cbb0fc81", "comment": "Malware payload (SnakeKeylogger)", "value": "8bd872b4b8d9f03ad26ed7c8af2993d2780dfb4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923984, "uuid": "65913839-ff23-401c-9b1a-e0e69f2ff453", "comment": "Malware payload (SnakeKeylogger)", "value": "07bdc5c5eb1705806fbfffebead618eb643c6c3c3bfbada712a7def7e684650a298f835ed632b4310e27fd5ddf57e00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923984, "uuid": "4db66dcf-a1f3-4232-8d50-ad8dcc09d0bf", "value": "T1DAF4E001CD7A5E35F8E5D3B41160173A07A8B7A12472E2098BFA68DA3DDBF6305E194F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923984, "uuid": "33edb968-2d3d-4b66-a0aa-59fafbf6e0b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923984, "uuid": "66402605-66ad-4ef8-82a7-73b9e21a9ec4", "value": "12288:l2y/EHTNu6DQlI9ZE0ml3iOpttWsYXePKUU6aeU0Kmt89Zwd8:l2TXUhZiOttW7MIVfZG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923984, "uuid": "af34aacb-cc98-4b43-b83e-007a027e7a36", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923984, "uuid": "689a6c2d-6d68-4b73-8072-891a256a2d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923984, "uuid": "6e6d24ac-966f-480a-bdab-ef8f54d41d2c", "value": "MV TBN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f62610-cc76-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679904655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904655, "uuid": "6abce4f3-8968-436a-b480-f25372e68f6e", "comment": "Malware payload (CoinMiner)", "value": "0ba4447a07a7c2c63cfe7aa69173ab6a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904655, "uuid": "7b7b4d89-38e7-43a5-909e-c980341c18cb", "comment": "Malware payload (CoinMiner)", "value": "7c3bd96cd755ebe1e700c2b578cf83e88d10ce2529213c5bccf2def62b5a6474", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904655, "uuid": "80460df5-690d-415d-a8b2-be2696aea75e", "comment": "Malware payload (CoinMiner)", "value": "00273726672ded3869e15e24e09ee1053f547f0f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904655, "uuid": "e21e12cc-be09-4a60-abfc-c85bf7ce468a", "comment": "Malware payload (CoinMiner)", "value": "d6e0d62dad07991bd4425011eba45104a45d1396bafc22b856f4bcfb881bda800868f692c02faa0eb90d59e48304e2f4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904655, "uuid": "5b57cea3-45fb-4d0b-8cd9-7753bdf6cf8b", "value": "T1B044CF1276D1C872D45A81384820C7F46A3ABC71BB5986C777847B7E2E717E29F39382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904655, "uuid": "0056b38e-07bb-4ca4-9b05-e9e7080a20ad", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904655, "uuid": "844f1273-2491-4aab-8a76-e506e21af64c", "value": "3072:cypgerGfQDgLG96SFeQYWxK14YrLLKzxR/yrhIfD1lBqlb2PDFgvRs5xbBo2+:1xDgLzSHYKg4Yr0bTlm6Zto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904655, "uuid": "df35b6fd-0b6b-400a-a0ff-3699d2065b75", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904655, "uuid": "58e41882-7f61-4cea-89b2-d66d1d15466b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904655, "uuid": "b22b5be4-2915-487c-a080-3b3175b7df7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b87590-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894907, "uuid": "72f551ae-7ceb-45f0-8d0e-eabb80fe6b11", "comment": "Malware payload (Formbook)", "value": "7f453b503f828a474ca684b065498d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894907, "uuid": "60246cd8-e735-4f42-b1c9-60e7e84a34cb", "comment": "Malware payload (Formbook)", "value": "7cdb9e0fde39ad1578dbd905a88c8b6492a608349c0fed0c79879f5a086108e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894907, "uuid": "b54809ef-2950-4d81-a448-3055766f4fc9", "comment": "Malware payload (Formbook)", "value": "b82a91e97e1c0a23b993db56f9f6049a96580b34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894907, "uuid": "7f18ca6e-aad8-4c15-a4a8-d05eeb47fe8c", "comment": "Malware payload (Formbook)", "value": "e7ade0ea1ea33d3c6e7a1eb9075c34a907690f6dfcf0f7911f33a38bfc7266b6af62a915456b8b99821fb7050c70bf6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894907, "uuid": "25953537-8c85-4169-98b7-d8e2adc91dbe", "value": "T192541281A562C53BE4B31B700F2B53456F36EE25B668C6074381AAE97DD1F028C1E77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894907, "uuid": "a084dc1d-2f55-4efa-9171-32b750a97f20", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894907, "uuid": "9bea3060-f7f8-4e0e-a997-ef43d87509da", "value": "6144:hT5Uzm0s9s3LWwHCZwX+A6UXqc0LrWK5OcraEUq2YWPOjJlaq8+:hT55Ns3LNi+uAz6c0LrWSaxHmX8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894907, "uuid": "14cb434d-4e0e-480c-9036-287aeb1d6369", "value": 293312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894907, "uuid": "2ce98920-7c83-4be0-ad71-50d1c04b0ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894907, "uuid": "e7e79ab8-4ce9-4022-a942-42ba9df7687c", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a02fa6-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904946, "uuid": "3af5a9ff-f0da-4471-80bd-3a8b1e07f27d", "comment": "Malware payload", "value": "2a876878eb744982978d6fc5228b6316", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904946, "uuid": "b4096483-1843-4bed-9f29-5000c974afcb", "comment": "Malware payload", "value": "7d574958aa9f19ed8177ed91a0d9a1c0e222fa749046239aee7ff326880ea230", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904946, "uuid": "18573f4c-86ca-4c45-90e2-d1b828bb21c6", "comment": "Malware payload", "value": "6d01b2eddc73cda76aa99222f8a300c3ee26719b", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904946, "uuid": "5e45ec89-5159-4811-b2e5-c3d9bbd2bb00", "comment": "Malware payload", "value": "be1a4563fe00fccafb08d734a627369af23f09446282e92a3a6630f52446e18f72a64cde1b2f5e203e1c1d30f4340b2a", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904946, "uuid": "c7bfee18-7801-4c40-8c87-e9df019dea26", "value": "T1B6118C1A7D6FDA1B433FD7F451B1500CD586D4916208BA2923E0F54FA25DD710F9628E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904946, "uuid": "994d1e81-884c-46a2-9bf1-f5c24e79c519", "value": "24:kAx2kGRV56FnMK/l/4/7Sw/699Ku5K/3n4/rh/6XMCG:kuqr56JMCwSvPVcikcCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904946, "uuid": "11f2d8af-ec06-47d6-b843-69caacde1c07", "value": 863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904946, "uuid": "f0bf1eb3-9285-4a34-92d9-bd346b85a7d3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904946, "uuid": "4edbb28e-fc40-49a8-a460-d619b8a2f9dd", "value": "doc(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7d55bf-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679878144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878144, "uuid": "c449ae06-37e1-45d8-a1be-374d9cbc7e04", "comment": "Malware payload (Amadey)", "value": "ebbb6676bb7dade3d3021b6bcb74cec7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878144, "uuid": "fae48cdf-954f-4a7a-80f9-87eaa1141f9e", "comment": "Malware payload (Amadey)", "value": "7d9a20548913a2ff76dcfa24bef12ea8fa4ae2bf4ca52111ad0082f6a308ebd5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878144, "uuid": "84b44367-f47d-4f3e-89e9-9c236bd95cca", "comment": "Malware payload (Amadey)", "value": "2a377985f4994c38943602c9d0940f0f00041076", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878144, "uuid": "3782a4ca-7c36-4355-a124-3247b0daa488", "comment": "Malware payload (Amadey)", "value": "7352aa773940cef1e0d7b6175fcda3e6599a89ca3577b4799f173c1cf9d68c6c1f212af5d4f9c2f36b223db717500c99", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878144, "uuid": "3b5f9938-f1a0-41a3-a4be-44d82f629893", "value": "T199446D2E93F87820E5774732BE2EC2F42A1FB8215D177B5E2649AA3F0970762CD61705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878144, "uuid": "85912157-e267-4f86-afb3-ee78b4e7cfcd", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878144, "uuid": "9089af7b-5ab7-41e5-b2ef-765f25f8d24a", "value": "3072:BBdvYPA+xFopFT7GWnm+F5qBky7HtpsJa5fO6eoNdKeHn78F:SPbSpFTaWni7NpJ5fleIdKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878144, "uuid": "a1baf8f1-1457-44f9-ba50-94763c26c30a", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878144, "uuid": "0e4336f5-39a1-41aa-ba3e-65d45447b695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878144, "uuid": "7c438eff-260c-4743-8826-ff8eed3d0c04", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafc7298-cc39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1679878357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878357, "uuid": "9cdbd37f-a7dd-4e90-9a7a-6af296652f72", "comment": "Malware payload (Adware.Generic)", "value": "288d7d66024b6562feeb4d6baed41849", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878357, "uuid": "75ad30a9-6a2c-4729-a894-36c7ee13c23f", "comment": "Malware payload (Adware.Generic)", "value": "7dfffd124e41f73e266f806951457060dfff9950caca0fcd1c542ff5e9a21e34", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878357, "uuid": "5df79514-2c89-45a3-a97a-4b69a416cf0c", "comment": "Malware payload (Adware.Generic)", "value": "cb9efb823a462d1afc8057839fecd224d661102a", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878357, "uuid": "af8a6fe4-3c93-455a-b9d2-78cd9830739c", "comment": "Malware payload (Adware.Generic)", "value": "989e1e6dda1f59d4f80b9ee7df923dbc6cf908f3ba27fec5dbdd23231d863fbadb11a5b5794e17ec15c240025c1e00e8", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878357, "uuid": "44f11d44-d37f-45bf-bce4-895f13b7b193", "value": "T1D8561267B298653EC4AA27350673A05058FBA6ADF417BE1737F4C48CCF761C00E3AA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878357, "uuid": "e9f44685-7af5-4ac3-8803-dfb034cd18c4", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878357, "uuid": "aa287b3f-d49c-4a56-b59f-1190b9cb8408", "value": "98304:LX44Xe8aIUM7LhfXMObVARKlsZjLusEBHYCzg1OnW/T+1zS2owMVMowF:7VXeNIUuWObuRKIu5Y0CozSnw7bF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878357, "uuid": "b0ce81ac-f926-4f68-a9d7-bcf4fc577ca8", "value": 6120168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878357, "uuid": "b6f220f6-65ba-4ca8-bfde-5f0ce1114a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878357, "uuid": "d1f401d8-f9de-413a-9766-61fae38ea672", "value": ".............exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc4557d-cce8-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679953577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953577, "uuid": "77bf2947-a3ad-4c0f-8a5a-952d92e3e2f7", "comment": "Malware payload (TeamBot)", "value": "ee40e5a1a1eb7e93fdd3a953379304c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953577, "uuid": "5669a65b-8aa3-423b-8003-7b1e0873bc54", "comment": "Malware payload (TeamBot)", "value": "7e6ba21c2fb7f3f4a422504154c7be3e72380d8770d69fb25eb3a547a6d2ac7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953577, "uuid": "9866ab1f-7ecc-4c71-82e5-739e6bf5bf8f", "comment": "Malware payload (TeamBot)", "value": "a08edadb458325b2b94544af76a710dad836c918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953577, "uuid": "5f0479c7-d372-4f8f-8f41-09db407d7ae6", "comment": "Malware payload (TeamBot)", "value": "fab0f428985ab87bd64a7b236048516d18082d3bf20a6b6033b1c5f99b885930017461b6f17e590a564b258709691323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953577, "uuid": "5d31e92d-463a-4486-b9cc-e5f7455fbc8f", "value": "T11D44D022B781C4B2D51B05B54815CBF96A3678704B3986CB3B58D6BE1E313D2DF3A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953577, "uuid": "41416a0f-c9aa-434f-8001-f408d1196c97", "value": "d233995a591f0c21b167474a8600ae08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953577, "uuid": "6c4b591f-5ecc-4581-b2e4-2c67f2006274", "value": "3072:jj3PRHyKIQ2k9LHG7yJpWbFgFM5vS26lrsWaUQXT0wXtw+htprMx2OdL5k+PCU3k:n/5yKck9LmDb+5lVaJD9lhtpg7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679953577, "uuid": "84c40b14-5133-4a7d-a7c0-ec8fac857c11", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679953577, "uuid": "98771430-cbfe-4bed-9e5c-8454a65ceb90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953577, "uuid": "7a72ce94-148f-46dd-97af-b73f9d4ce782", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fe5fdb-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679913220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913220, "uuid": "493d55af-4b6f-4c16-a801-5a4f3556d276", "comment": "Malware payload", "value": "11011c11c284a1f939018dc7a98adb4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913220, "uuid": "0503545a-ee4f-4ded-b311-e0ac5454c1d9", "comment": "Malware payload", "value": "7ea76f2e7c4572433ace0d56def0430da5006cb0324f94ea949e6d7ffe728c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913220, "uuid": "4f323dcd-57be-487a-b09b-479b295fa7d2", "comment": "Malware payload", "value": "17d605b778d1b09d040a576dffe0194a9f8234da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913220, "uuid": "74f11c13-8429-4a41-8cef-096fd81c154c", "comment": "Malware payload", "value": "7b9b58b08c1b6629d01092e371e7bcf43911901b4dbdabc058e9d2d8d8bc2a6b7166d11a497bdead14a882f78109c4dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913220, "uuid": "a402cc42-627e-4c90-b6df-79e86d2c63ed", "value": "T19F760807E99240E8C0FED174C636A223BA713489473433E76F619AB11F66FE46A7D364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913220, "uuid": "e13c10a0-5aa0-4405-811a-37e3a5030500", "value": "49152:K5hYo9ia8wWm5X+rb/TvvO90d7HjmAFd4A64nsfJwlydpRkeTo22Pqd3mEVez+zy:JvmmcknTucGhl/v9bDFVgICz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913220, "uuid": "2b641709-913c-4942-8cd6-903cbdae8764", "value": 7273066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913220, "uuid": "98c28eb1-8368-421e-b078-450b5940013f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913220, "uuid": "2c00a671-c96d-402c-a95b-a69cc645b670", "value": "11011c11c284a1f939018dc7a98adb4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285f2ee8-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894888, "uuid": "b4014d3a-835c-4528-9ae4-87283fc2990a", "comment": "Malware payload (Formbook)", "value": "2751d4a631a88c9ebe38e0e53737575b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894888, "uuid": "262981d5-65f2-4efd-807f-f9c40d029669", "comment": "Malware payload (Formbook)", "value": "7f8d1823d07c98a5ea6e9d2848faf940231df09568b4fee525f18ea59d6094bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894888, "uuid": "7b877918-e40c-44cb-8a15-1fec9ab6c2c7", "comment": "Malware payload (Formbook)", "value": "cb7aae218282f22021ca5857059fe0e7f93e7c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894888, "uuid": "a3015108-c1b7-442a-9969-f0821123270d", "comment": "Malware payload (Formbook)", "value": "87120e940992a2e89e24c8e9c962f1a1478ba83cb34f7de0f4bce7073ba9db57ccf247fdb79dc33bf1b7ee974efc0119", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894888, "uuid": "55c4cb46-0d9b-4f4d-838c-4bc188e30d1e", "value": "T1B704AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF0995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894888, "uuid": "86515480-2798-4741-ab9b-136165c1a6fc", "value": "3072:/8QnUQwBFKRujtBxb7ZMcR0j2Rg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:XNFuHl7ZMcuj4K9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894888, "uuid": "45e1afb1-45cb-4f53-afe6-144f433c78bc", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894888, "uuid": "89b3c394-523c-4c7e-998c-87e5cb2d9614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894888, "uuid": "42e10081-a639-4f4a-8b2f-8101c8928a9c", "value": "7f8d1823d07c98a5ea6e9d2848faf940231df09568b4fee525f18ea59d6094bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f205af-cc84-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679910619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910619, "uuid": "015db4ab-1f12-427d-91ec-0fa9d93f344a", "comment": "Malware payload", "value": "e75ad8ea02a3e1dd1c33593394eee750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910619, "uuid": "6325a3fd-c4dc-4bbf-8018-cf7cb8110567", "comment": "Malware payload", "value": "818f62189c2eb790718f547dab81018ead3a70064bb891fb54667f0a2e474910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910619, "uuid": "6dacc4b2-5f68-4698-828b-e7b4a8ecaefd", "comment": "Malware payload", "value": "c6af8fdaa3d8bfc417251d4774a445f9950509ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910619, "uuid": "bca8763b-0601-43c2-b171-b690fea34e59", "comment": "Malware payload", "value": "5cbc2cb559e0296fa04e3898b4145a9e1704020b28c464d08a791025b594364668051c1a997319dbc80295f46f0de8dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910619, "uuid": "3c0e2076-3f3c-48cb-960e-708b4a09d0a4", "value": "T15665BE4267898251C3B35173BB51A7627E6B3C253661B4BA2FB83D3FB570C53831A623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910619, "uuid": "09adf214-503a-4bc4-9faa-fdd98170f5dc", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910619, "uuid": "02ccdbf3-eb7e-4373-9a2f-6d640d631d60", "value": "24576:Q4lavt0LkLL9IMixoEgear/AFCVrUTvbjN7bJs4ORHnEBpq9MmCS:Hkwkn9IMHeasUrUTbJFORHEPaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679910619, "uuid": "54158042-ab33-4c93-92e4-c0c475e14b27", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679910619, "uuid": "44563013-2d47-41f6-8a1b-e24eecac6460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910619, "uuid": "1e395688-9bd9-46c3-9db5-4b4c96d618dc", "value": "Supplier Lists Requirement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48960f72-cce7-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1679952924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952924, "uuid": "11ea0edd-5477-44dc-adae-2fdb53641c40", "comment": "Malware payload (DCRat)", "value": "a0fb4af03514fe70e036bbea624ea81f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952924, "uuid": "a9c461c7-90a3-4971-95ee-649b6ed2a423", "comment": "Malware payload (DCRat)", "value": "82b8546043bca13cf187119fb68cdabd9ffef9688e16eaff06211d52bb36249b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952924, "uuid": "c16defe8-bc82-41ff-9f90-9163a1f594f2", "comment": "Malware payload (DCRat)", "value": "435f3ef79e360d89cab884e990a558722c9ce272", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679952924, "uuid": "125966d1-ad23-41eb-b8d1-c81de4335304", "comment": "Malware payload (DCRat)", "value": "43d41fc059efa95a9e365d4b6057cfe7671eed8a8b8fcba5926f5d6ff504cb613bcc7eb671339aaeb1ab67bc2a0961d9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952924, "uuid": "f58f7951-038e-4494-84f1-24a236fdadd6", "value": "T137757C017E44CA22F0185633C2FF455847B4AE142AB6E71B7EB9376E66723927D0C9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952924, "uuid": "8283043c-5ef5-41cb-86e9-9a3d6dd067b2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952924, "uuid": "d199171d-960d-4cf4-9ee8-0a28ad2719fe", "value": "24576:B2G/nvxW3WQnkHnDIlJzbBA5clWJG4kQy0ohgEGdHKK5Cu8Kc9mfCQbZ8/zARp:BbA37kHnDIbzi5MWjmuHNKQbi/E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679952924, "uuid": "905bd20e-0dd2-4700-b238-8bac56fe47ca", "value": 1638073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679952924, "uuid": "a2cdff67-2a56-40f9-955c-122538193616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679952924, "uuid": "3e5893df-41ae-4e06-b7ca-1cc18f88733a", "value": "a0fb4af03514fe70e036bbea624ea81f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d6fe0a-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679912948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912948, "uuid": "cf9ad119-baa4-4d6e-b5ce-d2ac798c63f9", "comment": "Malware payload (GuLoader)", "value": "892c52f192cb1905afbf9f09d8c1bf38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912948, "uuid": "f5552e48-df1f-41cc-84ed-2e66d498b3a2", "comment": "Malware payload (GuLoader)", "value": "83104e0cf5b8f50ec9724e7a27ba87ef39ecbfd81d4f456d42b7fd06fd9c28e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912948, "uuid": "418f30b4-278e-4078-90e0-2c05a850d3ff", "comment": "Malware payload (GuLoader)", "value": "623c6e347b5ebb0c788fc0a4bf39e6a6e690b1e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912948, "uuid": "9cc2190a-5bfa-4d15-83f4-a4efa1432966", "comment": "Malware payload (GuLoader)", "value": "4d3a7c56f15a8bbb04679679d23b69d206f4ce989ac730921082c0b801df01e40a282ca4c0787cd2231c8c839ee0e22c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912948, "uuid": "e59f0a17-6751-483a-b25e-f896fec3790a", "value": "T15554121B24A8C4B7C9E287351F7E0FA5DEF5CE6470642B8B3B013596B63BA80515B3D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912948, "uuid": "08b197d2-e614-4fb3-9ace-9e4e0f909948", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912948, "uuid": "970383ea-cf06-4a31-b93a-5d60823282d3", "value": "6144:H6+/tVm/dXDf5kRHVUUTbPQYO4BevqKe2u4Mw2t10uqVrYT4YezDMloPLbQX:Pnm/BDf58VUUoYTFKe7pbqlYT4YeGA8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912948, "uuid": "85a19142-6f62-4e11-bba9-a0dbe477ee9b", "value": 303073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912948, "uuid": "ea914c86-5485-45c9-ab88-040569f3e288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912948, "uuid": "eae0c88f-cde1-4880-86a8-7712ed827033", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31259b83-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894903, "uuid": "3438b0d3-fb27-4b8e-992e-3ae28def09ef", "comment": "Malware payload (AgentTesla)", "value": "e0c45d400db29784783e2316b374ff77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894903, "uuid": "6e930142-3025-4541-903b-f161528b06a2", "comment": "Malware payload (AgentTesla)", "value": "838da2512944be79f9adfe7c9091e4e3c9c743994d43fe1412659d9e2896c968", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894903, "uuid": "253ea9f3-f2b1-48ee-93a9-5e59cbb34cc1", "comment": "Malware payload (AgentTesla)", "value": "3a58155a4193d7fccb84b8b8c683c9e8468d0c7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894903, "uuid": "a7165239-8c35-4c26-a079-d38db083d39f", "comment": "Malware payload (AgentTesla)", "value": "4e2b3145a7398dc8546c1b2458fdfd5821fd0d4858a35fa923b31d08ae7f0b7a0a81d2e4a5b281487ad05b4c803f0b1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894903, "uuid": "3f3e8909-230f-44cb-815f-f1492bcbd0e6", "value": "T14A05DF59AD3E1873F8E8D2F455501B7A03B8BB911061E2D98EFA58DA3CDBBA305D140F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894903, "uuid": "1a97870b-5aa3-41a0-8c3a-329f9a6dba8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894903, "uuid": "b245e077-21b1-47d0-bea2-f9a2539d95c7", "value": "12288:qXsZwdG+dVkliZq6sOtD4wxlODoMV/MDFwv4GLLJZTQIQfT3TFXl3J5dIEYnvoq5:NZGG+Rxd4eluLlLdeIQfT3x5dN2voq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894903, "uuid": "3f7b48cc-8590-49fa-b0e7-9834fa8a3ef1", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894903, "uuid": "6798e00d-c571-498a-a1c1-cd4f2580281d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894903, "uuid": "8913d4f6-8f72-4151-8d27-afd907d76cde", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5b2b9c-cc38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679877956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877956, "uuid": "7a77627b-2906-4d8b-8db4-a570b4bc63b0", "comment": "Malware payload (Smoke Loader)", "value": "b1985baf3383037b6edab29cd6db7912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877956, "uuid": "607da764-9663-443a-9a76-92b8e7def7dd", "comment": "Malware payload (Smoke Loader)", "value": "839d4a9b22e09a6f64a90ccd7cfd2bb508efab74aa5bd8b10e75f3b583ee87f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877956, "uuid": "468ffeb4-853f-4150-8027-45f6921f8074", "comment": "Malware payload (Smoke Loader)", "value": "fbb82c2042c003784cf3dc3776a3edf0d662ed43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877956, "uuid": "aa140654-b098-46c5-ab07-71280e231b01", "comment": "Malware payload (Smoke Loader)", "value": "7a2d74f9d72129c2c98ef845ce80c165a80e740a02fd73645ae9db92e55d04799581bf96afd851d1bb81bdfadbe334fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877956, "uuid": "49056b93-3823-418e-9818-9689fca2ed09", "value": "T1B4448D1E93F47860E5374B32BE2EC7F42A1FB8614D177B5E2659AA3F0A30661DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877956, "uuid": "5b9380cf-9873-4a5e-ae49-05ccd97a6738", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877956, "uuid": "ad1770af-1a00-41d6-b1cb-e3ef2d99fd1b", "value": "3072:GqcD9BA+lFqBQSJtkyR+LawBOH+Q5zKqbLxcO06/zmoKogu1cMn78F:iBPMBQSzkyXH+Nq3eOB/zmoTl1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679877956, "uuid": "f22481d9-65a5-497d-b9c6-c69884d12f5b", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679877956, "uuid": "53321d09-8a4c-4854-8033-c8a19a29341c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877956, "uuid": "35b068c2-a335-4426-b599-6ca695429d9c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3815637-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904973, "uuid": "3a6055da-fa0d-440a-8dfc-8b85cb984444", "comment": "Malware payload", "value": "dbaafddd62e8880e074d25d56f1b8eeb", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904973, "uuid": "c1b6c391-a4e4-4a40-9519-e62d842c0ffe", "comment": "Malware payload", "value": "84bf179cf928c716bf6f7b0aad97772a56159abdc39e8ba8c4993cf5c45e457e", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904973, "uuid": "cced9535-38a1-4e2d-af2a-c450730844bc", "comment": "Malware payload", "value": "74133271577329144562f9cdc50c8b1698b401b7", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904973, "uuid": "f814c5a3-c9c4-463e-b960-15b652e57b9d", "comment": "Malware payload", "value": "2736e6de7e521561007467b6d87a271ab7be4d9e99a7cef21a02a8e82edc93d259b03178a09f271d505c20593adf10d0", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904973, "uuid": "4245cf82-944a-46c2-bdd8-0fd141bc8c3c", "value": "T1EAE3C4C035E980243AB13F70C7B55A5D1637BCEA9C7A56197C88AE4F3792D48CAB2734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904973, "uuid": "88a3856e-7dd0-41f9-a636-a14988a76a65", "value": "1536:j89r/aDcWJwG0mtvR/Eg5dfT1Ph+9PEa6UJCw4GEMofk0i:Ktci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904973, "uuid": "08cb4599-e11a-4b95-9d4b-922059d2e926", "value": 149720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904973, "uuid": "8b60b18f-018a-45ec-981b-a8b09b31b6e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904973, "uuid": "8ea34a22-ee3d-4d75-9a80-a8969aea02df", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353f2658-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679894910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894910, "uuid": "d641f608-846c-4672-8dd5-907361e2873b", "comment": "Malware payload (SnakeKeylogger)", "value": "70ee8b692e67cb2d4c9ef93b9a80030b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894910, "uuid": "e14af13f-8813-4cbc-ad59-c2c5b2fbcca3", "comment": "Malware payload (SnakeKeylogger)", "value": "84e316ba28c1745989fcba630c13792daa4286bee90d828d9eb6e9f36d86f4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894910, "uuid": "6ef17169-eb54-405a-b16a-750f4a09315b", "comment": "Malware payload (SnakeKeylogger)", "value": "cbea44f294f7cf40da91470f078a961f9645d6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894910, "uuid": "48e6c8e4-545c-4ec9-bb1b-3372a33f647a", "comment": "Malware payload (SnakeKeylogger)", "value": "9c8f2bf9a99805347f032a4ed0ca4a80abfc03851965f9e20ffaf661c427610cd56d140e569ab2ea04b017b905b3377b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894910, "uuid": "e6b59021-312b-4668-b566-57fbe6f65c52", "value": "T17674F1C2BA01C1FAF93E8931F4AF98178B99BC754DA108DA7754BB4849F22514C9FF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894910, "uuid": "96d64a35-fe7c-41a4-a5fe-db32edb60626", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894910, "uuid": "3d19c4f4-26f7-4b53-959d-3c163204b429", "value": "6144:nQ606xUAK/TxV595DDV3pv/LW9f6Mu18qMnDf0rXkOEjFX59vtoS7FJJcFg:k3LJZ3pHLW9fG3eDfkCx3vtVJncFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894910, "uuid": "dcbf7b33-c846-4c30-8ca1-3c7333cb2481", "value": 348954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894910, "uuid": "77f66668-6084-4e77-ab39-fafbd0eeef26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894910, "uuid": "901ce5bc-50e9-4f24-8fdb-de8c55dc0c1e", "value": "Extraccion_Asepeyo_ECC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cf044a-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679912929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912929, "uuid": "840fd871-0d56-42ef-92e5-7bfc7fe6d73d", "comment": "Malware payload (AveMariaRAT)", "value": "dbaa3eedb475065eb8d88c1e9e04c2de", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912929, "uuid": "6d85c7f4-5911-4df4-a69c-d05ec869de62", "comment": "Malware payload (AveMariaRAT)", "value": "853e1ec7d4d8fa449d88746cab1bfac6074e0d81e9a26ef6948793059e9bd781", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912929, "uuid": "71f759c1-9948-4860-aab4-6ba788af4571", "comment": "Malware payload (AveMariaRAT)", "value": "bd2bbf3940dbfa53ddacba057333c88c77e5372d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912929, "uuid": "af1e1a25-f8d0-4fdd-b066-a708ef680468", "comment": "Malware payload (AveMariaRAT)", "value": "b3b9f35e4af4dbdd21b361385812fb6f859a6824d0d23dad16b52e65233532ea99c27252acb8eb6929649b3a4716a816", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912929, "uuid": "26203f46-6b5d-4f34-b9d9-6df1ba5dabaf", "value": "T14A649D9C21467BCFCF1B87F166AF1C24A77065AAD20E9E435093D0E8899F6428F1D1ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912929, "uuid": "866f92af-f912-4caa-8fc2-c23a80721c1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912929, "uuid": "9910f8f5-751a-4f3d-9110-4862a9422c59", "value": "6144:u8fqDye3NCT8yGjm04y0O12udoEUAaZbyHfI:tiCgD4wldEiHfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912929, "uuid": "2a548fab-ab0a-452a-9fd1-08ed8171dbe4", "value": 315112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912929, "uuid": "d0579b37-3b55-42ba-b382-22b9bd4d0b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912929, "uuid": "6809bba4-a41f-496a-8cf3-872284506663", "value": "SecuriteInfo.com.HEUR.93.6430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7cc0d5-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912506, "uuid": "899a2511-91c9-4600-ab1b-8cb5ea96dc10", "comment": "Malware payload (SnakeKeylogger)", "value": "849c47adca493169ca05d46b16912631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912506, "uuid": "8f0e1ba8-73bc-4a5d-9ad5-38fb7e15deed", "comment": "Malware payload (SnakeKeylogger)", "value": "854b59aa584237418101867e86018d0e0c3e8a588010d8cc8f8850e66b5221b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912506, "uuid": "4401d826-bd9c-49ce-99e9-74a4a99e7f31", "comment": "Malware payload (SnakeKeylogger)", "value": "7149fcfc067b91fa57186d3c0ed0c9056bb59842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912506, "uuid": "dcb3633d-c82e-488d-b25c-3bbe9f9300e4", "comment": "Malware payload (SnakeKeylogger)", "value": "843cd75bb13551895187fb728f10d6c34e9a83b2cc11edf955b6569fb1e58d30331a962d2c1f0611bfc0e69f0f06639a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912506, "uuid": "2bc2fe68-6bfe-4e0a-8e10-54087a4255d2", "value": "T1BCF4F145F3D96722E77B6BF069B08440E3BCB4E66B12D98D4D9A20C790F57008E53E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912506, "uuid": "2fcdb476-d784-41d1-818b-e7472609f738", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912506, "uuid": "887ed18b-2064-4209-86f7-9ccc6e35e5d6", "value": "12288:hA5CB0OqJhZrzJV665IHCzwdvkSCcr/+VQ7CSOqJ7KEk0Vr2IPeiBS8rBy:hA5aWDyaIic1nxGVQ7CTxEX4IG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912506, "uuid": "b9521ebb-8525-4fed-b89d-6db6abf097bf", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912506, "uuid": "9e4c5853-4130-4208-98d2-34b2de1a8f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912506, "uuid": "0b98b9b7-669b-40fa-b1a3-92641a2c5364", "value": "Quotation price list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28501a3a-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679912927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912927, "uuid": "5ddd728f-eccd-4892-a5e8-56864b57c3a3", "comment": "Malware payload (GuLoader)", "value": "7211ccbff4e2557e067609dcbf6839ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912927, "uuid": "ca185ee9-49ba-4642-989b-5c7b194ed93c", "comment": "Malware payload (GuLoader)", "value": "856c3482c119fdecb777d14ef351c90a24a045cf8da8cafbb2d229619cb11bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912927, "uuid": "3ef6a94d-306e-49e4-8431-da5aeb8f5482", "comment": "Malware payload (GuLoader)", "value": "0780420e2f12a4cb8e6f3fb717afba2ea7e102e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912927, "uuid": "767850bb-3c1b-46d7-80df-601ba717e345", "comment": "Malware payload (GuLoader)", "value": "4c64816dc680db096d98dcda17a644799594ebf1ffbb5342473cf2c2ee282c44ca0c0928d1c3d71daadebc8550cdba8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912927, "uuid": "b493fca5-3136-458b-924d-60ddcfbdb20d", "value": "T1DF5422523BA2C573C2722731897F73F6DBE1A86030A0951727995EBEB7BE2C1411F252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912927, "uuid": "a0c5a798-b971-4068-a802-8e16e3dd3d35", "value": "5f0c714c36e6cc016b3a1f4bc86559e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912927, "uuid": "d8a2b4ac-bc68-4ae6-9a9b-f955d31b51e5", "value": "6144:H6+/tV2ye/x3BfF+WL/uVQXXXv+fHLhTySnjprxwPLbQ7:Pn2ye/DMWL2VCv+frh+w9W87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912927, "uuid": "79a8c9b7-d178-4a99-b41c-79f5a6cec83f", "value": 300283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912927, "uuid": "4f4ddef2-3df3-4d74-adba-5ef9b14b8945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912927, "uuid": "ccbcf371-f480-4959-837c-8bb40d3bd475", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80600c34-cc8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679913933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913933, "uuid": "6bb526a7-9c73-4f13-af68-f4988324d59d", "comment": "Malware payload (RedLineStealer)", "value": "a5d1199f350200bef2fc735a8e79f225", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913933, "uuid": "b411267e-e08d-4b0d-abf6-306339ea35be", "comment": "Malware payload (RedLineStealer)", "value": "858a5b8a86221a0f5ee7ef04e6837db21c5cec9f93037ad6009f1c52250ab40b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913933, "uuid": "6c55739c-24b7-4d66-bf17-09eda116dd5f", "comment": "Malware payload (RedLineStealer)", "value": "8d846a6b3ac4aa0ef7e9475d368ed8b343c000c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913933, "uuid": "bc7a1edb-dfb1-4bd1-99fc-0f6ea134ad13", "comment": "Malware payload (RedLineStealer)", "value": "1607ff7610ef2cbbcb7ff09947c379711482ffc23069dc2175e4807e36630491d442ec8c4775b092aba0de9cdf3f1974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913933, "uuid": "7762daa5-4c2b-4900-b0c2-6f5d9b47000b", "value": "T144E412617A90C571D89B01318866D2B9BF3EFC35D711898BB3681B6F1E303A16B6E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913933, "uuid": "1de4f9f8-883a-482b-9f16-da05b5cbc0da", "value": "70b9c76aa3fa9a17cebfd084a934f864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913933, "uuid": "a5287169-2cff-4701-a8fe-cb93a616610a", "value": "12288:TGNYtummB4EOqbovM72A8pog+cf6zfRIpLUewq7Y4bQUefBWe9a8zyuOu:cQm6ExbovWUpJ+cf6zapLkq7dU5Znw8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913933, "uuid": "8599cadc-a11f-44e3-ae90-83de7cf79451", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913933, "uuid": "b634df47-6d28-410a-9ab1-1f7a2978967b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913933, "uuid": "4c59e6c4-3bfb-4a43-9cf4-289309ea6eed", "value": "a5d1199f350200bef2fc735a8e79f225.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dfc16ff-cca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679923701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923701, "uuid": "c7487f59-6ba5-428a-bda6-059a04bdab0a", "comment": "Malware payload (SnakeKeylogger)", "value": "384a95dec71c1e1ed31fdc9ad73a2cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923701, "uuid": "4a95bc7f-fd76-4230-8d91-388238b1b665", "comment": "Malware payload (SnakeKeylogger)", "value": "85ba590703be8d34e03c30174d9998a460e19344f4fadcd85e964a7f3d8a03e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923701, "uuid": "157e6193-f8e4-468d-902d-1ad84e6eee0d", "comment": "Malware payload (SnakeKeylogger)", "value": "2a8ac435a88370321fed8c1b926c2a0776432390", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923701, "uuid": "16f56b13-bbe3-47d0-8611-3669325ce314", "comment": "Malware payload (SnakeKeylogger)", "value": "b6dbdeea6ba35dd87e4caab0142ebbe551db2d345d53023191ef65fc3a4b3c4404d818282aaff22b8f40f632af470ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923701, "uuid": "11e5d522-45b9-4b23-b0aa-3cf005d459d0", "value": "T157F4F158E7D46723E7B6A7F02AB09800D37CB4EB5B46E98C4D9A10CB80F5B104E57E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923701, "uuid": "8c12c115-3521-4dce-8cc2-ad1717a92ea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923701, "uuid": "8fdc69a7-c0ed-4d99-aa92-960fc4ae49e5", "value": "12288:FA5CB0OOJBefPNJSigcqFEVSKyZXV+U2KhMLKnVexXXEnMuI0jtARUiIMso+aSrp:FA5aIJBefPn66vIMZLKnYXVuyRHa1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923701, "uuid": "afb843b5-2cd6-412e-8130-811b570aa352", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923701, "uuid": "682188b7-0778-467d-be11-fa64414abc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923701, "uuid": "4845ed27-e263-4e22-ba05-57d76efcc711", "value": "MSDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cd6e49-ccd9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679946819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946819, "uuid": "db179850-a42e-42c1-b665-e661c0e80857", "comment": "Malware payload", "value": "415b10d78533886b89be01b61bcbbf50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946819, "uuid": "fe46aec2-9d36-44a2-aad4-14102cf80664", "comment": "Malware payload", "value": "862b5233c734d1645ad64a0068d157e61670023f137852924bae189a5e67c5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946819, "uuid": "e2d2a136-37da-4393-8286-790a6f55e7b5", "comment": "Malware payload", "value": "775e7ec1dcd91c6a77b866714031874f69110046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946819, "uuid": "57cb0a64-95b4-4b0b-b6a2-5f86278ac87f", "comment": "Malware payload", "value": "bc76e140005ebac9882ab3ed44ff9566cc3923937fdd62f972caf262e9f056fa35884eea43a8b9b464c2eedf3fc76ab1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946819, "uuid": "b5b970ec-2199-45cb-a344-254b00189e2f", "value": "T1B983E73AE36291B3C812C5BC764C1AD6A53A48B5715DD083BF845B82ACF01D29DC9FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946819, "uuid": "20b8192b-9dd5-4674-8164-c7ab216835e4", "value": "dea7238b333040c9efc51e6ebcf59a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946819, "uuid": "38f0e1ca-0796-4b62-8f17-8980dfb696b0", "value": "1536:BMDb4J5iHi/67i7iHrvI5Z96BLyT/h3djRDLsOfYLowbUOIt/:BMYJ5iHi/67keMf96BWV3dBLYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679946819, "uuid": "c40eba0b-0e46-4b8a-86db-abf6e55f9f66", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679946819, "uuid": "f27d2e50-bdbe-4a95-b98e-d1741d64abf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946819, "uuid": "5582dc10-e83a-43b2-a2f6-565ab0ba343c", "value": "stealc_default.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4b939a-cc6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679900934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900934, "uuid": "202f3ec9-96e9-4bf1-9e0c-053e17e74ada", "comment": "Malware payload (Mirai)", "value": "984e8922d5e6db5356ba3be80890a444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900934, "uuid": "4e3fb754-431d-49c2-96a4-2e426a7b90f0", "comment": "Malware payload (Mirai)", "value": "86325ded7fc1575b86d9a8c8d39c1664bf3ffd17621aa79b620f2d0aa50903fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900934, "uuid": "a9cde6b5-1fba-417e-ba34-86563ac1ef49", "comment": "Malware payload (Mirai)", "value": "89bc13eb2ba8e030e019b806427128e93954059c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900934, "uuid": "b4d4d300-4736-44f1-89ff-068bea88e4f6", "comment": "Malware payload (Mirai)", "value": "c490deb8efbd2e47cf0c62fc920cbc3111696f4cb7dc21099a3af5d6d97b32d771348312eda3c0d91dda11d535c3868e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900934, "uuid": "ab489e99-f6fc-4d2f-8071-5bac12c7c083", "value": "T102534B02B31C0A07D1A31AB0253F5BD197BBEAD022F4F684751F979A96B5E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900934, "uuid": "9f44ce80-2766-4d46-a5e9-0797faca1d93", "value": "768:qkaZjEoakZNRGHRnDmX7Xm+t/MyV8SpXCpEM9v/J9KCrMvuBxANUr6FV+tMiwWad:MvolWm+l1pXgdNKCAWBxANee++bWavF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679900934, "uuid": "44d385b2-ffe8-4680-8b77-b6bcae439878", "value": 62988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679900934, "uuid": "048530dd-2c4b-4ce2-ab59-8dd07e791afd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900934, "uuid": "8cf2589c-1bc3-47c7-8ad8-17ff2bc4d815", "value": "984e8922d5e6db5356ba3be80890a444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adf611f-cc4f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679887644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887644, "uuid": "8c416700-1c02-4b88-8243-fa97dd7c9ab8", "comment": "Malware payload", "value": "38c434e4f3d922c6614f000e052080e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887644, "uuid": "3c5ada06-ccfb-4946-b488-c3d34f9b6009", "comment": "Malware payload", "value": "8672533e265fca8c53d58cf7d64753a5dc1596a705ece819897df03e6cc16d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887644, "uuid": "c51e3bc2-5f82-4380-85e5-1145118003d5", "comment": "Malware payload", "value": "ee913091ecbd8c9815e4c4d05cb62e187117fdd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887644, "uuid": "631b725e-44c9-4674-8c57-f9775aacb0c7", "comment": "Malware payload", "value": "08a2339ee4e590b001d62a1dd7504cdec3d2ca70c699f713c67d07240618f5a649ba9839bb4a94ff903726c2d508c4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887644, "uuid": "417205fb-9aa6-4d84-b197-a1cba2b282d8", "value": "T10BE33A21B6C5C071D4B340B243B8D2A6667E7E72976989DF6BCC4D0D0BB41C2AB36363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887644, "uuid": "2ffd46f4-7e16-49ca-888b-f2171340d8b6", "value": "e93b0fa594d670a466cb6a5c504e254c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887644, "uuid": "a557f3f2-ce56-410a-a289-b0b6fb931881", "value": "3072:jyCId32Q5MsDxVxb95Xwy/S83pRSxMl1vUhAd:jyCId32QH595Xwy/N3zqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679887644, "uuid": "7d0715b8-51fb-4852-9f65-a084283f7e68", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679887644, "uuid": "56bef4d2-4d47-45e4-8796-9a9b925d65b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887644, "uuid": "6c66d960-80a6-463d-83c9-bffd97fe63d3", "value": "SecuriteInfo.com.Win32.PWSX-gen.6286.9067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ffde07-cca5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679924489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924489, "uuid": "8424af79-d3c4-4422-8664-4bfd25b82ecd", "comment": "Malware payload (Stealc)", "value": "1fb1aa6528c4ae7af08eed22cfa079e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924489, "uuid": "c6e5e6a6-7092-4ca4-af60-810419273c81", "comment": "Malware payload (Stealc)", "value": "87314838047125700260d065feaef4202abb6dd60dba26890ce8a759aef3079e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924489, "uuid": "23ba8463-b9d6-4676-bca4-50d06ea1e73b", "comment": "Malware payload (Stealc)", "value": "4aad295388f8e82c635de4c4a6339d90056d91bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924489, "uuid": "2884628f-6c5b-4be5-a049-ad1a28e5542b", "comment": "Malware payload (Stealc)", "value": "2dd7396cff4de9f2e49d2eb7cf8b55b1c6a4fa5b31eaafbb26898063b4751448d6a3f66f1ed2da0f4013880f0f1a4604", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924489, "uuid": "a4b3f713-5dd6-4429-8536-03fa3d7e6c8a", "value": "T1EB44CF22B7A2C872F567417D4821CBB4693A7CB24F558ACF67844A7F0E213D2DE39346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924489, "uuid": "e4092f7d-9254-4ba5-904e-8cf9105eb520", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924489, "uuid": "d8414bee-72f8-4fab-becf-e58b74cc072c", "value": "3072:2F2atoTZIFuRdkYLKdaCeMNckHube1o/NnUfCOxFO3PxSEXImej5q+Dni:WTtFuHkYLSarMNcw2eKnU0PMEXJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679924489, "uuid": "9b1099a5-6f00-4443-ab54-eb485b64058f", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679924489, "uuid": "9cd98dc7-f720-4cf2-aa01-3475c3ffd23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924489, "uuid": "3dd05e86-13a4-4e15-a853-d75c6e6f8cec", "value": "1fb1aa6528c4ae7af08eed22cfa079e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b4444c-ccda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679947306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947306, "uuid": "6621d088-2781-4e59-9034-35a140f39766", "comment": "Malware payload", "value": "db5f1a134988dfac076a910e31529f4e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947306, "uuid": "a5afd4e0-ab66-459e-84ae-67914f467db9", "comment": "Malware payload", "value": "87b500c5525a22471d6b45bc118418b91f8f00663eb2e64c49cc10241a98f08e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947306, "uuid": "a9a6a673-ec34-4c8f-a70c-e57ae56a14a4", "comment": "Malware payload", "value": "c2912218212d1c09cf1f9c711ad2b7d582df34fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947306, "uuid": "cfb7bd8f-2a2e-4542-accd-e34c7e0a19f6", "comment": "Malware payload", "value": "93d025acc409091203e8298e0b405748fcae75cb26a9cf351c775c7a0fbc9ae51cf51a4814e75b29eaa68f105770c2e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947306, "uuid": "6ad4bd80-452c-4237-bb8b-45d94eb57fe5", "value": "T1643533FFE505AF017CB2C2775728DE2FA254B2B6566AB0C03E3D8EC9728115E54825EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947306, "uuid": "6124332e-63e5-464e-a1b7-9220ca0b0ab7", "value": "24576:fl7sYQUPjogDrYz3l4hMAzh8GW4sUXQDddrJQFNBbfz7rUrz0:9sWYDAzhHhXi9QF7jUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679947306, "uuid": "b1233aaf-ee6f-41e8-8297-09f8f69630b9", "value": 1131140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679947306, "uuid": "0c8e102d-7a07-499c-8083-a397aa458e32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947306, "uuid": "24bd993b-945b-48db-acd2-7ae731fd882a", "value": "9772198099.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee94d4d7-cc9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679922279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922279, "uuid": "232cad69-b318-461d-9f10-9e70ce8008b8", "comment": "Malware payload (RedLineStealer)", "value": "ad1ff967c5ea7d2c78e48c2782c59b5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922279, "uuid": "422fbe22-edb8-4a75-b971-818660d5481f", "comment": "Malware payload (RedLineStealer)", "value": "882c10d3523f6e5060248ec72183a1e8fee42122f2688958c3fe27404bb9119c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922279, "uuid": "cb99d442-a393-4e1f-aa78-6bf4245b7f66", "comment": "Malware payload (RedLineStealer)", "value": "8bae7900f4b59f18f8468fd4c979882c2add36f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922279, "uuid": "c75ddb56-c7f4-4781-a704-c6e0561560b1", "comment": "Malware payload (RedLineStealer)", "value": "22d30b95c4078e13daf1a18491053bdbb6c9b8281a546dd5c5e84bdcd19ed1f6ae92fadb82445277a2a0660d1eb35626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922279, "uuid": "bf9f394d-9506-423e-97e5-b40dc9c50a30", "value": "T1D5547DF1C3C74E72F43FCCBECD8F15E6033C9EA159950A86A856AE7C0101499A6A3D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922279, "uuid": "9c742eec-119f-416d-be1f-51d64d312899", "value": "647411109b04481ccb858ac68f47ecf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922279, "uuid": "e192439a-9bd9-43ca-a48c-71b41f37881c", "value": "3072:JxuFjXVCnN9/OnkGZLaSCFy9ChX6XIHGMGyv1whEwr3BpY8eLa0TqlQij/tqgIax:J8ZUN3ALa++q4vvwr3Bppe5qqiRqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679922279, "uuid": "63b06476-09c0-4439-8135-e56760fbf33b", "value": 299120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679922279, "uuid": "220f1ea2-e24d-4b68-8611-f85a9ca5b871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922279, "uuid": "55babf37-d616-4059-87a1-25fe812fe8a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cc1e41-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920338, "uuid": "76eda280-66ef-4715-81af-7592d2a23dc5", "comment": "Malware payload", "value": "aff2a53ed76ff58c8a620223bc669622", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920338, "uuid": "de3b1949-7617-4289-bda0-18e1180c3b84", "comment": "Malware payload", "value": "88b4e9c0b3581690415fec148020383e0fb118b81cc2b47804487182a88ca50c", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920338, "uuid": "bddedc75-060e-4dc8-88ea-279a530204ec", "comment": "Malware payload", "value": "6e701920fe9e1da307d96e129219f0c5b424f072", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920338, "uuid": "f00d0e43-7211-4731-a90f-78a5b7d5d41c", "comment": "Malware payload", "value": "bc8cf1b73b84cc64ebee95916fce306b5895ad36a1f974d99fdac3bac50df0e0346e97b9a62e8c84e656709e2bfa5d16", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920338, "uuid": "b74e3d84-c065-48b8-a7cb-2730c8eee6ef", "value": "T16233A4094C89595B8273B37AEFA38459EF23116303665630FEDCB2061FB445846B2FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920338, "uuid": "89fa157e-d96c-4527-a6d0-46596e94f9d3", "value": "768:ZrWLySTt9EQzQvUrDAg5kC4tz5lFQJ7h45:Z6ySTt9EiQcDGC4tz5lO345", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920338, "uuid": "df5e8faf-509a-4cde-a1df-0857818b2661", "value": 51577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920338, "uuid": "27011f92-a3ff-4551-9584-75792489ff2b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920338, "uuid": "5fca4f5d-d797-4b2d-996f-03280d8fdce5", "value": "jtx57kpR.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acd1dbe-cc38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679877873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877873, "uuid": "8a147bd9-e7a2-435f-b831-159466c89ac0", "comment": "Malware payload (Smoke Loader)", "value": "0c19e28210816be657d63221deaa7156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877873, "uuid": "59868a74-08ec-4847-99b6-29d97ba311cb", "comment": "Malware payload (Smoke Loader)", "value": "88d99420f6cf07f9248df3c2f7d82da4f5f6c9c5662c7077d8da13e7f3e9d27a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877873, "uuid": "43079cbe-5346-4a46-89a3-ba72dcf5333e", "comment": "Malware payload (Smoke Loader)", "value": "b76b404e7523ff6e8b0bb69ac3d36a6d98adba5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679877873, "uuid": "9b496d99-81d3-4361-8912-6339875d4197", "comment": "Malware payload (Smoke Loader)", "value": "771dbac960f8c95254aefd4e0a82dcb712d7e3cb468b8e2b1e46612c019d23ec6a9b2210eae32c9979462f94b810eb21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877873, "uuid": "cde502ee-7f69-4d3d-9bfc-732baf3461cd", "value": "T1A6447D2AA3F46860E1375732BE1AC3F82A1FF8614D577B5E3649AA3F09707A1DD61304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877873, "uuid": "f6b52e88-5216-499a-bec2-688ba8e443f2", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877873, "uuid": "6045c277-9093-4be0-a349-bcefdb5cf184", "value": "3072:13BLbpwA+dFGTOxXqS+jK+N12PBk229RT0QimrjfjBQCid4n78F:twnYTOxXV+j0O229RIQhbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679877873, "uuid": "3aa4a59e-038e-4e89-95c0-f03c8114517b", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679877873, "uuid": "5188d384-5bbb-4282-8b68-e0ea9c687615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679877873, "uuid": "b68b63e3-329a-45e5-bb0a-a070687fa127", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fab6b11-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894900, "uuid": "8226e81f-96f2-4386-92f8-301c2105ab71", "comment": "Malware payload (AgentTesla)", "value": "883f4be15ee1ddecf1d78cdd99296edd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894900, "uuid": "1e057abb-eb18-453d-aa4e-12093041f70e", "comment": "Malware payload (AgentTesla)", "value": "896b104784321949a99e52a771140db071bdf355a1059e3c9af04ad21a6a219b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894900, "uuid": "89ceda1e-f433-4cd2-beb6-d8228e66e789", "comment": "Malware payload (AgentTesla)", "value": "88ed3a70a50ba38faae7c4851ee7ce933ccfac1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894900, "uuid": "53078d74-bb74-420f-80b2-2ae87b53201e", "comment": "Malware payload (AgentTesla)", "value": "af73d9b437352f3b8bbd40257a647a3a5df4398cc8793898f12bc74d93c2065ac33a54e05594218eeabd359c0a4c968e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894900, "uuid": "a7d80c28-34d6-409d-8056-8cc476928763", "value": "T18904BD9CB554759FC827C4B2ADEC2C64AB6075BB930B9793A00345E88B4C683DF690F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894900, "uuid": "9fca882d-4672-4a4e-b844-9d200cf019ce", "value": "3072:C+CDucj45y1lyqigVInOPyVlPQQazZk2K3s9VsI5R8KEdplC0gAm6:CFB4M8gW3azAs9uI4KEdXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894900, "uuid": "a50366fb-c7cd-4496-a968-abb4d0aa39fb", "value": 188136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894900, "uuid": "eb82b64c-8709-4f45-bb5d-1f9defc1b9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894900, "uuid": "17d829bd-b77d-43e1-9aea-b855c47264f3", "value": "Data transfer-24032023-9076789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeff5ab4-cc90-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679915730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915730, "uuid": "353bb953-7f88-4f96-a660-fa39d3f34a7e", "comment": "Malware payload (AgentTesla)", "value": "a2d23b80552b694494d2f07903077d01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915730, "uuid": "ce85bd65-e553-4697-a34b-01cf7075c04f", "comment": "Malware payload (AgentTesla)", "value": "89fc947344db449af06bbd95b6f955a98c06006e742a589689860dd5806484aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915730, "uuid": "c7f3ffb4-26d2-4a0f-966c-acdabe3af6a0", "comment": "Malware payload (AgentTesla)", "value": "8b7157eea917db6ebcea9393f83b1be9129e34fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915730, "uuid": "75c88a3b-6bae-4955-a587-912303f06a1f", "comment": "Malware payload (AgentTesla)", "value": "674f7a766f03409c19d69ec5a7db107e9b3176a45945dc49d6a7a5b24abc14368fbf95e4381c1d73f0426fa7add3d376", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915730, "uuid": "b56b1bfe-26f3-4e2e-b5b7-10338adbb1cc", "value": "T14005122BE6949720D7B583F456D44884E67C39E61BAEFE086D8D30C701F6B608E97B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915730, "uuid": "3ba44d59-6b1e-48d9-8357-86bf071a9e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915730, "uuid": "46b9b672-7087-43a2-9f35-79ffe9741642", "value": "12288:qUJB0O92mtL/PWU64GVqd5V7VmiUeL2HLGLqE8WMbUqyfpDgTFJB0jTSFJhZ:z32+L/PdGVqvxUemMqE8WZRDyJB0nwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915730, "uuid": "8de471d4-7b8f-47c5-997c-79040eee1649", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915730, "uuid": "54c19b0e-98ba-40dc-a831-6d6f92666c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915730, "uuid": "3471e9ac-b81d-4bec-9d76-04ecfbd1284b", "value": "QUOTATION REQUEST 818800369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e04aeb0-ccec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679955027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955027, "uuid": "38002f1a-cce5-47ba-97fd-c0357a39e857", "comment": "Malware payload (RedLineStealer)", "value": "f5dfec931e19e6738eaa2445958ccf9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955027, "uuid": "157fb1f5-15cf-433f-a02a-07d765447613", "comment": "Malware payload (RedLineStealer)", "value": "8a7d599d3de64901276d2d1cc58da339185637929661f4aaa44171905ddaf1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955027, "uuid": "bef1c994-6e19-4b8e-80be-5b54913c4fcb", "comment": "Malware payload (RedLineStealer)", "value": "e6cf70f7b43f4fdf5beb10eacf015df92567e6e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955027, "uuid": "fddcf78a-9735-4c04-bc8b-f8e7e3f20a5d", "comment": "Malware payload (RedLineStealer)", "value": "afca8055761971e1fce02f031c6f94996e59aadb05b6b85a2bc96c7adc52a3e40751b6d68bd9d980d30d330d16b22c72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955027, "uuid": "216bf940-b5a9-40f0-9ca9-a9413eb59f66", "value": "T11D3523856AD454BFD8F0277068FB02A30F367D928D74026A77C5E9AE4CB26C49871B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955027, "uuid": "20a44d2e-5c75-4285-9d85-f38456585be1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955027, "uuid": "ada855dc-a20c-4b3f-b7ed-59a929ec0e05", "value": "24576:IyWnTINN9cJM2QcGEM06FtaJ/Smc4kEAf7RCKypj+XMQoc8:PW0cLlLMOSmWRf7R6eMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955027, "uuid": "7d06a5c9-312d-4277-bef8-ad8d94828c74", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955027, "uuid": "21e87671-f399-45d6-88a8-0288863ede78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955027, "uuid": "efc64bbf-acb8-4ec4-98a8-566598c14e61", "value": "f5dfec931e19e6738eaa2445958ccf9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293815a6-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679894889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894889, "uuid": "cce15c02-d84b-441d-b4c6-44ec2394b2ae", "comment": "Malware payload", "value": "dfa2bb8164a2ad3b72928683def59303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894889, "uuid": "7c84c93c-be87-4112-8d10-1a3e061bd712", "comment": "Malware payload", "value": "8cb49d7764021a0d587b567c444766c952b7a9eea2c62a91e430a5bf905899fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894889, "uuid": "76aeaf97-2235-4c70-afc1-642f2d5c77bf", "comment": "Malware payload", "value": "2632b33825f39b0b75f5456a4d7fdec97df4cf3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894889, "uuid": "853005c5-248a-4b1f-82a1-423e6193d1b2", "comment": "Malware payload", "value": "ea84777c19cdd31914f69bce05fe3d7d5b6a956e0f682a99757f4dc334b1f9b5627b2ff80504bbc137856864d29e9c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894889, "uuid": "21b27f8d-7d1b-477a-94c4-c59438b2157a", "value": "T117D56BD1BB83E551C0E6083084A6A7BDD277FC3139D9661B6253F72F6C702C2AB2568D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894889, "uuid": "ee2ba73d-2800-4bda-8450-0df6c5b30fe3", "value": "49152:3mevC3moe67JVIYvYYYYYYYYYYYRYYYYYYYYYYE3iA7/eFUJN9ojoso2xno1J:WeG/e6oYvYYYYYYYYYYYRYYYYYYYYYYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894889, "uuid": "875e00a3-da77-4aec-84f2-dff43a73d8a0", "value": 2972672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894889, "uuid": "528914b5-e45c-4aea-8245-5a236046578f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894889, "uuid": "b938e300-71f7-4a8f-8edd-f27e83cc69d6", "value": "8cb49d7764021a0d587b567c444766c952b7a9eea2c62a91e430a5bf905899fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66a70af-cc68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679898589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898589, "uuid": "183d9a3b-2d16-403d-9dc5-72ce90f7ece9", "comment": "Malware payload (Mekotio)", "value": "fab766283f85bdbb558d4f4618832b47", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898589, "uuid": "262b42c8-bae3-46f9-9584-8980e7c2a7c7", "comment": "Malware payload (Mekotio)", "value": "8d1d7bdb10d0f436143f74a42b3d8d0235af39deb172711fb429473fefc0571b", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898589, "uuid": "2b4e7b3a-8fed-454e-b24f-2f68a9ae1ec3", "comment": "Malware payload (Mekotio)", "value": "7154da8449ee07c2aec545f6d2eb03fd0c2915d7", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898589, "uuid": "d75aebe0-6153-4f12-846c-78ce70fbb16c", "comment": "Malware payload (Mekotio)", "value": "329f51cdd3dc7f76cc4685a0df46a2164e8b3439ffb28c55f007a6cf2d907061b50136e3b2cac9ba1c2c0dc40c17341a", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898589, "uuid": "bab24f69-ab1a-4ca9-805a-db1fbdf5bec0", "value": "T1911633C117C2C95AC1025CA8E947365F287E88E22032D71B1CFA9F9E7E67EE5C4493C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898589, "uuid": "ff0076c3-358e-4d8a-8c5d-4abc7dc42b6b", "value": "98304:WTF+G2yxiZymroBv6zpu9yabfsF1fWqwQoRxu0tQ:RHyxiZpi6zpu54Yqwv20tQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679898589, "uuid": "1177b4e1-24fb-4c29-9853-097f00992fe9", "value": 4121301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679898589, "uuid": "0542b856-4739-49d6-83ad-9909ae73c375", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898589, "uuid": "bb5d0b49-e677-4aa1-b575-aa7d34ca4605", "value": "ID-FACT.1679898401.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba1910a-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912503, "uuid": "0da9493f-a2d2-497f-94ed-f92e0a3c2922", "comment": "Malware payload (SnakeKeylogger)", "value": "c1020976fd9d1746e27807e1bd7184db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912503, "uuid": "56abf631-b505-4449-895e-7a950549ed93", "comment": "Malware payload (SnakeKeylogger)", "value": "8d568e3e78eaaf4a8a89f03de6ad457c036bf257741f2bf42d6b861f65c5c060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912503, "uuid": "1e1bd4b8-2b0f-4363-8c1a-3cd71fd28ac7", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed66e255a4c8b6a6ce0bdcc24624bb132c51ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912503, "uuid": "ccee772e-bab1-4f30-ab30-76c6af9acfd2", "comment": "Malware payload (SnakeKeylogger)", "value": "24698c3a2d8a5e679520834d9ba53f1b832cd16e82bbc19bf76f793a31f8fb2c73ebfd4bcde360789d4cd17ddb8e1833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912503, "uuid": "a398d618-45b5-4019-94d3-1e42a2202edb", "value": "T158F4F158F3D46702EB7AA7F06EB19500D3BCB8D69B45D94D8D8A10D390F6B108E43E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912503, "uuid": "0d79984f-ce10-4671-b8f1-b8c69c58d304", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912503, "uuid": "07d9fbb9-f26a-4a49-a125-580954feb8ea", "value": "12288:0A50B0OxEHVDJQLUY+wv3zTVSPhgKhD0teGkZJm2MxIL6yjGrgewPDj0UNxx4dXv:0A5cc1D2LUjwzR+gGQtNkZJmEL6yjGEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912503, "uuid": "9151bd28-5ebc-4da8-988b-e58c16c9da78", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912503, "uuid": "28234f4e-c44d-42bc-b7a6-fd35066e3a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912503, "uuid": "8be389e2-de1f-44c1-a1e7-7143059abb0b", "value": "c1020976fd9d1746e27807e1bd7184db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf2c845-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951509, "uuid": "95b91422-f9d2-46a6-b60f-a123f020912a", "comment": "Malware payload (Mirai)", "value": "3ab3f4de7a9ab95a52f4b1fd5fc84959", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951509, "uuid": "c4f4f998-5136-4299-a3c5-e7fcb267e8e4", "comment": "Malware payload (Mirai)", "value": "8db3c562d0011c2d9e12b7141d2c35ac1702c6ff538ca220eb10a4709f4c12ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951509, "uuid": "66530ba7-590b-4bfa-875f-e62bfc7bee6c", "comment": "Malware payload (Mirai)", "value": "4e7c175d9d6aef856fea1543412810ff6063ae3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951509, "uuid": "04aeee4d-896b-42b2-a918-972d88177b32", "comment": "Malware payload (Mirai)", "value": "64f88bb6368206186b1351fdd7bf4ab9037b9380da2e2dc20261734fb573d6dcba6da99a9a4943d1800979aee9ccd3d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951509, "uuid": "b25fc226-0650-42ab-95d4-ae41e5328d83", "value": "T15D539EB5C5ACAE48CA1441B8B554CD399723A408A6E76EFAC647C796840BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951509, "uuid": "d1d453c3-ec43-4774-854c-9b57ce9a8a6e", "value": "1536:PaAtVnz1/mUUNztiYmW6KhiYL/zK3ZmDfJIDtEJ7JC7:P/tVz1eUUfwN8T/zKJsxOtEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951509, "uuid": "3b839752-0da3-46ca-96c8-3d13f9c37ca4", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951509, "uuid": "e2e292fc-1c40-44bc-b193-c0dc220608b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951509, "uuid": "8c8d97ba-468b-4263-9979-09cf6b27874e", "value": "3ab3f4de7a9ab95a52f4b1fd5fc84959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0903026d-cc8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679914163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679914163, "uuid": "521ad33e-8b10-4ea9-84ac-bc4ef87dcd83", "comment": "Malware payload (QuasarRAT)", "value": "2033c35ec94ce0d61ab4bfa1d34a0bb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679914163, "uuid": "63a8bbc3-6aeb-4fc8-ae5d-375d1aaed57f", "comment": "Malware payload (QuasarRAT)", "value": "8dddf22e96a6a22b5ed6ddcab093052a7f2e5419a8e3edc25eee6fc4a90076f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679914163, "uuid": "b7393f12-f4b9-4f8b-b347-e62d9e407fe2", "comment": "Malware payload (QuasarRAT)", "value": "b85748cc2e04ebffbc71ffbfefdafe163415b911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679914163, "uuid": "1ad74b2b-965f-4eb4-ae49-b0ccbb1e2c31", "comment": "Malware payload (QuasarRAT)", "value": "a65e973ef64f9717676528961d05c959745a26cec8b81ff77ead71b28c289ee6c09afc7009f4dec791a8527b4cf8d7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679914163, "uuid": "734dd414-1533-46a6-8770-e1693719a32f", "value": "T1F3747C1373A8E93BD1BD277AF43206144BB1D45BB716E38B6A5855F82C233868E503B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679914163, "uuid": "da98b168-6f6a-4769-9cbb-ee1ef17980f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679914163, "uuid": "947966ba-136f-46c8-88f4-f72aa90e4341", "value": "3072:0crt+8Hiefcu00MKpyDcsvPLxge9CUqcojBHLK9EThSbkKiWAEDjARQfWhk9fedo:02NHXf500MVRoVHLOpb9ihQfL9cOKNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679914163, "uuid": "b3a09b01-403c-46ba-aec3-5c2e6ad136ef", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679914163, "uuid": "6a3f6033-3d6f-4ba6-b364-cb0d1840ed9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679914163, "uuid": "de5421c3-caef-407c-a0d7-b9dbb05f5293", "value": "xwuy0TOcR3Em.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5612a23d-cc5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679894535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894535, "uuid": "72d63d5e-1b12-43a5-985c-20e4639b1442", "comment": "Malware payload (RedLineStealer)", "value": "9dd4d0f2990e6625e1d5cdfc7b56932b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894535, "uuid": "6e210c1a-bf14-4040-be45-cbff8d92786c", "comment": "Malware payload (RedLineStealer)", "value": "8e6cf0c1722c8a8ed11e9f18d380cb4dd75e3c95935bfc42d6bc8af51e6831eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894535, "uuid": "842e7016-2e8b-4277-9602-0c1ea663f7ad", "comment": "Malware payload (RedLineStealer)", "value": "6b7acfc511db0f33da9728a6e60328c2b5ae5d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894535, "uuid": "ae485036-988f-4cd6-94b4-4c4ba1378000", "comment": "Malware payload (RedLineStealer)", "value": "7a5b929885cda2e30a75c3bdc1a8842c8d6cabaaf04a453e960466b77112b61b3df8b60f47bc89f0967c6d45c0663377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894535, "uuid": "83cfbad4-6976-40c9-8854-cb054ceb1fe4", "value": "T10E74F05176A1C47AE4A245344825C7B4A97FBC70AF6886CB73886B3D2D307E2DF35386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894535, "uuid": "2f835e30-9543-41ef-9945-7b9ace5a665e", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894535, "uuid": "253e8db5-7a70-46a9-aa6d-cf512abfa492", "value": "6144:/dMkSLYEIqk5lj0mD5FHkCFxzd+hCLCl+fGTb4gT:ukS0EIqk5lQmw89DfGTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894535, "uuid": "067f7954-0cb3-4353-980f-4f70b6e9f258", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894535, "uuid": "a861b664-5302-43d7-ba04-9dd1d235ce87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894535, "uuid": "17109e92-546c-4583-a390-a5450042566f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8aa15a-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912479, "uuid": "fc1aaa6d-3d3a-4773-92dd-aaeae765b43b", "comment": "Malware payload (SnakeKeylogger)", "value": "8463d15f318d828c5159b8b06623aebe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912479, "uuid": "0f2dae9d-e130-4841-aa6a-0cd5b49c92f9", "comment": "Malware payload (SnakeKeylogger)", "value": "8f56c89024597db9a07eabb399a4d07e8ff9af74573de80214be3e5f764132fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912479, "uuid": "8f7941f4-b5e2-444a-af09-64c822f3cf81", "comment": "Malware payload (SnakeKeylogger)", "value": "d441f45cc42dab1741bc73357e0bd378f74d9761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912479, "uuid": "6f9bc0d6-c172-4afa-b7fc-dcf5ce4d97d9", "comment": "Malware payload (SnakeKeylogger)", "value": "d86a94cd92b0634cfcd2e185cfcc63da8c12d2da33dea2883c830c77479a61ac1d0d72e402a45eba0ecc4a61893958f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912479, "uuid": "458baeb3-8126-4132-a684-4b78634135a8", "value": "T1ABE49441FAA8470FDCF95AF764311BA5ADBCB806785EB78AC34077B089B5364B40C396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912479, "uuid": "746cf66b-76a2-4225-ab58-cd85089817bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912479, "uuid": "439df547-86ef-4b6e-8846-cd5d6ffcbbb1", "value": "6144:FZ70WCklPX7WdUValNZ417S5KoIj3L+kayyRTxQso6HFuUp7uNFxo22cuXd:zo8dLWdUValNu17SUn+pHtyulXus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912479, "uuid": "4d524dd4-8206-441a-92fb-e8b5d5c0ebb2", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912479, "uuid": "e7b00fe9-4eea-421d-8bd9-bf3c90d034b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912479, "uuid": "8736f5b0-e434-4110-bf1b-6d20ca7159de", "value": "8463d15f318d828c5159b8b06623aebe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74ea30f-cc3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679879693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879693, "uuid": "816c8dbd-ace9-4b3a-b99a-c0189d9a629f", "comment": "Malware payload (Smoke Loader)", "value": "1ca3644ccf0ab5f867dffdff18c01613", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879693, "uuid": "e6266d9d-4dc4-4db6-a4c3-9c2c972f81cc", "comment": "Malware payload (Smoke Loader)", "value": "8f58df21dddda5384f1f2bb7d5823c833ebc0fab7d1a1baed2b7e10facae10da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879693, "uuid": "5e1fb1b4-501d-4c51-91a0-352c7146412a", "comment": "Malware payload (Smoke Loader)", "value": "97eed708be3db65dca792db8c0374433f34be0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879693, "uuid": "e96dbd4a-8292-4572-af1a-df0949a02141", "comment": "Malware payload (Smoke Loader)", "value": "df2427e341bac6bb181a032d6c11455c07f1dad58c865a195f0abef41a7e1a302c83cefcd2501b7a3a2d6050eab7d3e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879693, "uuid": "a3d6aef9-f656-4b53-880f-98c93462456c", "value": "T139546B3262F06860E523D7328F2BC7FC2A6FB9619E157B7E12595A7F09702A1C572334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879693, "uuid": "7bfc0c99-29fd-4d07-90ed-36c765c39cf0", "value": "59edcf4038e73a659a2ff6e04ad467ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879693, "uuid": "0fab68e5-f701-455a-9aa8-61800a22d488", "value": "3072:2jmppvaAZ6ZLEZaSPh0MR8s0G4y6RxfX3puSGL/0zB/cSIW7mHPY88c55/1pNN4+:cAcFEEI0MBQxvu/0zCb//3NN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879693, "uuid": "1e255451-f3de-4d59-8340-4784de0273d3", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879693, "uuid": "3c1fc423-e19d-42a7-9cb6-dc91f4819d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879693, "uuid": "4c01ff35-2543-4599-b655-1391ff3c7dde", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301da3ee-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912510, "uuid": "841ad36f-389d-4038-849b-0a109a17c806", "comment": "Malware payload (SnakeKeylogger)", "value": "5d0bbcc25010032999e02b657fe402ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912510, "uuid": "d3a29f1c-95c9-4083-9935-b8cbe49a045e", "comment": "Malware payload (SnakeKeylogger)", "value": "8fdd895977065b5248f16aded86e5128fe208b5ca2b6ecb858a9e03f2d88bc79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912510, "uuid": "20a138d5-7686-486d-9ec1-7081f63cf526", "comment": "Malware payload (SnakeKeylogger)", "value": "1fbb8b8084ba09d3003a0d8c8de486a02285c539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912510, "uuid": "92a23966-922e-4d36-bec8-4335ef5581be", "comment": "Malware payload (SnakeKeylogger)", "value": "ba5e34ebe694c70674f252ec43ebbb7f44c63ea4d036f6e8c6338f96184c5076e1715c75285593374673fbd1f0c51581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912510, "uuid": "2b0ce4e9-8f2f-46ed-ac3f-2379ce2dd7a4", "value": "T118F4F048E3D4A717EB7A6BF42DB09800D3BDB8EB6B45D98D4D8A10C781F57508E43A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912510, "uuid": "c629ee19-0178-4aed-93e2-e9bc9762b866", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912510, "uuid": "ad4e017b-b702-403f-a2a8-2a0db2e8614b", "value": "12288:kA55B0O2JhZQ4n0AsnaCoqkYWnSBHmuVWvX41ep+xxk4:kA5j2DQ4n0AgRkYjG804QJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912510, "uuid": "b390d91f-f223-4dfd-8531-4ca782d0d5a4", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912510, "uuid": "de074e8a-6277-4651-a26b-2ce5187ba2b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912510, "uuid": "a9470e13-9c84-4ce8-98da-0857802d51e3", "value": "5d0bbcc25010032999e02b657fe402ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83368932-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1679920381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920381, "uuid": "247fa8ac-a33c-4930-a66d-f0d13d4a1082", "comment": "Malware payload (Fabookie)", "value": "8ee9fa4e189b78d14c86d1d50fdd90ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920381, "uuid": "77089730-e2f2-4196-a673-0cb403d6c366", "comment": "Malware payload (Fabookie)", "value": "902387aa87934a342776e8e81b67323957cb9c1d10288567ca8058a4614a30b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920381, "uuid": "fefd6b37-e657-4750-86ca-e702bb8bb06b", "comment": "Malware payload (Fabookie)", "value": "d1ecc16d3e4946f6e48c7a4b7d83b188e85bc009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920381, "uuid": "e8a54c23-6419-4b07-bff9-7ff4b058c832", "comment": "Malware payload (Fabookie)", "value": "46ed1cae7a8b3c50083ee92f0503a00f3d5099d431f81bb3b16a90069e39d1999b5f08c2718d2cc5d8b0acefda7b6b6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920381, "uuid": "8728fec9-5bc2-4ee9-9ed2-e2eb1216ed76", "value": "T190643B156FB91DB6C016B43F0C6E84524B337827162783F7E496DEAC0EF76E8D466822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920381, "uuid": "51019862-0980-41ce-beed-47b81e7fcc46", "value": "a7a19cad0c2c193feb43fc00c1b6b502", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920381, "uuid": "b9233216-c88f-4062-bd86-8ff940479fd8", "value": "3072:P8k/TMYQ0qIN6NtVcOXEK5ULtGyUPj09vJqxEm4x1ESuQG+3SeyRS6CSfKVu1xgP:5Mnt3EPRAPj2voxEvTEPp/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920381, "uuid": "6f88cbce-acbd-4cf7-9aef-bc00d008f03c", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920381, "uuid": "00e42c67-e44a-4b8a-b033-34219f0fbe90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920381, "uuid": "58bdd84a-3ca0-4ff2-b7bc-0c4867149707", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8b1afa-cc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679920992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920992, "uuid": "99eb591f-4a97-4bf4-88bd-1ef23953aada", "comment": "Malware payload (AgentTesla)", "value": "71cf68e20364b584bb08ea08f2d64b9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920992, "uuid": "5060735c-c371-4a82-8b39-6e08d9aaac8d", "comment": "Malware payload (AgentTesla)", "value": "920961f43c4590704b068fb3bd274325c966908e805f7994522ce173e7e4c0ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920992, "uuid": "d74c9473-c921-4b0d-9c96-4b3bd77e6449", "comment": "Malware payload (AgentTesla)", "value": "60402cf86e50c425e4852ee761c2d7650e76ba56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920992, "uuid": "9b08eae3-c809-43d5-b595-43cf6eb6f3f4", "comment": "Malware payload (AgentTesla)", "value": "b19e29f15f4763f285734acc1112b430b2137853d1984a52957632bfe21cbf28168e51ebbacec78f753e1c53db459172", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920992, "uuid": "43a903a3-4858-4a7a-a463-c06fd35be2d7", "value": "T1B0050199F3E46722E77A27F02AB05900D37CB8E75B56DA4D4D8E20D790F4B008E53A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920992, "uuid": "99484db1-2c27-49ca-aa60-49526741ff8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920992, "uuid": "d5dd2fde-d475-4ec5-aab2-bdbe7ecdcc23", "value": "24576:WA5xZDunGsiJgD1iYpOe7A6R90HRYVuAMVn:H57unGsi61iYnMVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920992, "uuid": "fbdce724-d6b8-4022-aca7-b8c7d805cd2d", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920992, "uuid": "cad269bf-8770-4b30-8411-d2461592493d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920992, "uuid": "494789dd-c538-4364-bd4c-a30a9aaaab2f", "value": "New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b28a108-cc9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679921038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921038, "uuid": "642a7862-6c2a-4f18-9861-0b13bbd20590", "comment": "Malware payload (SnakeKeylogger)", "value": "3d3b957221feb687fbff10f29354fc44", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921038, "uuid": "bfd840b4-354f-4e74-8cbf-cdf3033e2408", "comment": "Malware payload (SnakeKeylogger)", "value": "92aaded03ae797099fdc30885e152dbc90c0159a0ec493743aa50a67fdc27097", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921038, "uuid": "b0ee11f9-c423-4645-a28c-38c4e25d206e", "comment": "Malware payload (SnakeKeylogger)", "value": "121f143ece5d39bb4ed1efc54c6a65e0a618768e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921038, "uuid": "a52b8764-e308-4128-89ec-9850e5a6fe7c", "comment": "Malware payload (SnakeKeylogger)", "value": "d91342794132cfbfad5f40017889afc797fc216cc0ddd521c2c97ea9354bbb665657d7b072f04f09f5b632c0acb57f7b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921038, "uuid": "b1eba56b-1c23-477a-ad0f-3535ba141a2f", "value": "T1F3E4237E6877D5685008E14CAAC50F7EBD43DBA6EEE231828D98FA0D14CE37E51079D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921038, "uuid": "beedc564-86e3-460a-9256-589ccac4a385", "value": "12288:9SmvURUZTW9Z1IhwtoGBGM+4HlcPSPZ9+4J1PDXVNdis631pB8I3wWx+LopPi07X:cmMUZK9Ihwt7B5+4FJ3jdb6TBZ3wzolb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921038, "uuid": "eb2eda67-bb6c-4247-a0eb-7f81403b425e", "value": 692705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921038, "uuid": "e2aa064b-c922-4deb-b64a-a28688bade0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921038, "uuid": "7bb77c54-b33e-46f2-9859-0bb8e29aab73", "value": "COMPANY CATALOG PROFILE- Qingdao Wisdom International Supply Chain Management Co Ltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e323d4c6-cc43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679882746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882746, "uuid": "75800c85-b7c8-412b-93fc-7e24a62e7c17", "comment": "Malware payload (Loki)", "value": "463840c20eb3fc8c5598f937f502aef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882746, "uuid": "78aa3e7e-c6a7-4ef7-91e9-aa4c001029f2", "comment": "Malware payload (Loki)", "value": "9379c08a611d759dd3dd8532c51baf927373581ec4ed728e7fe9e418aa297ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882746, "uuid": "c5d3101d-6f36-4e18-a579-a85cfa71827e", "comment": "Malware payload (Loki)", "value": "6bc29b6c728d9c7ec652276a5db9307c5399f6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679882746, "uuid": "20ace0b8-5580-42d2-842e-d2bcd455c884", "comment": "Malware payload (Loki)", "value": "4494158d321734ecdea61ba6c3bd73f89b5b13ea1e706039320e7fbce44cfd15e2e08ac2d884f1196b710ca096575b49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882746, "uuid": "0cda9c8e-493d-409f-b8ee-863086744283", "value": "T1B6F4F058F3E46717E7766BF02D708940D3BD78EA5B05DA8E5E8A20D780F57108D83A2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882746, "uuid": "d709828e-12c9-4c5c-846a-27176280806a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882746, "uuid": "7a4ae164-2509-4f1e-886d-ac348ad8622f", "value": "12288:TA5NB0ODkPz7Gdin+DoPNvZpdp3bdxUNlWMlfqWQMBi9R5JhZ:TA5nNkPzqwkoPBLkNlr7iRvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679882746, "uuid": "d60cdbda-019b-4574-9eb0-d0e9e3206c34", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679882746, "uuid": "3dce1343-6b0c-4bad-9f01-6d1f35cb89a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679882746, "uuid": "8558ba4b-b9f4-41a0-9f54-87da0a7edf8e", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b51c29-ccac-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1679927658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927658, "uuid": "91ed55cf-357c-4e8d-b68d-4dba845f93d3", "comment": "Malware payload (Tofsee)", "value": "da5e4cbc3f49077078c72d5bc35d2490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927658, "uuid": "ce4613ae-1b57-4dbf-b948-edcc7fa783d2", "comment": "Malware payload (Tofsee)", "value": "941014493d71c401467dbfaa6e177ee7ee07486288350c6d45d1d2e9c3abec6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927658, "uuid": "ed70af02-7c61-4376-aeb6-0f3bb62be9b3", "comment": "Malware payload (Tofsee)", "value": "902ec3ac8390ededea2c9bcf3ec34a2d3394128f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927658, "uuid": "11cacb56-bd81-45bc-8723-44f8ff0d6f3b", "comment": "Malware payload (Tofsee)", "value": "b90065341b9cdb98ac9aa28937ce03866eaa34931b45a33128fd0319c328b4ffdda853f9f5c87aef8cbe60f3182ad686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927658, "uuid": "0ed0daa0-f51c-4e1d-8346-1b8b378809ad", "value": "T1CD44CF1276D1C472E4AB06358821CBB46A3BBC715B6685CB278443FE5FB13E19B393C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927658, "uuid": "383419e5-2e45-4673-a1d6-d31a45b80fae", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927658, "uuid": "4b0fda1e-6dbb-45c2-89e6-269fe21d3118", "value": "3072:IbFEBYrR6uEi8dkShLWlzECOmVcuGRrPVli5NuosnGboLj/8sj5qrSBKni:IBOYWiEkShLW9E/mVcjRhw5w51QrSBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679927658, "uuid": "87e08907-db6e-425f-bd23-2248ad8874f8", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679927658, "uuid": "51841eaf-4fd0-424d-8acc-87e8f71cd3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927658, "uuid": "8d2decc0-8e38-479f-9866-777844b35a54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63fa9ec-cce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679950585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950585, "uuid": "c5216618-453b-48a0-b986-5fdbff166634", "comment": "Malware payload (Mirai)", "value": "e98484eb50449ab46932bf35638a0783", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950585, "uuid": "f11b85f5-1a47-49e9-b996-c3b7e28ebdea", "comment": "Malware payload (Mirai)", "value": "948b8ffdd3f3dedf5cff884d606c0752d6ccff67cf4d2d61bea43386ba128f95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950585, "uuid": "fc68de98-cee3-4f3e-8fc1-b0085e5a1ce5", "comment": "Malware payload (Mirai)", "value": "ffc5bc07d16d98f0ce31dd1d3302e953f1f19b72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950585, "uuid": "79c6d744-a235-4bf5-b820-b4aea626408b", "comment": "Malware payload (Mirai)", "value": "3e8c115b7bfc6acafc9e5a64d7893417bdc96d43427dc0d62e4499b1b54a588c0497a34e137dd89b7e9989f964c96ef5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950585, "uuid": "61303fa1-baeb-4ea4-9aa4-83a2e3074055", "value": "T157C2E1986045692AE5F204FAC477C481AA5F4AF5D7D4B3382638076DA79305F38BF28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950585, "uuid": "d53644d3-28fa-4896-9719-99508a920022", "value": "384:PINTw1MVcolE7DhZ3JtjagAK0/1NR2CJTLasS7zmBT9d90qeRl9/EERhymdGUopt:PSncztM/Eu+S9Qq18s3Uoz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679950585, "uuid": "1129753f-89bb-4cf6-bd4e-5ce3b43ce006", "value": 28128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679950585, "uuid": "da410e0c-9387-4b7f-9830-254df8d87a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950585, "uuid": "33d43290-79ca-42e6-be90-b8ce87ad519f", "value": "e98484eb50449ab46932bf35638a0783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a993ac8c-cc9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679920445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920445, "uuid": "fa851bb6-5c4e-433c-b8c0-a88e5b91f939", "comment": "Malware payload", "value": "8986c5904e0ca38ef20da964d624e8b1", "object_relation": "md5", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920445, "uuid": "45012400-76a1-475c-ace8-a9282d8f8257", "comment": "Malware payload", "value": "94a0e2585945b2dd1263d360d85405e2bf16186ac56bbd5c3a35a02128b732f1", "object_relation": "sha256", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920445, "uuid": "726f1d30-3dba-46ff-b134-3a2c3f18daf4", "comment": "Malware payload", "value": "41577c52571bf6c7301aed16d050fb41da44d9de", "object_relation": "sha1", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920445, "uuid": "c6d0d2fd-fdca-4d22-af96-1529a800a689", "comment": "Malware payload", "value": "24ef22e4ee75aefc5b0ec85a0088793babb71dc6415daef515b72334413c16315538b90015b9806cb97ad3246bb3b5fa", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXWebShellr00ts", "colour": "#709244", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920445, "uuid": "ca5119ae-97e5-4bff-870e-64be4b3296b6", "value": "T1E533A3094D89595B8273B37AEFA38459EF23116303665630FEDCB2061FB445846B2FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920445, "uuid": "65b3e629-1c6d-4c1f-bfb3-f781e0bb827a", "value": "768:ZrWLySTt9EQzQvUrDAg5kC4tzZFQJ7h45:Z6ySTt9EiQcDGC4tzZO345", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920445, "uuid": "f13c7495-d4dd-4dd8-b24f-dbc14fe92568", "value": 51460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920445, "uuid": "d3929f80-a6bf-4587-8497-df7efbc53790", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920445, "uuid": "043ac648-05f3-4263-816a-4237f3fb1f1f", "value": "SxEGWHmE.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7b02ff-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679901817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901817, "uuid": "324f6a5d-5f60-4a72-8a71-34712ddc7b5c", "comment": "Malware payload (AgentTesla)", "value": "8f3cb78bf3632816a1255f1d71836932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901817, "uuid": "c60c436d-bb12-4b8c-807b-f9e8509b86da", "comment": "Malware payload (AgentTesla)", "value": "9570de55edd0673b943373c62f8933668173897cc3a9a7bd976636fae991b5e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901817, "uuid": "b549d279-d201-4e6b-94c2-3256aa22a9f0", "comment": "Malware payload (AgentTesla)", "value": "c858c54d86f8b77118cb561dff239a870db0945a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901817, "uuid": "71b7ea90-2dd4-41f1-9d5a-2fd6b225f2e2", "comment": "Malware payload (AgentTesla)", "value": "a0561ea05b15e24c17f26db722ae55f171c7e28235fc0790fc8a738226cf41ce633e54125164c0b5bc2d299183bcfd97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901817, "uuid": "6df569e0-c680-478f-afb6-227125910df6", "value": "T108F43A4173F5C22AF5EE57B5A6F106180EF4E40AF2B6D7AE1D64E1EC0E66B04894037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901817, "uuid": "60bb9478-14e7-49bb-b14f-26420648251a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901817, "uuid": "c8e0435c-ce3d-40d5-aa70-6e5215fceb93", "value": "12288:sf14CfyiII23mtF2v700UyxUAvB/+QVKdPDgw:Pit2mA75UyxU6B/+QQdPDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901817, "uuid": "03ef144a-776e-4d05-903a-8f25aaf88181", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901817, "uuid": "bc1cc8ba-dbc6-4a74-bcf0-b0d0932e8a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901817, "uuid": "9adcdfdc-aeae-4e71-9d90-27808d9decd6", "value": "zam\u00f3wienie Z2300251_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb8ca16-cc35-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679876779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876779, "uuid": "9f813a74-44d3-4771-ae14-429f06146324", "comment": "Malware payload (RedLineStealer)", "value": "ae95b7aa0aa6eed3f6c9f2ab201f3775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876779, "uuid": "f89a8c3d-84d0-48dd-bd68-c99aacb7a454", "comment": "Malware payload (RedLineStealer)", "value": "95aa255968ac0b34c2a584932e59543ef8279a827134357506b4a049942f48a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876779, "uuid": "42d9c024-98ab-4820-86cc-44c457200a95", "comment": "Malware payload (RedLineStealer)", "value": "d90b4122befb7dd0509885c6dc5731b5da2a3d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876779, "uuid": "d1d064aa-1301-46c0-898a-0b221ebda450", "comment": "Malware payload (RedLineStealer)", "value": "1d2fad9e23899a927c471cb8bde4340ea76cbeb8155ec6ee452fd62a1f61a59d6705bd90021fdf72db36a8c5be5b8b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876779, "uuid": "3f756672-0725-436e-8bb3-b2bea232d140", "value": "T19CE412026BE88133DDB117B054FA07C30F36FCA25D79836F269568592EB3644A97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876779, "uuid": "b57a7ef8-73b6-4ad4-8ec5-ddf33d4e88c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876779, "uuid": "849d95a5-8764-4e27-a7a9-4ef212d1cfa2", "value": "12288:AMrWy90e+YAXblfXx4NeetSrYEb1pNpVtlqkJBCy2ca2xe3Q7sDT:Gyz+5bJXGeeAYS3tlq8C7ca2xe3QQDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679876779, "uuid": "49d13c55-f874-4713-b169-f7ba02e217e0", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679876779, "uuid": "c4581fcc-020b-4ab4-b9ea-659bde3b092f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876779, "uuid": "4d881a5f-ba21-40d1-8e7e-abdf8122216b", "value": "ae95b7aa0aa6eed3f6c9f2ab201f3775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c8485b-cc72-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679902693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902693, "uuid": "ddaebf0d-50d1-45c8-b369-175cfe219e4d", "comment": "Malware payload (AgentTesla)", "value": "096547f66d02f43f7382c81bed7a24f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902693, "uuid": "2db3acdc-714c-4d34-975b-e51502b3fe3a", "comment": "Malware payload (AgentTesla)", "value": "95abf03a0df4af716ca9e0cb1154e3e10753d2be8d299a0ad3e44fb87077ee93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902693, "uuid": "70465166-6798-424c-b98d-a8140f613aeb", "comment": "Malware payload (AgentTesla)", "value": "bd2e0d6a3c5fdcdbbea2b66ea3fdc4a783ea784d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679902693, "uuid": "299ca0b6-4f35-4d52-9e06-f179b6c7b630", "comment": "Malware payload (AgentTesla)", "value": "bc8f061279fb94ac3862e2b6802bf560e0eb4034ad83ebb6ddf13a9a2ea9abb4fe28a09eecd8d7746e4056f6b7f75ec7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902693, "uuid": "42ee050a-eaee-48e4-b14e-9868de0eb809", "value": "T1F205D640A7F4C61BE2BE17B6A47409244BF8E901B7FADB4F2D44AAAC0C727425D4177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902693, "uuid": "937d32ec-7fa9-4a2b-a436-2a0664d9e43d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902693, "uuid": "fbbc9010-dc54-4b2f-ab0f-bf6ef8804657", "value": "12288:1dcv5cifSJjDGamUkr8ulM7UA54BUVFyYQBJhEd6pgh:NJ/GovulMVOQQBJ2d6pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679902693, "uuid": "936c056a-1f1f-43d6-9bcf-04d950765c5f", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679902693, "uuid": "6d8cc78d-0884-4ba5-a400-d38443fffab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679902693, "uuid": "c931e4f5-06bf-4066-85d0-7be48b3758c8", "value": "Zam\u00f3wienie 48099415_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ddf619-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904942, "uuid": "002fe3a4-40a7-49c8-bcb9-1af64208f305", "comment": "Malware payload", "value": "eb804a3b66a9e7a24fad5962d70eacb6", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904942, "uuid": "33ffc03b-3aa0-48bf-8958-4f1cbcfb956b", "comment": "Malware payload", "value": "96de0d854e0c93e82c7be754957fb411af1876d39d94105e4fe1ae65d24761b9", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904942, "uuid": "a1875d63-eceb-49e4-80f4-41cb7beed3d0", "comment": "Malware payload", "value": "c106c8fa064a3737343ee27761823bcd2f5d0f3b", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904942, "uuid": "2468ef84-e17e-4801-9ae9-98223fee266b", "comment": "Malware payload", "value": "a50940dda8ae4e38976a0be25c0457f84e7f451673433c21d3e58d296c79be46fa2cde335e6ef2ab1514ed9ec14eb191", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904942, "uuid": "c2c79a51-bcf3-46c5-8763-0657201054b4", "value": "T162D0EA9020CE5F7C6BBCB1DD3BB45E61A0EE191784C8458933EE27A72AB0E10971F525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904942, "uuid": "81212a40-c34e-4f88-92fb-946f3309ed41", "value": "6:Yx8u+eSNRP7f5EKXEKf5E6XsEiTA+V5SvbXV5SvNRSvUaXsF:7eSDD+K058v2A+VMjXVMFEF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904942, "uuid": "103ffc2a-f336-4377-8fcd-4d951ca9dacc", "value": 217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904942, "uuid": "800e6b2f-b157-482b-9ad2-eff3f47ee19c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904942, "uuid": "ddd8d5b6-1f73-46b7-aba1-c97bcd7f1d25", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4bea00-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679949924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949924, "uuid": "9bb01ccd-fe34-4072-98c6-d0505e641404", "comment": "Malware payload (RedLineStealer)", "value": "a39ce11c94d7200c8977e41e11977672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949924, "uuid": "d5a67d23-25f4-4c23-9c17-b10d17ab1ccf", "comment": "Malware payload (RedLineStealer)", "value": "9703a2cf66683041e83bb5a2a23663d85bc41f8e1fb950808707e36d782f182f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949924, "uuid": "306bb65f-bd55-46ac-80f9-a18ff7731206", "comment": "Malware payload (RedLineStealer)", "value": "8b7ad1b49a3d9fc4f0207bfbab1d6c5372b94838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949924, "uuid": "ba813348-2c0b-4dfe-993c-e7bf550c10e8", "comment": "Malware payload (RedLineStealer)", "value": "0f9812e1af6a678cd03d3d3b43f6c07ba4b4dbc38963161645f6d88382c0444392cd24d99bc86a82456999b419b970c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949924, "uuid": "ec5adbd9-fa2a-42a8-971b-c70dd42c3531", "value": "T114E41243FBC96537D8F04BB098F653531A327CA19A39629B124AACDD1CB36C16972326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949924, "uuid": "dab17414-36dc-424a-94d1-ca17bad56991", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949924, "uuid": "611dfb90-bda7-419c-a6ec-0c1e91c19a74", "value": "12288:8Mrly90emMQaXJJHkBSaJYeCJ/x9UjGNnwwARxllvvPSQzRHBJoll4RMrOU9HBkT:Jy9Qa5JE9dC1La9fRxTvyIRh2leU96ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679949924, "uuid": "059b9e3e-cc18-4dd1-bbd5-6f325509fc57", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679949924, "uuid": "1292ce7d-93d8-42bb-86ac-f5cf900ab728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949924, "uuid": "43d71c1d-c19b-4e51-8983-efe1436af65b", "value": "a39ce11c94d7200c8977e41e11977672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b83172-cc3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679879628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879628, "uuid": "7abc14ec-a6ab-4a6b-8dce-8f3aeb690220", "comment": "Malware payload (Smoke Loader)", "value": "76358f5b2b5330294493b0a99a25cf32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879628, "uuid": "5cd2efcb-62dc-4903-a303-a92b105dcfc7", "comment": "Malware payload (Smoke Loader)", "value": "99899771a355e35939d8809ecdd927c6595ee0b922a6dc68e5ac18666cc7d489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879628, "uuid": "e6855d2f-2500-4aa1-8457-8827211b74fc", "comment": "Malware payload (Smoke Loader)", "value": "37bd6007303a72a4931c3a9d2409146669020aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879628, "uuid": "ded20e47-73ea-4a84-b4cf-28c51cdfcdbb", "comment": "Malware payload (Smoke Loader)", "value": "4748dbb3f3a23a97e4ed87397afe48e4dbe36547f9030d70e1be52cab1966eec5633197c6a9231ae9579278c2d3df361", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879628, "uuid": "628329f0-d634-40fc-b32b-da64a39c4010", "value": "T165547C3262F06860F563D7328E2FC6FC6A6FB8619E157B7E12455A7F09312A1C272335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879628, "uuid": "b6c9d063-acaf-4e6b-87c7-26982a024ff4", "value": "59edcf4038e73a659a2ff6e04ad467ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879628, "uuid": "725c6639-d688-4e9b-b264-c2288f8baf19", "value": "3072:cF4dSHrn2ZBFR6i20MR8sS1gye4KrwUuBQJt/RKvpNN4TJY:yr2/7a0MBkV8v/RiNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879628, "uuid": "f8962dd3-1418-4915-8723-56abfa1f5c52", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879628, "uuid": "d0df2f64-6218-42fe-86d0-9ab6133050bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879628, "uuid": "ed7657e6-4e94-48d3-a065-638c62d944a6", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4189aa8a-cc6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679900943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900943, "uuid": "8e5458e5-673c-4f04-b027-31bcf4294258", "comment": "Malware payload (Mirai)", "value": "f912bde30448cba56043232a66871589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900943, "uuid": "1ce9a2f2-2b1d-459f-b173-c40fe7444fbf", "comment": "Malware payload (Mirai)", "value": "9c22d43086e07ba4f4e497e4f231bf796b71004e5caa29d34dec98f9235b0def", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900943, "uuid": "afb8015f-bcd7-4b8a-8a73-a933c2011515", "comment": "Malware payload (Mirai)", "value": "1e613e519bd2501a4d10e66f5c89f209b5bb845a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900943, "uuid": "2be889a6-f646-450d-b13c-b4ae3299ad1e", "comment": "Malware payload (Mirai)", "value": "47dbbdf8f7b91643f2c6c23141fc97c0742d8e2e93323dedaa6e9114ffefe59bba6ce1bc4e1821e6691916c763e33618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900943, "uuid": "33f00cf6-b940-4df2-aea2-08075350215e", "value": "T17783D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900943, "uuid": "084c24c9-2eca-4f7c-a204-6560ea5fa80e", "value": "1536:iVLymx1K0Skj752dCexuV/8UZlDwfkJ4MYfWd:iVLyIUYFezxu5VD1e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679900943, "uuid": "dc3abfec-9467-4012-a661-61fc7e6c811d", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679900943, "uuid": "c5ae90af-470c-4059-87f0-f5716ebd291b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900943, "uuid": "5225d7c3-c1fc-44f5-b72c-fb67894edb16", "value": "f912bde30448cba56043232a66871589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b440a4-cc3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880599, "uuid": "d41956fc-331e-467c-8901-fa912b9d4e3b", "comment": "Malware payload (Smoke Loader)", "value": "053a0c580a198bfe5b66a408473cddb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880599, "uuid": "fa2e470a-d76a-45c8-8e53-00e3db54bd74", "comment": "Malware payload (Smoke Loader)", "value": "9e58fd2184c515d98d98a2fb3452417586d367622a64a2c706778f6442b93aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880599, "uuid": "ecf5de86-5907-4e8f-a1aa-a9b8b2e8afe5", "comment": "Malware payload (Smoke Loader)", "value": "2677eba1fb70104051b591ce11126c3f454ee467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880599, "uuid": "6a21f0ab-5fab-4daa-a207-72ad7aee7398", "comment": "Malware payload (Smoke Loader)", "value": "f7dd23d50fe8d9905608f56a5d70dc74789add16a80c38299b65acf93536241cb66c553b6d470c6fbc94024686a47907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880599, "uuid": "5e908949-fa65-4b70-9eaf-95b63ebcef3b", "value": "T153547D0253E27860E72387329E2AC7F82E1EF8605E157BFE16549A3F2971F72D562305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880599, "uuid": "f0ef818b-4a6b-4c99-8461-3355a852f720", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880599, "uuid": "77b36f87-a297-4fb1-86c8-8b6fb323e0e4", "value": "3072:zufRzYU/wGq97PSjF8GYpb6kb9S7nHjDZnYHGaVoamLVzYV55JOF1bVCJQN0fm2X:EkCFxYd6kb+jDZXur6YV5POFlUTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880599, "uuid": "5d9cb35d-8bbf-403f-ae1c-84c0dcc049cb", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880599, "uuid": "de7e47a3-962f-42c0-bbd6-be8e891f1112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880599, "uuid": "42320366-7319-4b77-b1d7-0ac2409f8be0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6672ec1b-cc47-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679884255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679884255, "uuid": "c2403844-71e9-4575-a158-646027a8e8f0", "comment": "Malware payload (RedLineStealer)", "value": "72fca888810e3db7273cb9c492c6d6b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679884255, "uuid": "fc03d1af-e056-437f-b093-8329be804403", "comment": "Malware payload (RedLineStealer)", "value": "9f7c7cb56e7c247e7170ff663003640d5fdd0449e4e2b417e55b572de6888b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679884255, "uuid": "db2ae19f-91ad-4f33-be11-05514f9fa0d7", "comment": "Malware payload (RedLineStealer)", "value": "ec447164906da68359bf975928a31f95225fce02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679884255, "uuid": "73956b8c-edeb-4e80-8663-e886555295f4", "comment": "Malware payload (RedLineStealer)", "value": "ddb3153764e5f9d617f6a358e7a78b8c5227cc5ae12c8c6617f88cdc432e2cfb558a550e630522aa37ba12bde1f7d918", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679884255, "uuid": "bb007974-3347-408e-9e05-a43e312b2113", "value": "T18AE412036BDC5573D9A01BB009FA0BC31635BDF26D78925B17469C0B0DF3995BA3632A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679884255, "uuid": "d74ee495-cb95-4184-bc79-5b62aea5051e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679884255, "uuid": "ceec0c16-2734-4341-b0da-597f2a721615", "value": "12288:dMrWy906EJEdf+DhiMn0O17RiTZxl5kGBhK5dA0H6GfqY3c2us:rybEJB17Uzl5zhK5dA0H6GfqY3c2us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679884255, "uuid": "387c83d5-0424-4dd7-a404-d06a78926eca", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679884255, "uuid": "68c7cdd5-add0-49c1-be95-b41d14be74a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679884255, "uuid": "e4851cf9-4c24-49ca-b9bb-102c22fc048e", "value": "72fca888810e3db7273cb9c492c6d6b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c29d918-cc68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679898357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898357, "uuid": "ab6f1353-709d-415c-9eb8-179286b6a7c8", "comment": "Malware payload (Stealc)", "value": "4057acbd036de09b67259254135aa554", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898357, "uuid": "68eb8208-7667-47dc-9ff1-7326073d83ce", "comment": "Malware payload (Stealc)", "value": "a2c431113c533e61cc8ca4460a5852d0794ec21c98d0325e95fe62f6e50068ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898357, "uuid": "77857129-9949-4229-acf0-f57f7369e4f9", "comment": "Malware payload (Stealc)", "value": "8524d37fdaa52561863190044ad0caed1543036f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898357, "uuid": "626fa873-7dc5-4062-939f-a17da7354ba4", "comment": "Malware payload (Stealc)", "value": "938823cfeb568fb035798ad79f428bbf1ecf1a36c685b79d316491d25331e57d1ff660c66cc9436f3d32a041fbd910dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898357, "uuid": "95b790d9-85a2-4a82-9222-749ee31d0371", "value": "T1FB546B3263F07820E563D6328E2FC6FC2A2FB9619E157B7E12595A7F09702A1D172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898357, "uuid": "b47a1457-3ec9-47e5-9375-dce3e9f4c9f0", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898357, "uuid": "ab96dfd9-5f19-47d4-9894-e28737802113", "value": "3072:73/BN6O4fvufPNUwCYuk4EbZnRnK41gPFvB8RGxuU59dF/0KpNN4TJY:i3aPuwCupxK8REb7/fNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679898357, "uuid": "0994fc73-1ae2-4a65-91b9-009ac6658477", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679898357, "uuid": "e65775f1-c41d-4845-bff1-004f45588d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898357, "uuid": "95088a33-d671-4b6a-a3d6-44cace0753f4", "value": "4057acbd036de09b67259254135aa554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b88bb46-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679904960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904960, "uuid": "99ca9d84-1fea-45fb-8f62-1c44dfcc0121", "comment": "Malware payload (RedLineStealer)", "value": "b9992c5b8ff927081eec4f786ecb089d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904960, "uuid": "37105b5f-7bd3-4b07-90e1-f55f0b112a01", "comment": "Malware payload (RedLineStealer)", "value": "a4452aa37eedd85bb7547d9d60cef0b9a9103df5cb4a645ca78142fb7dd9e4fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904960, "uuid": "4514f8b0-f49c-4400-9fd5-898b4bf7cf28", "comment": "Malware payload (RedLineStealer)", "value": "c14c402b9f1a9004805d72cc859a8a8990fd0319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904960, "uuid": "f07fc02b-8827-4eda-b47f-a9be84f8e0a4", "comment": "Malware payload (RedLineStealer)", "value": "d25562822e8424fca3883134d78833797f108841df873703214d012189532e766d41622b3bba1592684764bc34d3c842", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904960, "uuid": "91c95888-1b66-4679-a1da-d967d4049f46", "value": "T15A74E0013291D472D85A41745A25C7B4AE3EBCB0AB6486CF3B802B7E5D313E3DB3635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904960, "uuid": "56cea9d2-466c-4c7a-9b81-7ca6f671b4c2", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904960, "uuid": "5ec61216-7f71-4b8d-a3ac-02110dfc685c", "value": "6144:XByZ0gL0qhz+4Oo6QUrBrPJLiTPfmyQ419qyZxL5glB:oZ0goqx+4/dZT3C41JxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904960, "uuid": "7a077fb6-199b-4c01-b540-ba0f2ad98f06", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904960, "uuid": "cdea4b32-87fd-4405-b1a6-f3d978e1f5f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904960, "uuid": "be964fd0-107c-4058-929e-7a1f67a976d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b143b5-cc76-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679904629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904629, "uuid": "719a237b-59c7-4aa2-8cbe-9bce69a4a0dc", "comment": "Malware payload (RedLineStealer)", "value": "f7f377c0ff5c42ff5431db23e9db9517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904629, "uuid": "9a2cc4a8-9b13-425b-93cf-545434b68b48", "comment": "Malware payload (RedLineStealer)", "value": "a4ab0631a77553314cfe341ae9bb7ac3e2886750ff544673c238146d450b79e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904629, "uuid": "2b176893-34cb-41e1-8738-93c46b802bd3", "comment": "Malware payload (RedLineStealer)", "value": "742656551d9a940c9f42a13c17fec7d6902d784d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904629, "uuid": "7a1863fc-2a82-400a-ad09-5b6bfbb729d9", "comment": "Malware payload (RedLineStealer)", "value": "509eb94c2fbcf103535d53071c1c07a188b1ab116d67154e7d5ca39d454ba7cb11220da69138bf170bfdf1e89d943f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904629, "uuid": "fa43247c-0752-4d75-bb44-d26283dad0d8", "value": "T14B252322A3F88477D8B56B30A8F213671B39BDA45D74473E238A494A0C727D2D17636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904629, "uuid": "1a10e4bc-f119-4a30-b5a8-3a3f4a36ed53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904629, "uuid": "a3463b83-299f-4d4d-9326-a42b210e1c19", "value": "24576:ryRopjVZ2G8eGg0OByKPtoHkqxM8Gv249Q73FrN:eRM5djyKOkqxMM7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904629, "uuid": "fb91d979-62ac-4dba-8aeb-23686c51d233", "value": 1050112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904629, "uuid": "7b11eadb-3537-46e3-ab1c-77b17a7efebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904629, "uuid": "71bccce6-4a70-451e-92a9-543136fff85e", "value": "f7f377c0ff5c42ff5431db23e9db9517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1ddbe5-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679901825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901825, "uuid": "7bd5aa2a-cc6a-4df4-baac-9c254e4ee7c2", "comment": "Malware payload (Mirai)", "value": "02d9f7c4171c57a5c16174f528ade54d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901825, "uuid": "da0c6972-04ff-405d-926f-8012329e05f5", "comment": "Malware payload (Mirai)", "value": "a4e1b85438c23376bd03b97928de23adc0e3ea9ee5b00693d711151b4032eedb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901825, "uuid": "3dbdc4f9-e046-49f5-bb88-d5e5e019bc1a", "comment": "Malware payload (Mirai)", "value": "762484e77796913ed20b3b1a7087e8f3f8c414ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901825, "uuid": "1b6c6028-320c-4288-b073-edba359bb4ad", "comment": "Malware payload (Mirai)", "value": "8261a841dce4cb0aed0ba7376d858bfc92952fa7ed2a01cdf388c36cee09905a7c8405e96ddf4d0ef09fe16205ef85bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901825, "uuid": "a7193fac-5274-4eab-a911-74e0f88df264", "value": "T125730856B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901825, "uuid": "4ad8990c-e752-49bd-aaae-832e211aba6d", "value": "1536:2ln25xPBXk1wnnkL7+KEw073zdEya6t0bIeiNNfsvHTGcV5GYIWA3:7xpXCMkMT9za4NfsvHqcVERR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901825, "uuid": "7eac6fde-f2a9-4c47-aceb-150f86047396", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901825, "uuid": "51664cf8-19e9-471b-a47a-3c4e7569f436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901825, "uuid": "5d7f819a-9008-4776-89e0-6f964ce19ddd", "value": "02d9f7c4171c57a5c16174f528ade54d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f5604f-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679894891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894891, "uuid": "cb12db0f-60c4-43cd-be9f-8220d94e265e", "comment": "Malware payload (SnakeKeylogger)", "value": "ed84e675015789b204e8deace5caa12e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894891, "uuid": "3bf4ab95-c962-4b09-80fd-a3da44fb6882", "comment": "Malware payload (SnakeKeylogger)", "value": "a6933c87abc8301a501a23bf8788692959d21ebc9389898278c39497d3092bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894891, "uuid": "09c7f7f8-3a8e-4c4b-8046-4c046d73a3dd", "comment": "Malware payload (SnakeKeylogger)", "value": "e7e13a71b81902916e43157f55516b0328d7f7c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894891, "uuid": "eb4e584d-28d7-4b51-b94f-770a076d8682", "comment": "Malware payload (SnakeKeylogger)", "value": "b08f946d5b71042ce204eb3c3ca964fb8829892566cfeff5c2de26379c700c4e5c0804e008422054ddd3a5402983b66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894891, "uuid": "04ff0b1e-fba7-421e-b6ee-9e1ad4a54795", "value": "T171D32A1D2BF89800E5FF8A7301B15121C775B842192ADD1D1AD1F95A2A7DBE0CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894891, "uuid": "59d19b34-0917-4418-b5b2-4ccd4f12b047", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894891, "uuid": "99ffdc59-f79e-425e-bdb3-077131fb08ec", "value": "1536:xOAgzEJRCRjTZ1j4Re6Lt/HgDJjgdMb17QdsWMFVZ5vdb/Uik63jwpiOWB2vOgF0:8AgAE/4HwL17Qdi/Vb8VkiwBOOgFbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894891, "uuid": "4e3c8e79-95cd-4cf6-8d50-099a10b2a701", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894891, "uuid": "e32bcc6c-eeef-49e6-92f0-b75cc254519e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894891, "uuid": "c9763624-1b72-4763-a776-8276608e9400", "value": "a6933c87abc8301a501a23bf8788692959d21ebc9389898278c39497d3092bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec793b63-cc3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878896, "uuid": "ef5f7515-8089-4e27-937c-fe3e7361ad51", "comment": "Malware payload (Smoke Loader)", "value": "5d7fb83beb6e9d74cddd3ccc06808c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878896, "uuid": "0d2ba6b8-9501-4993-b2f7-7ed39b08e7c4", "comment": "Malware payload (Smoke Loader)", "value": "a700f835e1476704115e90d4ad398ffbe101a183c1f063b5cadab6722c895030", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878896, "uuid": "062388d0-d957-40b5-9bab-8f29917dfd14", "comment": "Malware payload (Smoke Loader)", "value": "aadddad23941d6e603e07cdfdeb329953b4053b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878896, "uuid": "62d4481f-4307-4f19-b5c3-e30ea0969a07", "comment": "Malware payload (Smoke Loader)", "value": "39f1f855142aa2df280a9620cf7669b1c2cff58d106ed8c84199efb3bd7b2f8d53508bde82388a75d8b3a484833190a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878896, "uuid": "6be7f5bd-73e1-4766-a02f-289a5fcbbbff", "value": "T1E0547D2E93F46820E1734732BE1EC7F42A1FF8619D567B5E3649AA3F09306A1DD62704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878896, "uuid": "d47de09c-7076-4fe9-a2a8-bfcdd2a5bbcf", "value": "87d886eda68b09da2d904f9205843127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878896, "uuid": "f79b9785-740b-4d21-b5f5-838f611f6d65", "value": "3072:IOUazEY1HoYLSTzy4GefMdAOpoAe7mDT1dtcD7XKv8jzHqFONln78Ug:lHSU2zy6OpzQmXtuKvYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878896, "uuid": "013bee29-68e1-47ad-9200-deab33099025", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878896, "uuid": "25a4d90b-7e6c-4b7c-a27c-15b200d4a331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878896, "uuid": "6bd09cbb-20ea-4803-b723-9bc0b4ab7eb9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab3bc23-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894892, "uuid": "b375278d-21b2-47a9-8831-7495f3220de7", "comment": "Malware payload (Formbook)", "value": "e35543a9c79f42420c322a673ca77a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894892, "uuid": "35225dbc-2447-44ae-a2e4-55a8766b7017", "comment": "Malware payload (Formbook)", "value": "a70b171c28645f51d9405f8429ae74f28d27ddb48786545bc21f35810f9501e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894892, "uuid": "319fadfa-2ec0-4a62-98c5-b3b11c7e6a55", "comment": "Malware payload (Formbook)", "value": "87bc231a0db3254f5af9ba86212d54c78f4d47ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894892, "uuid": "a3220cc0-26c0-4062-877a-87ca4f14282c", "comment": "Malware payload (Formbook)", "value": "7fe2f239be137e2b6840193674a0733f16ed4c838b19153ffe9aff993d2563bcd31c5022b9fc606cbfe30255bea6e368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894892, "uuid": "1a4aab2f-b241-4d80-8d04-19afa4d5dc53", "value": "T16704AE32D602C071E2B251B5F67C1B7B883E0E343694A4FAE3E115A16EF0995F52A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894892, "uuid": "b1b26ab2-9c09-4925-ad8e-2bf26f9d18c3", "value": "3072:Y8QnUQwBFKRujtBxb7ZMcR0j2Rg8GYFsh9h2mQlufoRR84gHy0QtHnqkQ:ENFuHl7ZMcuj4K9CufoRVgS0SHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894892, "uuid": "0acb52be-e51e-4130-97a7-ca78168e2ab8", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894892, "uuid": "bc81891f-b1aa-4699-a264-18d362761b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894892, "uuid": "23e61865-8513-4d7f-9c1a-fbbd2d22efc9", "value": "a70b171c28645f51d9405f8429ae74f28d27ddb48786545bc21f35810f9501e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c2230e-cca0-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679922611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922611, "uuid": "ae15e14d-e67e-48c7-bc1f-c0527f5d1e51", "comment": "Malware payload (QuasarRAT)", "value": "278c9b22482531cac9433e57d900bbf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922611, "uuid": "f90864a8-5a7b-4113-b95c-519588103075", "comment": "Malware payload (QuasarRAT)", "value": "a7a5ce7c3c6fe4c23529f1254a71b8772327e3b68f1adceff98d7c2fb9af0315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922611, "uuid": "531338c8-74db-489e-b410-b920b34542a1", "comment": "Malware payload (QuasarRAT)", "value": "c58d0af1f005f25b9d7e2774cdb10cc48c15a201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679922611, "uuid": "aa909e46-c9d4-434d-9087-18600ebd99c8", "comment": "Malware payload (QuasarRAT)", "value": "6f1e0e0eef7b437e524304925a31eb365836d95caae478423f8cced8eab8e9f339fe421a34a801efa4f229d39d042a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922611, "uuid": "99a8976a-36e9-4a7e-b329-25f58a8c8079", "value": "T13F76330D516006F9E83BC03DDDA3942AEAB279964B64E3474774C2120F13AF56E7BFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922611, "uuid": "1ae178e3-c44c-4cea-9e11-86dc5a8b7290", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922611, "uuid": "f295e3c5-2e51-4c78-91c1-9ca28fa8d3c3", "value": "196608:BigkL2Vmd6+DXLZy7YM30LzajzpqmkCfOSCybj:AgkL2Vmd6m70GzajzZkCG7yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679922611, "uuid": "042a4316-4b35-4994-8026-6593f44f431b", "value": 7506487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679922611, "uuid": "3f42d12e-45df-40b4-8c39-d0b95b001337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679922611, "uuid": "27c9282d-ca67-4975-b102-41d9585c7496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb05b8ac-cc68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679898597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898597, "uuid": "ff9d9a2d-b2fd-43dc-88fd-7f4810d08693", "comment": "Malware payload (Mekotio)", "value": "926c1ddf5ff1f4fdee1012ddd0ce8090", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898597, "uuid": "53eac4cf-91e3-4580-b10e-4a04a8357aa2", "comment": "Malware payload (Mekotio)", "value": "a926b9750594cd248d67091d69fc954a855c6dea9be624bc575546af575c434e", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898597, "uuid": "9c7fe72e-cbae-4eda-b612-e9fd4a2d9958", "comment": "Malware payload (Mekotio)", "value": "4883014cf32da14097ab0a49dd706cd5ba90a93c", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898597, "uuid": "78c4962d-f9ec-4efd-9af7-386a7db07e95", "comment": "Malware payload (Mekotio)", "value": "de9360f9648f1733780770fe761497a939139c08854d1de0415f0e9fa36d1d592354478623f2999637047989901acda9", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898597, "uuid": "dc3e50fc-7c9f-4d88-978d-a371df8dba52", "value": "T11A26231276CACB3BC05A05B0651F97AB052ABD6447B2C4EB23C85E1E2E738D14376FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898597, "uuid": "592cc43c-5ff5-4df8-b505-56a2b67f0d9c", "value": "98304:xY3+BnoIi0f+h0e3kzp6dTuzaOrfuNH7sIWQ0jxQmLbqtMHA:mf0f+hjc6dTupsgIWlqmLbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679898597, "uuid": "5059c60d-faa4-4928-9f51-05e14ac2a125", "value": 4455424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679898597, "uuid": "7e1f8dc5-b48f-4a29-9090-b6c81d5e4004", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898597, "uuid": "99f8b430-0ecd-4566-8265-b9a1be07c824", "value": "FACT64213.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979cdc29-cc5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679892927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679892927, "uuid": "73b4bed7-d620-43d3-aa4e-fe6f3d27f9b8", "comment": "Malware payload (GCleaner)", "value": "87ab999411c98cd71165d80cc28ccdf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679892927, "uuid": "17d57945-5623-49b2-a413-edf243da63de", "comment": "Malware payload (GCleaner)", "value": "a9f02f4197438a00803cc5797895b65016c05c310a306d3b52ffe7c8b0643893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679892927, "uuid": "e2643384-8870-4d34-bc48-3b6b5e74a4d2", "comment": "Malware payload (GCleaner)", "value": "a87c9617638c5b0800a771cc9b743c2d31c605db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679892927, "uuid": "a7be6451-1d72-4968-8fa9-4941d1975da0", "comment": "Malware payload (GCleaner)", "value": "4c7a408ee926bfa0858c37560434d8cbef4fc0e701584dfb76dcbfa254513f5d37854b2a936cc1a002f8228b067c446a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679892927, "uuid": "33b4e9a9-1ea6-4843-a56a-27777922a69b", "value": "T154853305E2C24C30E8F75D707F620619C34AB3A15ABD21D9F46E8BCEAF1A11E496F746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679892927, "uuid": "23808900-dd30-47be-a35e-2a62e9c3a7ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679892927, "uuid": "063b7884-4a1f-45a9-8672-6162da9b647b", "value": "49152:EGlJfs0l7JOzFt98Uyz/oE0xpma7SYtqfAms4KE5dlLYp:5H7KFtCz/o18aGYt6AmhPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679892927, "uuid": "378d6131-e305-4ca6-acc9-b73ad11645e7", "value": 1861112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679892927, "uuid": "5da304f9-bf5e-4968-939f-5cd9b437fb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679892927, "uuid": "8f39cbd8-a4ff-46fc-9752-f5c3801bbfba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc33805d-cc45-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679883647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883647, "uuid": "9a56723e-ed68-45be-a0db-72d46bf135fd", "comment": "Malware payload (RedLineStealer)", "value": "16c3ed8ce5be94b63b9254129ad089b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883647, "uuid": "50a019d0-ae01-4ab4-8da3-ef35caa82e11", "comment": "Malware payload (RedLineStealer)", "value": "aa0d375e2bd7a3053398cdff8b475f63d09c9102190d964021c6b6384a4a69b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883647, "uuid": "44c72aa6-b1b2-49c4-a8a5-6e672fdfee0b", "comment": "Malware payload (RedLineStealer)", "value": "174a005bc3b4eae0416583d369c5af69696b0778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679883647, "uuid": "1e0d43f8-ac41-417c-96cc-21caa5d7a278", "comment": "Malware payload (RedLineStealer)", "value": "fa593f72b7d1127931f971683b7374e5bfe37635be36d9ebc80e41d96f6cd2e8da242552158e0837734ffcff33f55e9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883647, "uuid": "e76c25e0-164f-4119-8588-2f08cc35bdef", "value": "T13BF4F12A63F46830E4774732BF2EC7F82A2FF8525E467B5E3658593B0A70661ED21305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883647, "uuid": "5c05dd27-2de4-491d-bf39-c6b83ef0103c", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883647, "uuid": "a41ddf44-5665-44fa-96d9-60cb12e224a5", "value": "12288:GBmM8+Umj0aGZ9vnQ8nEhZOHjt0qRKctOcVp+kmt7QyHHTroIyAAdv3cz:unUmQa09vQj67tQrt7QmHgnAAdfcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679883647, "uuid": "1de94095-70f1-49f7-88b1-4f89b8d4f90d", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679883647, "uuid": "0e96cf64-f6c5-467f-83b2-96d7af5b721e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679883647, "uuid": "61c09784-5b3c-4ca9-9e0e-070ebe8580eb", "value": "16c3ed8ce5be94b63b9254129ad089b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d204f6-cc76-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1679904272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904272, "uuid": "226ccfcd-0316-4550-b2a6-7aba47cb3992", "comment": "Malware payload (Mekotio)", "value": "a03bf3f3e035298f03601b29e7b86800", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904272, "uuid": "ea458cd8-cb8a-4e3b-9a92-924f4d002543", "comment": "Malware payload (Mekotio)", "value": "aa0f750aa4d7fbfd81792f153535aa6286151cc7cc544b4170fe59bb5a06ac2f", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904272, "uuid": "5bd6ef62-dac9-49aa-938a-f52ba0ffb31c", "comment": "Malware payload (Mekotio)", "value": "f8f4b84bc3a3e4e2d32bda9a088074651287a117", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904272, "uuid": "520a009b-d9a4-4169-9277-7322f0dba5d2", "comment": "Malware payload (Mekotio)", "value": "d56862516044a2044770364101e737e31418aa8edb75af07a876e532b56931a405d9fccb89fed7a7baea238a2ce699fd", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "sospeso35158", "colour": "#B42E77", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904272, "uuid": "f0445960-cbf9-4281-8609-04f16c55f88b", "value": "T1751633C117C2C95AC1025DA8E947365F287E88E22032D71B1CFA9F9E7E67EE5C4493C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904272, "uuid": "6df0f30b-bd45-4611-ad5e-56492123856e", "value": "98304:nTF+G2yxiZymroBv6zpu9yabfsF1fWqwQoRxu0t/:oHyxiZpi6zpu54Yqwv20t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904272, "uuid": "ac55e7d0-2e3a-4bd3-9ebf-7917395db0d3", "value": 4121301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904272, "uuid": "08d1d23a-8f52-4ffe-ad37-93b8b8724313", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904272, "uuid": "fca5c9c1-c9e7-4dda-836b-473206698a80", "value": "ID-FACT.1679904180.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5e9452-cc9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1679920047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920047, "uuid": "56cb2784-7a31-419f-bd41-6a1e3c9479fb", "comment": "Malware payload (GCleaner)", "value": "c3ac9820210102d288551f6eae5ff38e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920047, "uuid": "1dacfdbe-7bf8-4515-955c-9226ee78e931", "comment": "Malware payload (GCleaner)", "value": "aa1f0bddc9a79c80d9ea7b5bed05c86d41d03e558ac3471bf627b7f5d85a6cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920047, "uuid": "b5961612-10c5-470e-8531-4316636ec5cd", "comment": "Malware payload (GCleaner)", "value": "4dc9cdfb00290e39ef9c0b8bbd10192bd9f623c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920047, "uuid": "a4e0bd35-3005-41d3-8a85-143494007ac1", "comment": "Malware payload (GCleaner)", "value": "7cf8b7ae58a4ab31618327866ca51a0089c2cf1615ccec4748986cb152a54f04ef7cd6f8138f56257652fc5365f648eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920047, "uuid": "c5f2cdd1-fba4-49c2-b745-af7ac90112ea", "value": "T1459533459A5949F7E4F3D8727E495E4ED92BFE264BB8202CA8AE4C4D2D27C50CDC03D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920047, "uuid": "a1b46dc6-0ae6-45a0-b112-db6dd5f9d652", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920047, "uuid": "aa39d441-d7c3-435d-b5b4-862e3233b264", "value": "49152:EGlJfsYpw5gXXar/dOdpdyy/vyT5dlLYp:5hpbHy/dAyyWPYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920047, "uuid": "bd150b5b-2f11-449e-bfe8-7ee47d51bc77", "value": 1874866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920047, "uuid": "bed2530c-0286-4276-b95a-1b7ab78eea99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920047, "uuid": "65898ebe-62de-46bb-b2fa-3bddc822f502", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3525f749-ccd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679944731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679944731, "uuid": "4ee0bc6c-c95d-46e1-8b38-591332182f18", "comment": "Malware payload", "value": "bf385620a704c6dd8a2a66440246f694", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679944731, "uuid": "59c2a101-5d68-401f-b8cf-e09979f60358", "comment": "Malware payload", "value": "aaae1d278bf201446eccdd7832985bce9e9e5318b9d5131d15ba6481a71007f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679944731, "uuid": "7995a7ae-95c6-46fe-979d-df751407f2ea", "comment": "Malware payload", "value": "42210b16d2f6d71a7a3a3d309469724942a21ca9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679944731, "uuid": "996c0f95-618f-4536-a9c7-ecfb407ca347", "comment": "Malware payload", "value": "52c8fbd6de2144671af8e8dd7368fe4d269cb7d4d5a876eaaecbfd915263ab23231fc755fa56da4b6441e18801248a63", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679944731, "uuid": "a888cb00-88a2-478b-92da-562050bce55a", "value": "T16A94D0449BC89F55CEE80A1BD0BC2E2C37B10786C066A2CD7B577A0B6FAFD4C551B588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679944731, "uuid": "931f6045-6f6c-478a-b4b2-3559478b254c", "value": "6144:ZxNPiP63nT5hZv3bhVCB9oyToJczlNWfJy1lQZKXVw2Mg/OZ8iLwTYiU7yRxTLui:ZjZTTZzhU4B6zlNi4w8Vr4g79ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679944731, "uuid": "7d7f96f0-2582-4ca0-908d-ff3460530674", "value": 422542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679944731, "uuid": "6bea3590-f6b3-46c0-b4b9-641d4754f487", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679944731, "uuid": "a4102326-e2a0-4d88-a8de-5af3b9cc0f43", "value": "mj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422f23dd-cca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679924137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924137, "uuid": "d9d1d437-35e3-42be-bdb0-277d966d1cc4", "comment": "Malware payload (Amadey)", "value": "60a8faffcc0215a5b11541c48f8f77a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924137, "uuid": "7d4688a8-2e64-45ae-97bd-7fbf0b2c9d46", "comment": "Malware payload (Amadey)", "value": "abb18917606c6031ab4139c3a5da92902af409ab055b48893924ed706b68cad0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924137, "uuid": "27acb37b-bfb5-4a1f-a5c7-cd54f6b14053", "comment": "Malware payload (Amadey)", "value": "cf8e9c6a2cd4714021811c7e66feac5e17bf4552", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924137, "uuid": "110c8ab1-9261-448d-af0f-64dc31335a8f", "comment": "Malware payload (Amadey)", "value": "16062fcb6f470fc75c5ee25fc87638e3b54cf3d6de9478518a98c5c5eaa809405ef154bc97fd9cec246e04172ff3289c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924137, "uuid": "dc716802-d58f-4534-8a8f-df9004527b54", "value": "T16A25235363D88172E1B92BF029FA03871F3ABCD689B447532307E9491CB26E0593777A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924137, "uuid": "ef7caf36-cc00-40f6-b36a-9277432b60ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924137, "uuid": "11599922-85aa-4692-8740-383596b9dd99", "value": "24576:Iyj5XnS5LY9/Qkvm/i/AxICW9ZR1hF/H+6:PjRnMqQk61mhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679924137, "uuid": "591b161c-0598-47be-ac97-ac1ca608dccb", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679924137, "uuid": "2cac4638-afb2-4ccf-a7c4-4d587b951afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924137, "uuid": "7ca2de37-6a07-4d91-99d8-25ac2ac991d2", "value": "60a8faffcc0215a5b11541c48f8f77a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b4d773-cc90-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679915659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915659, "uuid": "8779e772-4074-4934-97ac-39ce58dd3c07", "comment": "Malware payload (AveMariaRAT)", "value": "53622e61772d39cd6868b89aaabb8249", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915659, "uuid": "694504e0-921b-40a0-9e2e-c17f9c14b009", "comment": "Malware payload (AveMariaRAT)", "value": "ac48e7fdd258315b54625d2c9cc84d555d44b1a82c4e834238500f32d088d58b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915659, "uuid": "50cb9c6a-5593-4cf9-9169-97e7409fa9bc", "comment": "Malware payload (AveMariaRAT)", "value": "97d7be3cbfc038c741d0a0ba0404c147eb2d9b1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915659, "uuid": "e84e0541-8a1e-48c3-baf0-0d87ce4b9efa", "comment": "Malware payload (AveMariaRAT)", "value": "9db73025d5096aa1394faf20b5d4e50deb35404747a8b04c75264c535d122b81d3674d78ff6f26fb2623b448f09e2721", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915659, "uuid": "a99c2632-42b4-4fdc-ba2f-45867c213992", "value": "T1AD14D0F8A2F949D4F5B51E70B5A6CB352435FF7A9C63B31E3EA5B080663271C8841292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915659, "uuid": "f4c7c900-3ac6-44ae-8448-233c61207cf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915659, "uuid": "81414065-8426-422b-a086-86533d1e8637", "value": "6144:QkdnyRSXGwbtZt2hP4hY9eII6cuH58KCNRJynB:Q3SXt5E4hoeEdmV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915659, "uuid": "c4badaa6-76db-4d07-9685-555c4a6437d2", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915659, "uuid": "b6ed195d-6c75-49e5-9e6e-a31cef94e141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915659, "uuid": "f1fd8ff2-cbec-43bd-bb06-ebee3d52bf83", "value": "53622e61772d39cd6868b89aaabb8249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7798f8-ccca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679940720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940720, "uuid": "f0033318-fed2-43c0-9927-92fd1982e4bd", "comment": "Malware payload", "value": "7255172fe4b5c237ecef6b64cd2814af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940720, "uuid": "dd36f3f4-809b-4c6c-b072-d223d34550de", "comment": "Malware payload", "value": "ac9bb996580aa80856b642b0e8de1508701a469aded09834f0ac08e7901e17e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940720, "uuid": "0e2b8cb9-374b-4533-bb6a-3a44b94bed21", "comment": "Malware payload", "value": "0260b3a01e97ab56242f1430677caca843e03de6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940720, "uuid": "b89e0441-f047-4e55-a21b-642b069ac6a0", "comment": "Malware payload", "value": "cd8a962953c376781b646f5703e15e57ef085a162312fdb2c16d95222f42f78ae399479bde3a95f109f321f5a29e262d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940720, "uuid": "d78522d5-5155-49dd-b1ae-f300bd164eda", "value": "T111552A26FBABA9B2D2595732F7D60C1443E0F9816327D61FB5CA235A08437B78E43607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940720, "uuid": "4de3fae6-0625-445f-b2a3-183deb3534bf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940720, "uuid": "88facb84-d867-4c9c-b943-9049759a98ba", "value": "24576:CUZdLqEHvfaNb+xAuv4nUkwgL0s7fRdr3xbdVliDw:VFHvib+xAbas7pdr3TVID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940720, "uuid": "3ba3e8ad-c47e-4c1e-82ce-7f43a01f93ea", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940720, "uuid": "7a92a236-d115-4020-b3c2-534b6f5301ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940720, "uuid": "18637a6b-2b04-475c-831a-47095d9daeab", "value": "AgentTesla.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03b82a7-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679928214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928214, "uuid": "d1382e45-db80-4cf7-b801-17e8865603e4", "comment": "Malware payload (AgentTesla)", "value": "f8ce470d80b71f2872dd43b1733b5e70", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928214, "uuid": "18f818ed-809a-460d-924c-18a97dce2000", "comment": "Malware payload (AgentTesla)", "value": "adc0e74081dd6c507dda1fbf41a7b9a1386aa4ca58edf5bd0ce3743411b5bc79", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928214, "uuid": "b44cd366-37e4-4bbf-b1a2-2650ce6ee339", "comment": "Malware payload (AgentTesla)", "value": "9323ed79ed557497192e6ebf687b9a59d8dc8cf2", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928214, "uuid": "d8a36d07-08b4-4dba-9b29-5865730a76ff", "comment": "Malware payload (AgentTesla)", "value": "9a09f0e8c4bed52308a319acde7a852c7b196636f030874ccb30c0c3eccf7139c45a5f0ec88f6f1303bee34b8e21d24c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928214, "uuid": "d10c0524-3d25-4c31-9de1-98402d8dff11", "value": "T12C4583C07AB84519E0AF2F7568310EA5E5B7FC5E9466930F18073EDEAEBD79004623D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928214, "uuid": "b7c0ac7d-e5db-4a9a-bed4-e075ab2720ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928214, "uuid": "f4c09d10-a8d7-42c2-9041-e6ac72b5751a", "value": "12288:PAm9M526jqjr8bEmTBizx4zCy9feQsc78mabde119ebmiOZgIu0:PAeMRqjrm4zuzYc72bd+3eIu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928214, "uuid": "e1f7fa34-deae-4d38-8eea-d8eaa2257efd", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928214, "uuid": "6e9e832e-ae2a-4e90-ad3f-54ab2a649666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928214, "uuid": "2c61c21e-c688-4f4e-a394-bdf16ec54a5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a87e23-cc3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679879118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879118, "uuid": "04caaf93-5186-4a1e-a83d-0f7239d368db", "comment": "Malware payload (Smoke Loader)", "value": "15916f777cabe2a8be34b7de615794a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879118, "uuid": "0ce0fc83-de90-49f9-9965-319fbdaf7c8f", "comment": "Malware payload (Smoke Loader)", "value": "ae7799f085224aa3f6c244a0e7cc5a495e0be1b32239b5132d50c40c8fb401c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879118, "uuid": "fa6bb280-5ca5-444f-a6e1-54556e7b5a3a", "comment": "Malware payload (Smoke Loader)", "value": "b85ac92732d1ebd92eceef1e29ac081999191f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879118, "uuid": "6578246b-2e22-4304-8045-ad1200b55b43", "comment": "Malware payload (Smoke Loader)", "value": "c900497cbbb74c16352c699a2afa0e367c02367fb357f0ca45a8310fefa17072ce9bb72ce4cffa0327a48c06ef903660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879118, "uuid": "7dc93761-dfa8-43c1-8d03-210815f2f933", "value": "T1AC546C3253F0A860E562E7328E2FC7FC2A2FB9619D156B7E13555A7F09702A1C172335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879118, "uuid": "2e5e57e6-108f-42a9-a559-f92eaa23493d", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879118, "uuid": "1b5fe230-5081-44fd-a726-3e0d48efcb6a", "value": "3072:O3YPCOt43uLvsLuxVu6F5bZJc2K3Vss4zBHYntdLPuPPngN7T/UypNN4Th3:Jguv2uxXcnesAsmPPngN7T/FNN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879118, "uuid": "8ff51949-1f07-441e-a657-5ace30902b6a", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879118, "uuid": "54cbdea4-8b0f-418c-859b-3d5a347cb5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879118, "uuid": "0060e9ee-4895-46aa-90c2-6e9859bd8ec0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9efadd0-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679913252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913252, "uuid": "7e3e5a81-c336-4143-91a4-df83e2c43ff0", "comment": "Malware payload (Rhadamanthys)", "value": "2b1bb8697d53c73296cbfdd2b6ec6e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913252, "uuid": "402b10ed-c542-4001-8757-d305d71fc615", "comment": "Malware payload (Rhadamanthys)", "value": "aea15de1d2755ed033575ffd61efc47489500d5eb80d790a5764b8c778f43806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913252, "uuid": "4081eaa7-e152-4458-8920-caf84885c1aa", "comment": "Malware payload (Rhadamanthys)", "value": "89e7fd740567c0e52925f111b9a1f5be5d8e7730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913252, "uuid": "ae602bdf-e021-4826-b502-9600181e2ab3", "comment": "Malware payload (Rhadamanthys)", "value": "817838a58bb94ba562830b1e97bc144c47113fb63ee5a0ef2464b475d5f914aa143644e5c964dd7cb491260be2d7d0ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913252, "uuid": "10f81b1d-99be-4714-b4a1-db591b711736", "value": "T1D574AE2E93F46830E5734732BE2EC7F42A1FB8515D177B9E2649AA3F0970661DD62310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913252, "uuid": "1032bc10-e57f-42dc-b64a-cad5e186aa59", "value": "a45b0eab0ff7170ea4d75272be8d3235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913252, "uuid": "af1601f6-019f-4dfc-a632-6ecd07ec1103", "value": "3072:GIV7LkDq+tFl31VnLeXam/vvRdjUaF5QWUatYW/pvETEUTObc6QGb+7LHyEwERW+:KD5vlVLeXhci1VUThMbEbsCbnxd14R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913252, "uuid": "8d9666e4-9f46-4ae4-8556-ad4335c88ce2", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913252, "uuid": "5e9d3f99-d8e0-4ac3-8d0a-1da2b4df4a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913252, "uuid": "bc3dcbe0-37a4-4f2e-a228-a6254d37efce", "value": "2b1bb8697d53c73296cbfdd2b6ec6e52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c94e40-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679901814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901814, "uuid": "7a882117-2914-4775-8687-7ec367ce568f", "comment": "Malware payload (Mirai)", "value": "e484252769db92f3e721f1d90e74db53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901814, "uuid": "6d1eb05f-5e1a-46ca-b2e0-b17d373549c9", "comment": "Malware payload (Mirai)", "value": "b0106e85122d36a64f3795faa99034350d873075b43e249b4c8700fafd2bdade", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901814, "uuid": "71bdf406-ef09-437b-a3e9-5994653714a2", "comment": "Malware payload (Mirai)", "value": "d94b54d259344fa7660d010f47aeeb849ed540fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901814, "uuid": "5d192bd9-579c-4afc-8e64-384870a88a61", "comment": "Malware payload (Mirai)", "value": "0a96c663c91f2c50f9f3c4f39998074aa5937ad5850401265ba763cca22dce6a40b41872bc888e078717de096d2097a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901814, "uuid": "62641c92-7a6d-45a4-88aa-cf0a72b6f015", "value": "T1EC83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901814, "uuid": "95fc4acb-7943-410b-bbee-b87515faa9f8", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4EH6gTE7ZDYovZ73x/nL8y8Qc:Rakdn2Eo3eQaV6TERYo99Be037WVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901814, "uuid": "1b2295a0-c86c-4a6e-bfbf-fb971a5a1f33", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901814, "uuid": "fb502e2d-5f17-4652-af64-10e6a86dc1ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901814, "uuid": "c30b6b94-f959-4739-b8db-0ac57a87d381", "value": "e484252769db92f3e721f1d90e74db53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f576d52-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912509, "uuid": "d4a38eb5-3d99-454c-8eb1-c204d09c3143", "comment": "Malware payload (SnakeKeylogger)", "value": "57973506f0d7e96c60721edfc3192ccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912509, "uuid": "1662de54-2ff1-4376-bb1a-a54586eea463", "comment": "Malware payload (SnakeKeylogger)", "value": "b0ceb7f37cc95869d4dbf51faa6ed5f5c2df7ac24bbba2b0f77dcca7471c9f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912509, "uuid": "403380ff-3538-4890-9786-a1aa46d96696", "comment": "Malware payload (SnakeKeylogger)", "value": "aa718d2ab82483a24e5423d5399183ab92abbb78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912509, "uuid": "b29f7bd1-3c8a-4266-9d3d-b35eacc10ed3", "comment": "Malware payload (SnakeKeylogger)", "value": "52cf671d760d2214c23f6575d4100ee766459ac7e39cbdeb971dda97d58b4b2c1d3122f73124ce7d9ac016a433d73a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912509, "uuid": "c7f95c04-0caa-4c14-b318-75330852094c", "value": "T190358ED1F1908896EE6B06F16D3AA93020EBBEDD55A4C00C599E775766F3302209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912509, "uuid": "329b4cde-f9b4-4663-9a2c-75022a0ef279", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912509, "uuid": "722c3852-16b7-41f5-a2ad-8795cf6a7ae7", "value": "12288:JA5CB0OnK1isLbwivtJtT/KHOy3dsOgE20LxfKSTkt2R98VSAKJhZ:JA5ahKL9vhPy3XgPmxySIt2X8v8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912509, "uuid": "30269e02-4775-400f-a124-6b598772b0b4", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912509, "uuid": "204321d1-780f-4943-b229-40b1223eb254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912509, "uuid": "f771eff2-a540-48ec-80db-56a289dccd98", "value": "hracat belgeleri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd20943-ccab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679927351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927351, "uuid": "578179cc-0efd-46a1-b6e0-db3a4d9f7838", "comment": "Malware payload (Amadey)", "value": "988f1622b98be1cec133fc839e0fc918", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927351, "uuid": "ae597b78-f1c6-4c35-ac36-2cec5f1fb5b0", "comment": "Malware payload (Amadey)", "value": "b1b014d8c81723e8285abbf170aca64dd601ee8980e6bba866b214425cd53af5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927351, "uuid": "c66bc375-2d40-44b0-8306-2d6e6f6d690c", "comment": "Malware payload (Amadey)", "value": "63c6eac78de3511f43d27bd16da72f0eb73bab1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927351, "uuid": "5b0ab8d6-e37d-45da-b98f-0e68f9339e26", "comment": "Malware payload (Amadey)", "value": "ebad3519abb85684d06e78539ccdab096e282bcb268e4bcd07bab90003175a044c5cb9c10b53d7e1c544563645e2cb2b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927351, "uuid": "aa307905-1cca-4872-bb6a-f2f95d0a4031", "value": "T18444DF2276D1C872E76B01354961CBF4A93BB8705B5986CB2B80437E0E717E2DB3A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927351, "uuid": "1d63585c-52b2-4cbc-b943-f1506497e2f1", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927351, "uuid": "d3721993-9b80-4e2c-9a0f-3317e9ac1f56", "value": "3072:PFQ8NoU+oWuudk4LxGRCVs/sePHyhKyAt8fvMk9qOGzIj5qbni:dvN0u2k4LMRgs/se/nCvrVGf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679927351, "uuid": "2622ba99-f444-443a-b40a-6e694836af97", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679927351, "uuid": "ec5227bf-7941-4631-af7f-9a61a576cf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927351, "uuid": "2eca1dbe-f8f6-41ac-876e-712391174564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b72660-cc6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679900922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900922, "uuid": "cc1519d7-fc44-49be-9261-f1646b8e4edf", "comment": "Malware payload (Mirai)", "value": "27f8d14807778c561febb2a4598ab022", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900922, "uuid": "e0c80052-bdb7-4b4d-8474-d6601d3002ff", "comment": "Malware payload (Mirai)", "value": "b1e3c1f0c94806955ffd1a0edb4482915c63d777719bceb4328c6201c21f618c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900922, "uuid": "ab797dac-b1e4-4564-a45c-2b72a8263a98", "comment": "Malware payload (Mirai)", "value": "337ab75951e90b660d47977645f33e2598ad645c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900922, "uuid": "fc57394b-069a-48f3-a287-b96de4548dda", "comment": "Malware payload (Mirai)", "value": "764d2f2277dce841412be56edf934e782cfd8889a8f7ab1ea76b35c5a4282c1c6a6d4c87d3270891ea30547e6d51a672", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900922, "uuid": "bfb32612-3c0b-4725-9930-d26e4c037140", "value": "T124534B17B58280FDC09AC1744B2BBA3AD93775FD0378B2A677D0EB262CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900922, "uuid": "40efd2b1-08fa-4d83-93a8-5357c90b7c40", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/XDiQHLiKimfFoktCe3fYRME:WShU3q7cEDlCK/XDP9i8Fok06fYRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679900922, "uuid": "cc511306-74fe-40cb-ba1c-bd3663861a49", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679900922, "uuid": "f735ba7e-075a-4f62-9933-e346e914ca5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900922, "uuid": "75f17842-2a00-40b1-9cfc-94d4633e62c0", "value": "27f8d14807778c561febb2a4598ab022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68512e16-ccc8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679939663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679939663, "uuid": "cd3b08b6-115d-45be-bcf7-41d287a2e544", "comment": "Malware payload", "value": "e7a268eac51c371df3663753800935f6", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679939663, "uuid": "4f4518d1-fe3d-428b-abf9-aa482c5cb866", "comment": "Malware payload", "value": "b27e6468ed1edbb0a1e743b361342f71c354d1c767106b82d528c5edade74585", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679939663, "uuid": "5e62b5e9-8733-492f-bf0e-487bb7ce4509", "comment": "Malware payload", "value": "8300e98819c4f2ed31d14bfb9d874f12b040be30", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679939663, "uuid": "72786c18-523f-423a-9a47-06ee90f66120", "comment": "Malware payload", "value": "b662dd0b80cd3a021b1b095d67451c8a02998749771b734557929e57a5bc75d3035323f1e936178dc6d8d533b9ebf6eb", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679939663, "uuid": "91c78272-5306-4b0b-8519-971526c6d5f1", "value": "T182129F1FC16D194AF4A1E5E8248607E84247BAC5115A810C8FAFBCB51ACE3DDFC55E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679939663, "uuid": "6c3f021b-bb6a-41c2-bb9c-939252fdf18b", "value": "192:2wiZdmCJ/XzbYv7bI3lPPmsbzVNX0F/YHyP/ih:kmYYjbsbZUYHyP/ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679939663, "uuid": "993b3170-abff-444c-954b-63db53b88df7", "value": 9358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679939663, "uuid": "cec06d53-44ef-4d62-9b5b-6324a72b575f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679939663, "uuid": "93386fa8-ee4d-449d-ac02-0942d665f9af", "value": "Old Prices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e71dd7-ccb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679930069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930069, "uuid": "93a9d6c1-a57f-4f26-ac9b-ed907bcca1ca", "comment": "Malware payload (Formbook)", "value": "91da3743bb05e6744e50fe749f5a9cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930069, "uuid": "c4c13e07-00c8-4ec3-a8c0-a5ff083e3876", "comment": "Malware payload (Formbook)", "value": "b3811fa28d3e22cf5029476f6870c54e7fcd4d68da1342bb199ca6d41ed9ff56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930069, "uuid": "bb825694-fe06-424f-aaab-814faf93cd11", "comment": "Malware payload (Formbook)", "value": "fbb00ec09354ded8bf1b7f18f2e9cb2ef0e3d3b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930069, "uuid": "7f57e344-31cd-4439-853a-59cf4f8dfb9f", "comment": "Malware payload (Formbook)", "value": "a65221aa862a941cbdd04666efcd1bb17ffcea4277f370a3e203fe61ac382e43f7f456dfc42879618da93a73bec7b4ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930069, "uuid": "87844f67-858d-4059-8c57-e4f6b238bd7c", "value": "T1DA05122BD6189B20D76887F822908944D7BC7DF96B66EE49AE9C30D701FBF50494370B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930069, "uuid": "83fa8b26-5f33-47a2-9f5d-4b4469d9710b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930069, "uuid": "fe1bc58c-6c73-4ed9-bd16-482fb01dc157", "value": "12288:LUJB0Oq8p2ZEtCgO27/mW9XqUjX5OFUuOWGt0p4VedclBeHlOrh1CuQvpAoJhZ:AZpTtV7fjc36veA1Gx9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679930069, "uuid": "69ae2665-e3e4-4155-a450-cdab508b755f", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679930069, "uuid": "82223de7-9380-40ce-bcfc-3f64f71db774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930069, "uuid": "c2693aa9-6506-4136-bdf7-9c384cc6adb9", "value": "Orden de compra del proveedor OC_No 1435 27-03-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba37194-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912422, "uuid": "40280435-9b9b-4a52-962e-4e2af716e44f", "comment": "Malware payload (SnakeKeylogger)", "value": "d07c8dc3d3e090d8a2afd8a1494c2279", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912422, "uuid": "39ef146a-b1af-4608-aef4-b1a498c8794f", "comment": "Malware payload (SnakeKeylogger)", "value": "b595e8b8ad88fefac3219604d933bfc466cc0927a6cf5aadd9b2f34ad6f71768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912422, "uuid": "9c7b6ee4-0c06-42c4-b6ee-b67bffc421a4", "comment": "Malware payload (SnakeKeylogger)", "value": "b3a942fe922810ca0409f1932082d546d415007e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912422, "uuid": "f16cf2f5-d0eb-49b5-86ed-421f3838e6a2", "comment": "Malware payload (SnakeKeylogger)", "value": "25c0e1fb000bca732c9ab09f5b00cd252a9ef8479fca640b9ba9c4b1de4798334b472ddd89bbe3a48442fc4bab50670b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912422, "uuid": "d8827417-f4ec-4ac9-89b9-518ff5216ff9", "value": "T18806A63079EAD829F077AF759EE0F596896FFA622702954F105433460A73B40EDC1E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912422, "uuid": "1f280e49-f1c5-4b8d-94ff-afb54dc0aa06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912422, "uuid": "2b021119-24bb-4dc9-912d-7e92172bb0fb", "value": "49152:Gbq1cHmhE+fNTzzytNt8j+giUT3BGPAt1MBDh9OzdnxVypvC:u+Xypv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912422, "uuid": "830bfe9c-82d0-463e-8dac-ebac9efda1c3", "value": 3875840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912422, "uuid": "8b8b057b-dd62-4da8-a52b-84324223f5c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912422, "uuid": "8a26cb6d-3b63-44c0-94f0-c625c4fd4d97", "value": "d07c8dc3d3e090d8a2afd8a1494c2279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608c1b3b-cca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1679923758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923758, "uuid": "3fedd1c3-9db4-4826-8954-3778e6058d71", "comment": "Malware payload (Vidar)", "value": "7811c8e24019a783e1c72e7eeb58215f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923758, "uuid": "c28e1ea4-dcc1-4e60-86b4-ae8560a6ce97", "comment": "Malware payload (Vidar)", "value": "b70354fa72344ed5262ef55243ab71e20149fcd87ec772b4b77ea44c93ff79b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923758, "uuid": "7743bee6-7fa6-44fb-90e3-24efe1f16630", "comment": "Malware payload (Vidar)", "value": "d21422ed627d291a80e08fa77d3cfc126e94d4cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923758, "uuid": "a6d117be-a22e-4629-85e9-66bd503bcbc6", "comment": "Malware payload (Vidar)", "value": "af76506d86b9dd6423312682ee23d81d65d3c7086c801b9e49d1cc51aabc5ddcf7a22602f216d0504b5964679d88ae52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923758, "uuid": "77c42f8a-47b4-4848-89c3-4aa8e1c0161e", "value": "T1998502293693CAC7F8BCF1341E5E66022A2273D07D8289CB3650A71D1D9DCD35762FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923758, "uuid": "2d8b68a2-3d02-4820-bd75-86274309a444", "value": "9c5b1e43674bd84aa54816aa5a401ae6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923758, "uuid": "abc875e4-d4ba-4d96-8a4a-b636f450a5db", "value": "24576:IzYyxHFKIlJX0oXMAsksIyESF/PvWGS5JcT1pWNpFj6zpe3rNNyJfOxmsAYQCOUO:+YyjxM3kMF/Eb+o3QYQJURnCyZrxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923758, "uuid": "26db54e7-55e8-4219-827d-8466996c52f0", "value": 1805224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923758, "uuid": "e7827752-2206-4b38-a212-fc1bd78e04d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923758, "uuid": "ba06856e-8dd5-49a6-bff8-fd6b33178996", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcadcd7f-ccb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679932986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932986, "uuid": "80e4f8de-b055-4dc7-bfd6-51da7ef2e07a", "comment": "Malware payload (AgentTesla)", "value": "ab92b205a179da227d2e5f7b83a6f251", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932986, "uuid": "2c1ffedb-608c-4f9f-8104-4d0cb8931d52", "comment": "Malware payload (AgentTesla)", "value": "b70a16122bd7d485a520eb177209f1c39bd74dbe0ef8502c56a8706f4c9450bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932986, "uuid": "82e7a9d1-51d2-4a5e-9005-1aed75d4ad75", "comment": "Malware payload (AgentTesla)", "value": "42527dc009ad1df479c1ac84e8d787258ef6804c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932986, "uuid": "b3ad3964-b11e-40df-a2a0-57a6be131160", "comment": "Malware payload (AgentTesla)", "value": "96e3e51ffd997ad22f6656d974fbb6dfcd99cec35cbdf4d1234f8024d8d29f30286270d52b5413ab36c09fc4c334ca39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932986, "uuid": "f130fc60-dab0-4b28-85e6-5ceb23edcc7d", "value": "T178E46C7D2DB89E26F835D2798BE0C137B0A1D7D77B218B18079B134C8E0295674DE1AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932986, "uuid": "7c40d132-6218-4b2c-bf84-8c8f1b5c326f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932986, "uuid": "8fcb0b48-ce43-4e66-bce7-793071989d57", "value": "12288:zzSeLEgNGSD7QK/xNei0XpfiLPDDwTusreui8Hc1:qegMM+xR0XePDDwh1Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679932986, "uuid": "96cc85e6-be65-43fc-b47e-c28a192f5059", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679932986, "uuid": "6e5afb38-5ac8-40b2-89bd-1dcc34d2b302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932986, "uuid": "6a3effcb-a9ae-460e-bb04-c20b8f00fd5d", "value": "Pending Balance Updated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109f0ba4-cc6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679900432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900432, "uuid": "57d1b5bf-fee9-4862-aacd-9242251facbe", "comment": "Malware payload (Amadey)", "value": "5473585678cfada6f791d10f116d11a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900432, "uuid": "4312d184-e5bc-4db6-b880-45e7d048da14", "comment": "Malware payload (Amadey)", "value": "b7c6c872fd2112e29b2bddd7cc95ebebbcf07805f718b0c4757bf1463ce397fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900432, "uuid": "057327fb-db3f-4eba-8fcf-74f7e6d76ae1", "comment": "Malware payload (Amadey)", "value": "22fc18ba79e3fe48e2f2f9d965fc03f2e14a420b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900432, "uuid": "75770fb3-6f2f-4ab2-8bba-39b115487ceb", "comment": "Malware payload (Amadey)", "value": "fbc8a66481ad3ad435a425b385489cb82ffb34eb6c3669e55f3a9ccabec5392463625affd32d221aa1e1e73d591be89e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900432, "uuid": "17a3c5ad-2eae-4f02-b177-a0a2b3fb7b8a", "value": "T17425236273DA8476EDB86BF014FB02D30F35BD614A74C749234AAD4A4CB1BC4957336A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900432, "uuid": "d4b0b894-4d29-4968-a8d7-e50819dd30f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900432, "uuid": "81b462a6-6026-4195-91fe-e08b25d24387", "value": "24576:py9StUR8rGSkWCsJLZCtCfngHOcrgW7iwi94AYN:c94GSkWCm4QU2X9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679900432, "uuid": "9c74a972-e431-4093-814b-e1b7bbce5bf3", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679900432, "uuid": "488d23ed-21ba-4303-acc5-6c339d290cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900432, "uuid": "48fe136a-e244-4063-ade7-9e372b7529ae", "value": "5473585678cfada6f791d10f116d11a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06a035f-ccd8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679946709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946709, "uuid": "bea422a6-2571-49c7-b1d2-1176f91b7057", "comment": "Malware payload (Rhadamanthys)", "value": "0fdfe42750d9a51d9f3007ae5153fac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946709, "uuid": "799da421-adbe-454d-b789-e017aecd7785", "comment": "Malware payload (Rhadamanthys)", "value": "b80c6077ed4c9814a995b866297e0e522c9d23917370767ff05e951ca9412e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946709, "uuid": "336df56e-7f2e-4758-9a2b-73c533a9cd76", "comment": "Malware payload (Rhadamanthys)", "value": "74ecf809721f871ec47187716a55101ca2c7e51a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679946709, "uuid": "4f978cf5-90c2-448e-b503-00096975221e", "comment": "Malware payload (Rhadamanthys)", "value": "485b8dcba3416acc4e446f83c104e2b0cd539524d750185b65e33fe193834a632eb0c0d7ccd5b71e53dc7addb1477d03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946709, "uuid": "3f054e90-e8f0-4d52-98ae-80a21cbad888", "value": "T1C375BF095F64C497FA59D9B276B063A43C5A02A08E51CD9B6EEC2C1039BF7F144633BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946709, "uuid": "5897f093-5bac-4e48-8850-2819d6d87c08", "value": "1e8dcf2021ad0a7f1707a78b4daf4043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946709, "uuid": "ceb1aa0f-a377-414c-b5a9-3813ff25fe7b", "value": "49152:KksJ9boYkPQjKjfJQlunr1aJim51hdEDer/W9eBgA:k98AKbfr1aJP1EarxBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679946709, "uuid": "df20cf53-bbd9-4098-88e9-4ba0276beebd", "value": 1683456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679946709, "uuid": "8882eb23-0f23-4067-9bac-df0bfb974b4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679946709, "uuid": "e19e4c2d-32e0-46b2-9a66-300df6989e92", "value": "PROFORMA 18.exe_0x2ae6000-0x19b000.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcbf322-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894894, "uuid": "04136a1b-b65e-456c-a2c4-fbececb2bf88", "comment": "Malware payload (Formbook)", "value": "ee9acfb93472e119ca6913a8165d34ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894894, "uuid": "9635992d-ecbb-436a-b9f0-5a8e4c80425d", "comment": "Malware payload (Formbook)", "value": "b846523d8b67f881870a47eca4690dde8454c30fbf50660fc023578c145c0143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894894, "uuid": "ee571157-a2a3-475a-a836-69cd465de302", "comment": "Malware payload (Formbook)", "value": "dcf0e3301798da54873c729640434bfab3429238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894894, "uuid": "90a00fa2-f42d-4ef8-9ac3-50f74ca6a345", "comment": "Malware payload (Formbook)", "value": "cfcc1215b03fd369e7879c6ebe6732eed678ab5763d46c4ef46523d302a0a92f08392277e4a10fd8d590aaa323ff352f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894894, "uuid": "7e1e5c82-1f0c-4295-a037-ec7f581b9df0", "value": "T19004AE36DA42C071F2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894894, "uuid": "48f99b88-131c-49f8-b927-82996ffe7b5d", "value": "3072:obX4kQvFJdO43t/c5scFV6hP/zSJRnUweMoeks3jG1ZlRRR:vU2tk5B6hP/Mn9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894894, "uuid": "7e65a312-bf13-41a4-a147-3612804a0a75", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894894, "uuid": "240f7de5-d268-4011-96ac-e4e177762976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894894, "uuid": "1547e356-f4fd-4c1a-a5cf-d4ec0ff00e66", "value": "b846523d8b67f881870a47eca4690dde8454c30fbf50660fc023578c145c0143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a4de42-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679894961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894961, "uuid": "235278d9-39e1-4b5a-8116-3e6af787bed5", "comment": "Malware payload (Smoke Loader)", "value": "11ad8bdbbdfee754a25adcc84624f7b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894961, "uuid": "29b51e48-8a6a-47de-80fb-9774569bc3c5", "comment": "Malware payload (Smoke Loader)", "value": "b87577df851960649e52cebb4796bd489ab28293f708d1a404b0cc06f16aad39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894961, "uuid": "497fb58b-0f80-4655-9b80-d43516399270", "comment": "Malware payload (Smoke Loader)", "value": "08c0a461cda758d3b18f072321d9642841602662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894961, "uuid": "2796157d-27d4-4e23-b831-d3e23e0b2b76", "comment": "Malware payload (Smoke Loader)", "value": "aa301124a17b93f1b7a7df99695d1c1f4b47fe4f3bf3877dc3cf1a10125f06f466dcb478b26f4ba9f96cb505a8a2712e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894961, "uuid": "fa57db68-8268-4b25-a6cf-fec0a8d26246", "value": "T1E244CF1236D1C872D9DA41754825C6F82A3BBCB18B9586CB37543B7EEE303D1DA3A352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894961, "uuid": "169f4856-a17b-4c9f-a78c-f3d6935225cf", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894961, "uuid": "9ebbd6e8-cb2b-4633-af0e-7b8f5171053b", "value": "3072:/hxLhKAJQzyLylplF++o2n8zWWOhBhG5BqBHNET1B+s5xLvjf:jyzyLKlD8zHgPBw1n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894961, "uuid": "24c596dc-59b7-4633-87d1-6afa56a5be92", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894961, "uuid": "27b27ebc-8a93-47df-a93e-0b2c03559103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894961, "uuid": "d15e1853-e462-48da-b674-d9acd36cc55c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8cad21-cc8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1679913342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913342, "uuid": "bc7526f8-1fe9-4a99-9255-829635a7a26d", "comment": "Malware payload (BitRAT)", "value": "2342f3d5723d354f19844400bfc63b8f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913342, "uuid": "752f72ff-a019-4dba-95e4-177ed12c8286", "comment": "Malware payload (BitRAT)", "value": "b88e6baf28fcfa45e9f951160e8dc0b017218171d4c4636fb628136c2bf6c1ac", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913342, "uuid": "0e254bab-adac-4fd0-9362-931cb1468655", "comment": "Malware payload (BitRAT)", "value": "535009ed27ed4364493cecd0d871c0e45505a21f", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913342, "uuid": "a93e1f4c-31b7-4407-8389-f8d8bba4000f", "comment": "Malware payload (BitRAT)", "value": "c95c9aaaba7309e252d31c38457b1199eaaedf388aee059de0dfee7be45de9c0fc376bac015b42cf63ea71c7cc17454a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913342, "uuid": "5305acf6-08c8-4a94-93c4-dcd0da33ec3e", "value": "T164E5F17112C3FE8AD77B2EB5E944A3734C64675357028344BFD80EF9265624CAE788B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913342, "uuid": "2bad0a18-5dcc-49cb-8063-18c692ae48e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913342, "uuid": "836043e7-f3cb-46cc-bf12-d419829234b2", "value": "24576:CaiYyi79nghoOKuvA2lrCuFWzYUKcqLcVFNT7zl3Xr4cqtBCGMUSDqH5uVBDcwDM:Qoig3DFHWfypES55XtB5Yg8KdaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913342, "uuid": "2c7a40b0-5f07-466e-a796-40d7f4b10bae", "value": 3063808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913342, "uuid": "e8b6d1d9-d475-4894-9154-ac025d2c1062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913342, "uuid": "53c0aecf-fc8c-43de-afb0-ff0db4099304", "value": "B88E6BAF28FCFA45E9F951160E8DC0B017218171D4C46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39728b74-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894917, "uuid": "a1fad56f-7320-4d74-aca4-8dc9770830ef", "comment": "Malware payload (AgentTesla)", "value": "c7a530b9c9eccc78f5dcfff025c0858c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894917, "uuid": "99812bc9-b62c-4802-bfca-1f72047cdfee", "comment": "Malware payload (AgentTesla)", "value": "b9727005104b3d4c4d0b7a67b291262c231b5e0fd4a827f6f8aba1b3c45a6958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894917, "uuid": "0610973d-2a8b-46e0-8be5-1e10025f41d6", "comment": "Malware payload (AgentTesla)", "value": "53094f75e12100b5b4f09ed6c91be121997aefbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894917, "uuid": "8e5be00b-eac0-4436-a8ea-c1dc70b55c64", "comment": "Malware payload (AgentTesla)", "value": "6d23379ac6979fca8592386ee302ebc735a99c8cd0b548bd7ac4ea0c3526707fdc25d9a637d79c46d367fec8a7dfca57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894917, "uuid": "a35006a5-3498-4cec-b826-09663c72fe10", "value": "T15205220A719758A3D7390FB886A273C05375A361AB13D7FE1CA214CC8BF678116617AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894917, "uuid": "e5ed601f-8da9-4197-8ea6-5de0c028eb4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894917, "uuid": "65578eb7-0da8-4ffc-97f9-a2ea03e77773", "value": "12288:xVcsqYgcaGAqhnVAte3Vu1N5yKQcnTfUWyUIX08ngU5lwnM9Jc:XZapqpQ1NtQuuUgCU5li8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894917, "uuid": "4bd3952e-4cbd-4fc7-ae6b-c2db575c6096", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894917, "uuid": "51647c7b-5a37-4e55-a642-fe91a648c2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894917, "uuid": "244045a7-365a-4d1d-b27b-246b02be11ed", "value": "invoice 7284051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317c5b28-ccec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679955033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955033, "uuid": "a279f15a-6856-4e9d-aace-4373732becd5", "comment": "Malware payload (RedLineStealer)", "value": "439ba67ca364779b9747e8a8d2d8ccde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955033, "uuid": "f7383fe0-0747-4d6a-b157-bcde28b84af2", "comment": "Malware payload (RedLineStealer)", "value": "b9cfc791ba165fb157da8f1d6b4fb950066cbb10ddad162587a1392056663549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955033, "uuid": "aecdf024-28e2-47ec-a191-569aa31dfcf6", "comment": "Malware payload (RedLineStealer)", "value": "0ab5659ff275c65e079eb9984a20299c3c6b4ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955033, "uuid": "ad1712fa-89b5-4c14-81fd-b88d3c4410b4", "comment": "Malware payload (RedLineStealer)", "value": "8e4582a07c75adf9d32858728ede6e8446d75af7a594cf1c03e889c4d6038fce3a94a209255cad0fe1202295285001c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955033, "uuid": "cff00956-f894-42de-9756-5ab5fb1ad7cc", "value": "T11F54071B02E48E2AFCCEDA7D919A62509C5F39E3ABC5C2CE179C954B0558B5C703AF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955033, "uuid": "384f7c16-e9a7-4dbe-b272-1b7dc05e231c", "value": "67a13e475a7159590c30461a3c5d1a5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955033, "uuid": "5d9895ae-583c-4f5a-b37c-6b47ea845fec", "value": "3072:eVQVwzq5PW4VVA+yXtQ+ZV2BX74gtnsOVWS68Wy6SALnxGL6L5RR26l11UqQb9bt:Xve4ytQ8YX74knVVWS6FxnOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955033, "uuid": "be5a9963-6f85-423f-a521-e737a1f2478e", "value": 302344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955033, "uuid": "e1a734b5-2d6a-424b-908c-bd69456ab615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955033, "uuid": "75f10207-5aa9-4457-9e2e-698031f9b966", "value": "439ba67ca364779b9747e8a8d2d8ccde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73126a81-cc7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679907039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907039, "uuid": "3ececc5f-2b22-499d-a8f8-c07c414295e4", "comment": "Malware payload (RemcosRAT)", "value": "9ca296392ffda3a2168b2c8e38423f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907039, "uuid": "8be23e9e-3f8e-4272-b026-36391a4a3a2d", "comment": "Malware payload (RemcosRAT)", "value": "baa1926f8f9eb46243f4591d418581fc422268a40aec9a83fccf7e3ee2f913af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907039, "uuid": "b977a442-059d-42fd-98b1-1b0616f10bc7", "comment": "Malware payload (RemcosRAT)", "value": "5a6001e488ee7fb0ec19e5727871c7a1d476457d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679907039, "uuid": "c9a90946-e10c-43f9-bde8-c6ce37828691", "comment": "Malware payload (RemcosRAT)", "value": "1076874a9d97029a9590c37e05b978da4cca17afbad125b9c30724f7ac8c3bb56d7eea45d5c8d4be657250393968279c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907039, "uuid": "732a60dc-5efe-4270-b44e-80986f3c868d", "value": "T156551202BFD159B2D1A32A320A76AB11557D3E201F798FCF63E03A2CDA711D1D634BA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907039, "uuid": "4c25dc98-7cda-47ac-9505-3b5f75f28e0c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907039, "uuid": "a88377a9-dab6-4782-85bc-7a77264530f6", "value": "24576:lTbBv5rUqDGbB22Y7+QE96qZaeUTHc8SqAOgRF65:PBX0YZD40kVqK65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679907039, "uuid": "71a55669-6eb5-471b-abaf-8e02d09bbfbc", "value": 1311761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679907039, "uuid": "2759a138-387d-426f-9330-d9c5c3ea126b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679907039, "uuid": "8b1f4083-f12c-4ecc-9e49-cc67f67d8dc3", "value": "9ca296392ffda3a2168b2c8e38423f88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262e3228-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1679894884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894884, "uuid": "fe5e1b76-6a54-4613-b128-021fa0a5c95f", "comment": "Malware payload (GuLoader)", "value": "33b2406fb53f40f840ada9bb48f1e842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894884, "uuid": "eaeec76d-10bc-4166-b4e1-c0d60d77af0c", "comment": "Malware payload (GuLoader)", "value": "bab32690065170326324e00168f66d23835eb493229561b7cadc00b740818a7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894884, "uuid": "ccbb8e96-1034-4f4a-90a0-3d5047480e76", "comment": "Malware payload (GuLoader)", "value": "e57968a925d21e17a886fb8b49ba153b92e6790f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894884, "uuid": "4b5df7f9-a4e5-4512-be47-6c77d102e178", "comment": "Malware payload (GuLoader)", "value": "7aa92a47859f2273af2a111f0543be6667e58ff9a5f8d3d94ef18e20783e80bcb3d8726fb21cf308b0ddbfaaf6991647", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894884, "uuid": "97279c96-9225-4b41-8474-285fb3091f0b", "value": "T165C4239B096260EFCCD307706C3E8F6EFF9D8C276485C95BD71418A07AB9A12474E58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894884, "uuid": "61c22846-dbd7-4696-a4f3-2a2da057c8f9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894884, "uuid": "b46030b0-29b8-44ad-ab22-8721de336315", "value": "12288:l0ARJ3xOcJjArS9NP8rZLTxZb87vMRAtsINAnBj482Wl:VJAOgSuLj4k+NAn94nWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894884, "uuid": "f5106e24-336c-473b-9182-a4521f75e063", "value": 580792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894884, "uuid": "687d8e69-5d07-4d6b-9149-e0a1dd94aec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894884, "uuid": "593465dd-cb1e-452d-94b7-3be8f066daaa", "value": "567898765R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb26719-cc4f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679887679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887679, "uuid": "5d399ede-d17b-40a6-909f-70c711bf942b", "comment": "Malware payload", "value": "f998d5389a4ad2d27f5a01abe06c44e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887679, "uuid": "d2869a59-cb27-4c87-8541-03c836515377", "comment": "Malware payload", "value": "bbd6bbb6d37fcc6ce352f0b9762d13709661c36945cfb01cfef6f8811c31e248", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887679, "uuid": "33bcc88e-bc00-4346-a864-e067ce148fc8", "comment": "Malware payload", "value": "cfa4e419820a6a24512714f5530ef9f12be3460a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887679, "uuid": "56690e09-dbd0-4007-ae1c-f83d1e547c1d", "comment": "Malware payload", "value": "f6ebccfbbe2ac8c34a11e58482af2c7962bf09ff0616eb4afdac8a6ef49f91fdcf8cb1f5d1602b652e5cc27bbce415c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887679, "uuid": "55034ebd-b77b-4a56-8300-05ae0bf0816e", "value": "T13A01F13E384696F1022526D156278C14FF16ECFB421C1259BAFD42940FE0E59A8DACA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887679, "uuid": "e222af71-541b-4115-92a0-05ac18d846c7", "value": "12:iuaK7uh39uV7C+oEu3lEHW3hBaGlwjlOgY8asgITRhVlYI9kUQafrLug:OK72M7SRBaGCa8l9DlPGUQorP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679887679, "uuid": "98685253-9d4f-4ba1-a4e1-679b09f70f75", "value": 794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679887679, "uuid": "6c9bc5c1-0b97-48e7-a2c7-359c1ae8c11d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887679, "uuid": "7c26513a-7d08-4d55-92b3-980c654b8647", "value": "Untitled-1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e0ed22-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679912247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912247, "uuid": "10afa3ca-e0a4-4928-98ba-546f5e5a6903", "comment": "Malware payload (RemcosRAT)", "value": "b5fe9871d9ea49f5690b3b02e52432be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912247, "uuid": "8c19b2f4-0483-4d83-9441-841fee8194e4", "comment": "Malware payload (RemcosRAT)", "value": "bc663a12e76623f5bcb297c16a209b0ef5a978f2474ba9027d9ec4601c3fcc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912247, "uuid": "1c9ae74e-0e44-41ab-9b7d-8612e72d8dd5", "comment": "Malware payload (RemcosRAT)", "value": "017fbfd3040bc5cbfa724fb195d3a5240ae16d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912247, "uuid": "5bb4a553-6a9d-4a8e-bd0b-ba2e2d06f2bc", "comment": "Malware payload (RemcosRAT)", "value": "9bd4af1f22b7bd239eab22c896948bafa20c18484b13e20127ebc49395cd2c86091f91f7a7c0101bba64bdcb428cf2cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912247, "uuid": "6415add3-d0eb-409f-bfa0-42802b3eb677", "value": "T17B350701BBFEDA23E2DE0737D8F0086807F1E851E662E71F25D566991A137A34E06727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912247, "uuid": "0b4b7984-b6f7-4c12-99b6-5e2194968e7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912247, "uuid": "9242a825-add8-4e51-bd57-c1d46f9adc08", "value": "24576:j/lSdIQHTtf6++IdMUXuMjyKBhQXglmvgQoVPGK8n:jTV2njpmvgQolGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912247, "uuid": "79fe7ebc-b932-46ef-bd48-fa1011a5264d", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912247, "uuid": "1fe843b5-8e16-4d72-82d1-f6f4d492fdb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912247, "uuid": "d82f1041-e557-49fa-a198-f7e0b320d0ec", "value": "\u00f6deme belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7809d49-cc73-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679903289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903289, "uuid": "49a7cc4a-9c81-47d9-ae05-0d6f5b87d520", "comment": "Malware payload", "value": "8a05eaf9c89a56256a8903fb99ddcc8d", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903289, "uuid": "e810fee4-1f66-4135-8ce9-e4303a9dbcf0", "comment": "Malware payload", "value": "bdd6868beeac816df877a0a6c36d88cbb6a73ae60be314f9718f113fcddd875a", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903289, "uuid": "b7d90df9-63f0-4e18-83bd-03f2514d811c", "comment": "Malware payload", "value": "dddf440c314f2502a873314ff2d42111170827b0", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903289, "uuid": "816841f6-047d-4d54-ab6e-acb0c0604c5c", "comment": "Malware payload", "value": "20dfb2509c46cbcb12ae71f2f69f9f26b46d9836a80940a2a3a9f77cb92139f48ca8de27ee6e5121890f16cd88e027c0", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903289, "uuid": "7a94fd13-d36c-4b37-aef6-584585234e64", "value": "T1E77423008BB3851F8634A779A46F1BCDFF0587A7401606DDB2BCA17D1FDEAC1526A89C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903289, "uuid": "0e517591-a13f-4a53-8ea5-f5d8419fa13d", "value": "6144:76XqfxJBtatevHpPEdVdrEP/h+2U/TcBhIBJM95mSpIV8BAMVU:7NxJ3atex2VdrERa/IMBJMuKIV8eMVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903289, "uuid": "ca377986-c9ce-4700-b763-4b8d2d7adf58", "value": 353775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903289, "uuid": "de979c1f-9833-4f5a-8549-473ed3938b88", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903289, "uuid": "f4a8deeb-e80e-4fc2-abe6-96be502403dc", "value": "RFQV21019612.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91255f4-cc3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880528, "uuid": "e885b28d-8b01-44cc-ab31-87aca2f5ab13", "comment": "Malware payload (Smoke Loader)", "value": "2e633a8d1ad010a937496508126482a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880528, "uuid": "37b841a5-0d5b-44ed-a5f0-50ec8368ade3", "comment": "Malware payload (Smoke Loader)", "value": "bde3b0eeb94a9796e3dff43290cdf7b17413bc03b343ad28d275a31ac0aebaa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880528, "uuid": "b63a290a-721d-443d-9c92-75f223cf1e33", "comment": "Malware payload (Smoke Loader)", "value": "2d49d992acaa7c6af924554a615f1fd84ea53cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880528, "uuid": "5c5807db-96a4-49e9-99bc-8b528a264ce1", "comment": "Malware payload (Smoke Loader)", "value": "68e351c459fbfcfc803ef6a152a696a9042811a1a15ffb10126e0f3b7fe9f0d9daf97c14d804d187ff3b6d33805272ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880528, "uuid": "e5dd257b-24ed-407c-adc4-e7face3a3782", "value": "T1B7547D1253E16830E72387328E2AC7F42E2EF8619E156BFE17649A3F1971F72D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880528, "uuid": "80cb5eb7-8bbe-4fda-80e4-3f5dcc2f9cfe", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880528, "uuid": "5066539e-e9c2-4bd2-9996-464f187c683e", "value": "3072:wCSTzYUB+aY97WSKwiGMhfqag5iA7HCoxAPQv4/p/LQcfcXIlLhofCCJQN0fm2Rh:0uOw3MRqagNAIv4/FcChuTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880528, "uuid": "d132f71b-abc5-46cc-b6bd-a4ae5cbb8b36", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880528, "uuid": "5d7ee76b-2866-49cd-815c-9714effd8cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880528, "uuid": "cb752020-500c-41f8-86ee-1a3a625112a4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aedda85-ccb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1679932393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932393, "uuid": "0e80872e-f26b-4e52-a49e-3c0c7249a8df", "comment": "Malware payload (zgRAT)", "value": "074a16c6ee847c06a81abe36e9034717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932393, "uuid": "1a724c26-59d9-4039-8044-85b2006cd7e3", "comment": "Malware payload (zgRAT)", "value": "bdf5e9b659a5c86d95be20b4d3539fb222dc4b614b961665057d1155a5b1a636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932393, "uuid": "3ab72473-5240-4450-8ea1-4f246a2428eb", "comment": "Malware payload (zgRAT)", "value": "2a3a502512350a9b1d77cd1321a0fa9ece8d6cbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679932393, "uuid": "a9772683-3704-4ef0-984c-63e0af060f84", "comment": "Malware payload (zgRAT)", "value": "01576db919f9a763a5a09e0e395e43e52b7864022a3fbe74598943713fdadd08d4afb7535d891f93f9f18fbf101a0058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932393, "uuid": "ae423e00-b220-4af2-92ff-d8606a157d5d", "value": "T1DAF4F9502BF9C61AF2EE1F75E87005580AF8F805B6B6D74E6D48D1A92C72700AE4877F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932393, "uuid": "3bc53701-83ed-4e75-aefe-5764abe93ca1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932393, "uuid": "cda10396-895f-413e-aa5d-d1c27887ec37", "value": "12288:BuQx5HewySOlIDmNLo4MX600dVBnfbdePg:dISmI9XpwBnfbdePg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679932393, "uuid": "8da167e2-1b72-46da-b095-dd25e47911fa", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679932393, "uuid": "741aeb73-6a19-4cc5-81b6-bb6f33143939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679932393, "uuid": "f6758e3d-50ec-4254-a4bc-c33db98f42da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9155319c-ccf4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679958630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958630, "uuid": "9d7d3ae0-f6e5-462e-9f7f-af0bf5671883", "comment": "Malware payload (RedLineStealer)", "value": "f9ca901fb82dabe4c5036d0b276cdfea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958630, "uuid": "2848b83c-78ae-43f4-af7c-d1c6a4bfe386", "comment": "Malware payload (RedLineStealer)", "value": "be79e1d0618a893153a049271268fac39ca9007bae26ecaeb73df3a455fb90b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958630, "uuid": "b4a42206-77e3-421e-9374-3f15e34dad66", "comment": "Malware payload (RedLineStealer)", "value": "d5bfc6ff7c6cd0d142ad3f7dfa08451203da92f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958630, "uuid": "1196b84b-e06d-481f-b508-89ce1364593a", "comment": "Malware payload (RedLineStealer)", "value": "44bcdc5c15c0afa30dd681b6a71e3bbd013cbf6fd22d03cc0aeb20ebe435d26b34129c116b818d8afeb8703ede70a6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958630, "uuid": "24f67aa8-d0b9-4def-9338-e25f70998258", "value": "T1AA94F185BAE0F2D2CC7681724B5C90F0E77BFE3956A5D61723D1BB0E72319E1D906222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958630, "uuid": "8e3c56a2-3e47-4459-9615-785b73f0a3eb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958630, "uuid": "0c5f5c37-546c-488f-bb0d-bb40f6d7ea29", "value": "12288:6YF8rfffDfffFrnVqpPtogpFJN1HKd6l/r:6YmfffDfffFopPt1FlHKez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679958630, "uuid": "a78ce57e-d776-4453-abda-d121980f9877", "value": 434562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679958630, "uuid": "136f3d18-2962-4545-b98c-26f3cbdfb32c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958630, "uuid": "b0bb8e70-b7a1-47a0-9321-2ff8534b6b78", "value": "f9ca901fb82dabe4c5036d0b276cdfea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89578333-cc3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880877, "uuid": "c141fcb1-0c82-4342-b7d7-b554df52d870", "comment": "Malware payload (Smoke Loader)", "value": "e06c4872f488cf89eca7b4b5229ef67f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880877, "uuid": "d9e3b7e4-237e-41e2-8128-96f6b18ffeb2", "comment": "Malware payload (Smoke Loader)", "value": "bf99ed336b7127c649c8513a109c9b6d0274ee39d797e248b2082f7bee368bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880877, "uuid": "cbfca77c-b506-4f9b-a077-bcbb7b150ae6", "comment": "Malware payload (Smoke Loader)", "value": "c28238502dc836ebecd913248a9b3436cfe1c280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880877, "uuid": "11118e7e-19f3-4eb9-901b-c40211921d70", "comment": "Malware payload (Smoke Loader)", "value": "18440e6b18e4e215d0ec05cba9d8d6240f031a3d3bb84fb2ec4e5fc3984bcc24e6171875013bfb2524eafe4d289e089b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880877, "uuid": "40d4cbfc-41ea-464f-bce2-01cbe33e1a16", "value": "T133547D0253E26860E71387328E2AC7F82E5EF8605E157BFE16589B3F1971FB2D162705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880877, "uuid": "7a36c3aa-3835-41c0-b5d6-10c3bf5c47a6", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880877, "uuid": "c28edb3b-9b26-44d3-aa85-60e3cd401391", "value": "3072:gxnSzM9OBmn9kheq0CNC+G1gzgsSx8EnNa77kbxXg1GoVTddFdnR/OUxaPHG4t/+:BRdNC7E4mEnpsF/yQTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880877, "uuid": "d108909f-70a5-4321-87c2-dc02507f4c3d", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880877, "uuid": "d3d2a6ae-8376-40f5-85e6-2d1792082528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880877, "uuid": "9e768b2e-f6e3-4d70-8e5e-0249f6f7110b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01621b02-cc9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679921022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921022, "uuid": "bb7414a1-4a5f-425f-96a4-59bcec437778", "comment": "Malware payload (Amadey)", "value": "15abefc45b597c9fb29c2af76cce1256", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921022, "uuid": "09ec2935-8b41-49a8-b722-d16212c72ff2", "comment": "Malware payload (Amadey)", "value": "bfd046a216c93ef369ce6dd3f3026a784d0b27cbfd32b39c0c31707f55c2e021", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921022, "uuid": "2d3acabd-d86b-444f-8148-d6062ada004a", "comment": "Malware payload (Amadey)", "value": "ac2a7b2540f8d8390914a847193116be32885672", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921022, "uuid": "92a383a4-494d-488a-a4b6-9c52d6c628dc", "comment": "Malware payload (Amadey)", "value": "05dd6ddb5a1f8297588e0e1e1ffb7e902dc919f71aa486565428f17fc688873759b38e34c58e9a50a8ecc661d86ae346", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921022, "uuid": "a37ee558-41f8-4f60-9027-770947a91c8c", "value": "T18A25230226E84033CA7427F19CF64B9B0B35BCA55D7993AE27C19E1B4C72684B53672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921022, "uuid": "694316fc-0cf2-4cb5-9112-a5ff6b8ce323", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921022, "uuid": "35bbbf0f-1c25-4e29-b434-597edbc9a41e", "value": "12288:+Mray90rs9d8yKN6WOK7MlApeikgZzPpc4e+s3hJL72ZHmjhFJR72eB1Iqyi6KyS:4ym5XuCxhBdcJLIHMJRSeDH6KxQbiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921022, "uuid": "95771764-92b7-4f09-ad4c-651d01e05854", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921022, "uuid": "ca1c7343-6f5f-491d-8eaf-d039801744c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921022, "uuid": "a0697586-6f01-4d26-b72b-6412535c021c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b61c06-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951465, "uuid": "f154ab0d-512a-4e1b-abb8-db1a2e6fff9d", "comment": "Malware payload (Mirai)", "value": "861b1d08cd2c39d9732ff0cbba29df25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951465, "uuid": "ff1719c3-6c69-4797-8ec6-dcdb4dc344e9", "comment": "Malware payload (Mirai)", "value": "bff764525de4403bf8225e865e160784efba1bb3f3c488b06993ff42be2c332c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951465, "uuid": "bb3dd05c-a553-4da3-8909-1102af1b364a", "comment": "Malware payload (Mirai)", "value": "c569f713d5a20b6fc9260366ef3a184daaac031c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951465, "uuid": "6ef6df7c-8006-469d-829c-10c65ae9dafd", "comment": "Malware payload (Mirai)", "value": "28f8fac1a7e58b52c1d30f592b5c88b71aa1c69874e739e8723703399190a0b951b50443816975c69135c397a4878adb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951465, "uuid": "77632170-2b6d-49db-9999-c9b191039d50", "value": "T199D2E00CBB991CD9CE4C28BB905D4720BE22F584710F838EEAA04C50F5E85DF1A0F69E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951465, "uuid": "1be0a53e-3a47-411a-a7b9-cc55452ec4de", "value": "768:vm1TcP1RMSJ3AjpePfQbLHPNdvjkpH8uECINtfWx:vmhQQSJQwwbz1dQKNt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951465, "uuid": "056b068a-448b-4200-bd9c-4f503e91e433", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951465, "uuid": "a4bd7666-24aa-4025-8996-22b5b66a7604", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951465, "uuid": "0be33ae3-2db1-45a1-83fa-93e29ba9886f", "value": "861b1d08cd2c39d9732ff0cbba29df25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8387609-ccad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679928201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928201, "uuid": "cd288f5a-469a-46b3-837e-bfc2ef798d1a", "comment": "Malware payload", "value": "4214f20aeded9992ee926f0710d5ca76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928201, "uuid": "2d61dc4a-1827-44b3-8e4a-32862dad4ccd", "comment": "Malware payload", "value": "c190e2988319c108f55776d0819b9167fdb29101824749bd52f2b53763684171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928201, "uuid": "dffaaf4a-4d4c-492c-b966-5a1d66230348", "comment": "Malware payload", "value": "4e26b8598bd6494ec49e8b463d17c4d4eb9bc4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679928201, "uuid": "72e97f44-7fec-4fca-bf11-b4d1a04ffd78", "comment": "Malware payload", "value": "d767d27690b93090ebab0d4da71a8019642eeafda93456ec825e5ef1e9b41703141f5b1d60c66e145db9ffdc743aaed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928201, "uuid": "26d9f862-6a23-4522-902f-c17e6d414599", "value": "T197F5E1A2C3B529B7F62A9C279C23234CB7389DEB810C72C76F7B946D460526D115D83E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928201, "uuid": "7ea7bb49-3512-4dc8-89e2-72ed3f33450f", "value": "647411109b04481ccb858ac68f47ecf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928201, "uuid": "5fdbc16b-7d12-480a-948c-428926164dcc", "value": "49152:evNJEciXT1SMTEGUlayCd1XlOrUcwFY92eg6zBCYUFQumEeBAoCuYXMYo3js:lcmEZlaPfUwbYIelzBLU3vqCRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679928201, "uuid": "9278ad9d-6b00-42dd-a451-802b6f32d24a", "value": 3613296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679928201, "uuid": "b62551dc-7e51-47ca-8071-d4b6bc6c9c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679928201, "uuid": "ab5c25a0-2b26-4d37-9d78-c727440db7de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd80ac7-cc3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679880482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880482, "uuid": "70cbe6d5-7f36-49ef-b0ea-285411b5198d", "comment": "Malware payload (TeamBot)", "value": "ce55370ec022f2de89c2a36ceafc7f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880482, "uuid": "e54145b7-59ca-434e-878b-0e9d3ae79b04", "comment": "Malware payload (TeamBot)", "value": "c1c31c8b54470ee86da9b36f9ed3531c86c1ebac35ae2ba4e18ca1be3b7db226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880482, "uuid": "1fb9fed3-0175-4985-96f1-d940e4abe6df", "comment": "Malware payload (TeamBot)", "value": "b4325b7e98c884aa448057db71a94ea9cce9f4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880482, "uuid": "39750669-3075-4d6a-9e8e-49b879699a2d", "comment": "Malware payload (TeamBot)", "value": "0dcdf805326e6f7896846c3a895881d2381e38f6adf347b3ac479e5f6326b87a0172cb0139e4b01812ea7c09a59bbed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880482, "uuid": "68fb8234-1bae-4740-b1f6-7fb278d01a48", "value": "T1A9546D0253E26860E75386328E2AC7F82E2EF8615E157BFE13589B3F1971F72D162315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880482, "uuid": "04f1f2c4-b40f-4c34-8931-8fa817e18efa", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880482, "uuid": "2f28f9bd-5ac3-4e69-b87e-bcb7cc8a33c9", "value": "3072:38nfzYO1U0b9xsSNQ+GutSOyCF/7BN4bjnvBgoupjbhZ7h8hyk/0u2EoCJQN0fmG:cz3Q7ukOyCCbDvBIbWM6rZXTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880482, "uuid": "cab46e8f-c00c-4876-b84e-da829816ceba", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880482, "uuid": "2feee916-9997-4b63-b7f5-46697cb0157d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880482, "uuid": "e9075bf2-aba1-4fcd-9a65-8799f53ac8ce", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6c4a84-cc51-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679888451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888451, "uuid": "7a2ce3f7-de87-41bb-a152-a8b0f3abebc9", "comment": "Malware payload (RedLineStealer)", "value": "f8be21508a5e62445c422e617630b9f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888451, "uuid": "e602907d-6114-4699-9c9b-fa453fc66c3e", "comment": "Malware payload (RedLineStealer)", "value": "c3e011a86632545295b8653faaa5186b8bf5899ffa07c9be4c1b809f043e07d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888451, "uuid": "399a7d7a-89ca-4bbd-b102-bf51857ec65a", "comment": "Malware payload (RedLineStealer)", "value": "52eb494861a168a26bc4e98e9844b4d541ab8716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888451, "uuid": "601acbc5-ec4e-4990-bc09-1a9815dfb0b0", "comment": "Malware payload (RedLineStealer)", "value": "9db0c3247a0d909d41183a77c4c71fb4481659d17371b23aa13914dedc2a894ba0a88d4ec0498d3da8e1bd48b201fba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888451, "uuid": "9e52760a-3a2f-4d50-8f4a-21c7a2567cbf", "value": "T11FE412D1E7D88073E8B5277089FA12830F36BCB05974979B62C56D9B0CB3684E97136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888451, "uuid": "ad7fa3d6-5fe2-497c-925b-6950eb845e0a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888451, "uuid": "70b8a2f8-55e3-4d78-b396-282060c52df2", "value": "12288:iMrky90BSu1gKRF0hD110na8gq8iEphT+iNiqK5zq:KycSHO0POnyq8l5+QiqK5zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679888451, "uuid": "e357101f-cc6b-499f-b835-275e86fa9c69", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679888451, "uuid": "0241cda7-0c59-41ef-9238-918eee6d3dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888451, "uuid": "179e463c-c14e-4d56-8d1a-78fe86d30504", "value": "f8be21508a5e62445c422e617630b9f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456fc23a-ccee-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679955925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955925, "uuid": "5362761d-c8e6-451b-b7c6-9ef5f3815779", "comment": "Malware payload (Amadey)", "value": "6b8c7f61fa6d0f51745b5b666c892333", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955925, "uuid": "69d45a61-375d-484c-9d2a-d319dc966029", "comment": "Malware payload (Amadey)", "value": "c434cfd02b14df392aac52bc8d329a336098b25cee9efc81d704b5341ba0613e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955925, "uuid": "2489580f-43cc-45f4-8fdf-4f72e174a87f", "comment": "Malware payload (Amadey)", "value": "e5786735089ee45eddcdbadaca39f87859de2126", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955925, "uuid": "29c4a10a-0da2-42a3-8a71-166e47057b94", "comment": "Malware payload (Amadey)", "value": "5d65946cfd9d57f3a8744b7baa81d3b6a2661ad5a1a1e2a724bb691ab720d2914fc556efc034a69132b41fa0595d22b7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955925, "uuid": "dae4190f-e737-41b7-ab96-6016a1ca3d0a", "value": "T11835230376C84533DD7127701CFB06830B36FCAA9D7483AA3746E41A5DB3AA4A475B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955925, "uuid": "cab67976-5959-41a8-82ce-5a9fa65b2e8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955925, "uuid": "e27694a2-47ae-4c2b-b659-5f1569fe7716", "value": "24576:Cyo8bwSju+w8Dsxyi9+KTWUENNiflCerAA:pDbwPdxL8uIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955925, "uuid": "0f7476d4-ae3f-428f-9a55-2d986dfbc49d", "value": 1063936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955925, "uuid": "c5264187-d712-482c-b72f-857c3ad1eda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955925, "uuid": "cd9dc97d-79eb-4694-87a3-abe4a39693c3", "value": "6b8c7f61fa6d0f51745b5b666c892333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fcce1e-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912500, "uuid": "e313e929-94b4-4145-908c-9df2d1d03712", "comment": "Malware payload (SnakeKeylogger)", "value": "396d3bf7bf022ef37489dba74bf09b35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912500, "uuid": "fab6ed36-c8be-4a2b-8b53-9dc818e99c05", "comment": "Malware payload (SnakeKeylogger)", "value": "c4ac65ea4af1e9c789530885c0d2bb838b218553a1fb6e2a6c3a40258f3aafb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912500, "uuid": "a5b0bf01-a85a-4bfd-b30f-90cb70512b2a", "comment": "Malware payload (SnakeKeylogger)", "value": "13cd1d0c6b8615e4982689142960b51188d1f675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912500, "uuid": "a366bf6d-82c7-4384-a771-530b3217d313", "comment": "Malware payload (SnakeKeylogger)", "value": "2c1ef4324490fe58d92a4e56e9cf33de60767a9bd65a952cb8e3b55b7d0d48181c3eb5bf2e5afefbaf58ee6180d066ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912500, "uuid": "758e0b76-7b39-45bc-bbc4-799ba4277193", "value": "T154F4F158E3E4A722E376A7F42EB04904E3BDB8E75B56E94D4D8A20C790F57104E43E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912500, "uuid": "c4c2a9bc-ccac-4a9c-bc6f-35396431dc97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912500, "uuid": "7a4a2d9e-76db-4883-a8c6-07233357584e", "value": "12288:sA5sB0O6JhZ8FzZ1Ih0tomBGI+Y/7gPOPZ9+4JJP1D/NdasS31XB8U32WP+NoLP6:sA5EuD8FzIh0tBBL+Yz/3rdjS1Bj32Rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912500, "uuid": "8480f11e-ea4f-45f2-8450-de94a8586a75", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912500, "uuid": "5c803902-3fde-4fea-9ff5-042663a68647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912500, "uuid": "0f000ca1-3e6e-4223-a49b-73c07d9c2b84", "value": "COMPANY CATALOG PROFILE- Qingdao Wisdom International Supply Chain Management Co Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8cb5ad-cc77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679904966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904966, "uuid": "8a1b79fd-d246-427b-bb8c-3b915d57db76", "comment": "Malware payload", "value": "cb08dd00131de26fce81ff8fd015752e", "object_relation": "md5", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904966, "uuid": "300291f0-9fd0-4e21-90a8-ad6363c51b73", "comment": "Malware payload", "value": "c6b3372480fbe8aeada86c14dadce332d3cd4a46dd2c2c1a0d08297c04ae1081", "object_relation": "sha256", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904966, "uuid": "34f6abff-09a8-4561-9886-ba19b5e8f737", "comment": "Malware payload", "value": "044605b2ba8b1296d2ec9ccc679d29c65a1f91ae", "object_relation": "sha1", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904966, "uuid": "54194949-3397-44ec-b00f-a80664fc9959", "comment": "Malware payload", "value": "fbd31779cf7aea009ee0b089c78ca0c5ba416d87993444f42a2c643a11668c02fbfea6ccb4859af96bfb3124c4804947", "object_relation": "sha3-384", "Tag": [ { "name": "datacenter11-myftp-org", "colour": "#0D1983", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904966, "uuid": "b669a33f-e4f0-4ba9-b7b6-d54abca9b2f4", "value": "T1D8234BF21653AD8F8B370E42F40C1217DCA8EC9772AA84AEBF4549A94FF45189C74DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904966, "uuid": "f29227a6-c5ff-4684-b26c-9f45f6a28023", "value": "768:Y/axw06kW9wYrZZp958vHZ1FQhhp9Bec2jDBPxU/ofAd+kL4K0gQEZ2mi/c13w/m:Y/axw06l9jrjpI/CBeckU/ooqgQqxikN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904966, "uuid": "9451d4c8-97c8-481e-969c-9f1f9ec5d4cd", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904966, "uuid": "4d93c106-a62b-4703-868e-8b625b104ad3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904966, "uuid": "4798d441-8071-415e-9ec4-f9f1615224b8", "value": "document", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6da27e-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679913038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913038, "uuid": "ac90f037-0e41-4278-996a-e719116387ab", "comment": "Malware payload", "value": "29d588d23b81daee7b69ccd97afec82a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913038, "uuid": "2c7e5e8a-5ac5-4be3-9ffc-8cd3811b742d", "comment": "Malware payload", "value": "c6b7a86b4d5ccaefc1bae1b399a2e6f1739a30809adad9ea4e475bf9090889d2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913038, "uuid": "13c48e04-b4fb-4a01-8120-d2015048f4f9", "comment": "Malware payload", "value": "1e102e70d56701f44594304d54b440f8708468b7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913038, "uuid": "2b10d32e-d32f-4cf0-9de5-cdda718f4a31", "comment": "Malware payload", "value": "4bc98367386d07094ff2e7372771b0dac5d55c2701d9b34e704e2bcaa2e66905b1b15d86c963d7d4467a036fcedc7e0a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913038, "uuid": "1ac2ab01-f29d-42f2-b143-c439dc8ef512", "value": "T144617B145BDA0708F3F2AB3AA9BE52594E3B3956ED32C74E0059814E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913038, "uuid": "d3945539-5caf-4f1c-8575-98b3c212338c", "value": "48:8wHaZU9Dmel0iglZ+EslpQfYj1sAT1rTRRSJxodgImcC:8wHxB0+E86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913038, "uuid": "3cca5ba7-8e6a-45e8-a959-04cbf046db9b", "value": 3442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913038, "uuid": "14c77f98-33a1-4493-87c6-41c251355a5d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913038, "uuid": "b36c948e-336c-4880-b835-4e8046036a85", "value": "Request Parts Product.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64687559-ccda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679947387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947387, "uuid": "174a7f78-61bc-43e1-b9e5-47f0e46e80ea", "comment": "Malware payload", "value": "fe4848ee9024765cd5f4872b04f3cdd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947387, "uuid": "660910bd-3b1f-4307-93f1-8bdd3085fe95", "comment": "Malware payload", "value": "c73a9772c2c6d5bdfd7d527d5e1d7776733f1fe47a9bc2ec8e9e1ca9e6c5d972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947387, "uuid": "0dc68e5a-f7ee-45ab-91ea-7c230da8d340", "comment": "Malware payload", "value": "129b7bbba51fe8bd90a2f7c2ce274038e5c2ab5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679947387, "uuid": "3fa5b4cd-31e4-4eee-829c-f9420c4ce09e", "comment": "Malware payload", "value": "48d914e27760adf99b23be28eef9df5dd9f16bdaea37bfd5001b1250972fe4c8633c2dd0a21a420d0457393bbf4375fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947387, "uuid": "d02acfd5-f13e-4048-8472-63ce4fb9bc84", "value": "T13A957C35568442D0FD53507924B879CA7129733285DEFFEF8368E5E26E0B262FA42E1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947387, "uuid": "a24a1030-2244-464e-a378-c505f2b05712", "value": "9470c78a7842de9e321f18351c5a30bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947387, "uuid": "7153850a-2577-458c-86ca-f176a3b3b545", "value": "49152:28RLdNJfVbgK0BRFSGGknK2YhRFjlP0SL9pGsamu:vbN0IGGKK2YhnjeSL9pGsaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679947387, "uuid": "ad458450-6105-4fb1-aebe-3cf4db86a99a", "value": 2054584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679947387, "uuid": "e0b14ca5-9c31-437b-a405-b2c40f07968b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679947387, "uuid": "94b662f3-3529-45c2-aace-13ec30a4fadb", "value": "c73a9772c2c6d5bdfd7d527d5e1d7776733f1fe47a9bc2ec8e9e1ca9e6c5d972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2add9c57-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912502, "uuid": "41b6c68c-27cf-4aba-a594-29d2802bf227", "comment": "Malware payload (SnakeKeylogger)", "value": "b3e0ea04c0bb374963c7bb0f1bf262e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912502, "uuid": "201c90f5-cc17-49aa-889f-267b914d10d8", "comment": "Malware payload (SnakeKeylogger)", "value": "c7c7abfcc51dd34f13a47132c25b799d1070b54882cfcd7f393afbd06246f872", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912502, "uuid": "18084d85-9b04-49b3-aed0-d8f7ca686f02", "comment": "Malware payload (SnakeKeylogger)", "value": "6647b50c1b67cfaaea3e391f4041dd073b682c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912502, "uuid": "e270ec3c-b76a-49b6-9df2-f8b803eedc9c", "comment": "Malware payload (SnakeKeylogger)", "value": "ad257a05db7d4649e3fd6cb8cc013a2d53c74096d443bc6fd5fc3b3011c5cd199d00434ea4004967d23d37d5f5fb1de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912502, "uuid": "bc69fc20-deab-488b-9669-11351e722056", "value": "T1FB244C1E7BF48820E6FF4A3204718161C77AB9510A66CD6F17D0E56D2E7C6D08D2AFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912502, "uuid": "978408be-76b9-42cb-8639-8427913ee6aa", "value": "577a8d3e64977f9ee2b9e04ac0e96174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912502, "uuid": "a4336204-5908-466e-af56-2679a3d2d2ea", "value": "3072:ChRykxCdEYXN/q6IPGNAa4Zxn8Y19TBrKDCbbxR2wBZjnbY:mR2Vy7oGbbvDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912502, "uuid": "ff945f84-c9ff-4de4-b29f-22468c9ccd95", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912502, "uuid": "09d72569-db35-46d7-a707-73c5653734f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912502, "uuid": "09a2014c-2ae2-46cc-958e-da63e6c4b3f9", "value": "b3e0ea04c0bb374963c7bb0f1bf262e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83d79ee-cc5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679893921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893921, "uuid": "95d6fd27-2525-45fc-8f56-245cf8526032", "comment": "Malware payload (Amadey)", "value": "26d85c2bdc983c43452401545f3c6007", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893921, "uuid": "870e28ed-6a3f-446c-bc9f-178903a86840", "comment": "Malware payload (Amadey)", "value": "c8313943995590c444dac429919bc562c8f81c7d81c898fbb9bd7822dce889f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893921, "uuid": "0af28089-75a9-4263-9b5d-ee03e2dd4e9f", "comment": "Malware payload (Amadey)", "value": "e18a2a223b91f426b5dab23b13970264d1da6ebc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893921, "uuid": "64ed013e-5c0f-4b74-9ed9-d00fb18287a7", "comment": "Malware payload (Amadey)", "value": "1f9088d8476ebd6fd6e6a8916e42a97522d1dda67dbb0e4e82e9bff32a04e7ed8805b726cca31f49305f6a45db220fb4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893921, "uuid": "df966e33-71fe-4eb9-a402-57237f662f28", "value": "T1C4448D2E93F56860E1374732BE1EC7F42A1FB8615E5B7B5E26486A3F09307A1CD62704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893921, "uuid": "35a377b6-d434-4666-860a-4043ca67f1c1", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893921, "uuid": "024b40d4-e7e5-4a56-a3ec-4cd04e5022e2", "value": "3072:Fm6fmyQA+BF8tlkC42EVOkAz+t/lB2SpYeEvyqbxDFoio56WmxeQZn78F:zQLK42EskAhS+7fyZmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679893921, "uuid": "7be3073b-aa4b-420d-bbab-0efbbabd377b", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679893921, "uuid": "85c02211-bb80-4ba0-85b4-77ae2e8956ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893921, "uuid": "b0909e6c-9485-40ed-b3d2-428cc51575f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9460b4-cc57-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1679891165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679891165, "uuid": "cb6afab8-454a-4a69-870f-7736eb47118b", "comment": "Malware payload (NetSupport)", "value": "bf544c611cfb3d368804c5d30a7f5308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679891165, "uuid": "58c5fc15-93fd-4a6b-9713-c9f0455e2f1e", "comment": "Malware payload (NetSupport)", "value": "c8449615cbbd5105e7894fdca6c5e9b278ce7692a0af96d4540c332df49b8eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679891165, "uuid": "4f74c7b4-241a-4131-a5c9-dd14d1ad3fd7", "comment": "Malware payload (NetSupport)", "value": "fb18778b66c54bcc0f1390acdcfacaf8da320215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679891165, "uuid": "7040f2bb-66a2-4cc7-bf7d-6d4756af0e62", "comment": "Malware payload (NetSupport)", "value": "063c0d64515aea87b7fb171a238827262298f67f751e85c2660163674c27fdb9f513f279414da5ac0adaa23b370b5456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679891165, "uuid": "6cc75982-4ba7-449d-b4ea-2d14a97c1beb", "value": "T10FD512C0336AC05BE96309708EA3C39D9359FC98AD32385B3364FB5F963A9D29E54705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679891165, "uuid": "cf09588e-2d28-4aab-9d81-b3e535e1c31d", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679891165, "uuid": "b4bae44f-50d2-428c-9e9a-cdbe79bc6ae8", "value": "49152:SKINhiFm5Dz8twrCSzcB5ALEgFigntylPIVQgD0m2w2d+C3gLh4n2:agA5ktwrBzcPtYslPp+0fd+C3gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679891165, "uuid": "5ed23e3e-5be8-4f65-a8e9-4757a2d4b3b2", "value": 2792448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679891165, "uuid": "e2eb9e2b-1e25-4bbb-b703-3061ca1a84fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679891165, "uuid": "142172c1-0924-4489-8922-7e0e258f6dbb", "value": "C8449615CBBD5105E7894FDCA6C5E9B278CE7692A0AF9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8e376e-ccaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679927023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927023, "uuid": "e2d20d13-66a2-48bf-b222-66ca30bfce4f", "comment": "Malware payload", "value": "2556104c860489966ce4d0188a3a42e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927023, "uuid": "176da6a2-306f-4b67-94ac-6a5965dfc1d9", "comment": "Malware payload", "value": "c897f9c85890f0d0b5b6b740235a1e83b547bfa0900ea82bf4771716f60f88ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927023, "uuid": "a1b187e1-6e79-4f0d-b84f-27ad0d814e59", "comment": "Malware payload", "value": "eb6c7d44de79b268a0c003df5924fa40a3d5b99a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927023, "uuid": "ac9cc9d5-63a8-4003-9bf2-3beab92548f0", "comment": "Malware payload", "value": "2d502cb0b6d56d36977bd52b582e6ab2210aebf0d33fa0038fa1c616d22c85fe746535bf5bcf51e1fe95e794bd77284d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927023, "uuid": "062401eb-692e-4981-ac8f-ffe4d6359c71", "value": "T1E5B60C8777D179AAC85348364DC3E35062FDEE60C646463F218472259CE66AF0ED2BB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927023, "uuid": "d02d0583-0867-4663-bb93-652f0ec92c49", "value": "12288:kGjUEQH1sIap9aQe/LceXK/ZATRlCmPSgabf:kGjUEQH1sIap9aQe/LceXK/Z8tPSlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679927023, "uuid": "1f8f6cfa-f1ed-49e5-9a4f-55522f8715c5", "value": 10858496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679927023, "uuid": "319efb31-60b5-45e5-b919-035b3ce0cfa7", "value": "application/x-coredump", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927023, "uuid": "b84ce24a-0506-4ac9-917f-6c4b9165cb37", "value": "core", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d081a098-cc84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679910632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910632, "uuid": "e0a58c81-9907-4115-9a7c-805f4c082403", "comment": "Malware payload (RedLineStealer)", "value": "3e72829c620bdc3e68ac7be4d3680a66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910632, "uuid": "62e6bc26-234d-40cb-84d8-7188ca946dc7", "comment": "Malware payload (RedLineStealer)", "value": "c8a83a59adf0cc70f7e283b74866cd00747030e34e18cf1367a9b3ed76e00efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910632, "uuid": "600ee17b-3d9c-4aaf-af71-37ccaddafd0b", "comment": "Malware payload (RedLineStealer)", "value": "2940c6b0f84f7337be41dda0260f3c29c16d8a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679910632, "uuid": "59c974aa-35e6-44e1-a26d-a20b6a1631cc", "comment": "Malware payload (RedLineStealer)", "value": "0414356bc698d340801097197cf3edf4baf0f084f8bef496440a684b2baf53eee51e4b714c2551eb738afd339070f12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910632, "uuid": "511d681d-3e8c-4c70-a72d-f3258e6d5aeb", "value": "T14F252252F3D8CA72C8B9137168F617870E367DA48D31EB163A95940F5C72A84DA3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910632, "uuid": "9be91347-8aef-47d0-ade6-d4507567a8f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910632, "uuid": "b95d0d91-663c-4a1f-aa40-a4449cd3c587", "value": "24576:Nyp8vPnyoU5RJlCPkqYRkWPM/Lx5XzzBt3DIv:op8XynrCPkqYRkeMjxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679910632, "uuid": "c5a008b0-2047-47cb-95fa-edaf9f41735d", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679910632, "uuid": "5c42a376-3244-4c79-b614-6c5214e0cd77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679910632, "uuid": "b62ad759-3ca6-43d5-aacb-e252d635a45e", "value": "3e72829c620bdc3e68ac7be4d3680a66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb53e34-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679912349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912349, "uuid": "84015e9a-ac39-4f9c-9ae0-10057ee3415b", "comment": "Malware payload (SnakeKeylogger)", "value": "ee3abf1a87d75cc4cd46cc2ef240e58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912349, "uuid": "53061214-2c53-46f9-bca2-5d560d568614", "comment": "Malware payload (SnakeKeylogger)", "value": "c8ba51273adab558391b5eec01294b23590f54a65391acb6c74aa08b1d3518c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912349, "uuid": "c2ad4330-0dc7-4553-824e-cd562f12dd68", "comment": "Malware payload (SnakeKeylogger)", "value": "d754e793801e0791ef40d9647b3c6584cc0193c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912349, "uuid": "ad440f5d-6af8-4a54-873c-069054b480c4", "comment": "Malware payload (SnakeKeylogger)", "value": "50ae108e692b022297eb150bbf3a2fc171336b2182210be4eeea09d3264fefbfe26405be1f0823226b719bab587d9beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912349, "uuid": "1f77aa03-4465-4465-ab0c-082dab92ccfb", "value": "T1ACC4E05933E49451F5BF593315B081608B79F8120E2ACE1F67C1B62A2E387D08E66FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912349, "uuid": "d64ec587-2196-4b47-a622-6e04bc972d3c", "value": "12115494f2c86ccfa8a7bf3471dfac33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912349, "uuid": "45c116fc-2da2-479a-ab75-1a9cd766d494", "value": "12288:8e3+HoF73E3HDei3oXA2jCXgXLz/HQOqzjW/NJgk:3WodU3Hq6oXA2jBXHnqzjGJgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912349, "uuid": "1e45b02a-3d64-424f-b52e-43f8ca9f76ee", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912349, "uuid": "82dbbfab-3dca-48ec-bf59-02a258fe4591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912349, "uuid": "241b3304-dc7b-4d4c-9c2a-c3891cc983d0", "value": "ee3abf1a87d75cc4cd46cc2ef240e58e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ca2626-cc3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1679880435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880435, "uuid": "c8a8a4e8-8166-48f8-aee4-e384459958ea", "comment": "Malware payload (RecordBreaker)", "value": "7514b207ad0cb43ce20d5b84ca188b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880435, "uuid": "d8a26509-5a19-49d7-9375-f8eda5d258e5", "comment": "Malware payload (RecordBreaker)", "value": "c971fa3f881544f1fbe018453592887c22ff6c6ed4fe5cccc99e1a1b123c1a66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880435, "uuid": "f21c1d10-a18f-4c37-b09b-96b9c33e38b9", "comment": "Malware payload (RecordBreaker)", "value": "9dbefbd033b67b435f64db3175f3bb738d38d769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880435, "uuid": "7076a0c7-fd75-4ed6-99d8-7246e6ead4cc", "comment": "Malware payload (RecordBreaker)", "value": "84c61da12f098042092a76ef2c205771f60f9da2aaebba4797e4a826965a49874f4a218a6712ae6d27909d4a534e4c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880435, "uuid": "e35186f6-244f-4da8-9de4-e3dc2daaeb48", "value": "T1DF546D1253E17820E76386328E2AC7F82E1EF8615E157BFE16559B3F2971FB2C162305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880435, "uuid": "1af5e7b3-c49e-4f83-97cb-03fe0ff9174d", "value": "5bf64f0a1a526a4cdb08b53a545d3838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880435, "uuid": "5b6bf95d-ed54-4e6b-8c95-9298cb2f4be1", "value": "3072:LI5Yz8L1Thq9CjO2+Q+GsmFiodRq7Zw4pZ7Q7wl3xk9of1f4cqFntn98LCJQN0f1:5y7+Q7suiodwplHf5qht9hTfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880435, "uuid": "c178fbe8-1bb7-44d9-9328-7514390dfc77", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880435, "uuid": "87e11ddb-f18d-4984-b691-e1993243cf4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880435, "uuid": "3802ed92-809f-4375-912f-bb2d1440d66d", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55da86b-cc50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679888226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888226, "uuid": "c92d4240-3188-4fba-bb6d-e0be223b6c5f", "comment": "Malware payload (Chaos)", "value": "b404acd8cfce28de0fcf5d2b0be04989", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888226, "uuid": "40699db8-ac24-4b44-b819-5a346cf3cc24", "comment": "Malware payload (Chaos)", "value": "ca073b77bb9d36ab8aeec19b780f59024b5bb5d985312fb9ad0aa52adeb28775", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888226, "uuid": "4dcff8da-a0ed-4248-83fd-8a76979ce392", "comment": "Malware payload (Chaos)", "value": "51bc4a02d672ce0c4b6e9d5a3a517b934adb670e", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888226, "uuid": "05b41e99-7126-4760-9fe3-e1fa87d72f06", "comment": "Malware payload (Chaos)", "value": "57afa657304b106346c355d0287937f1bbe6feeed5e9248438a104fedf765c8c4b0470cd8c3d0754dc308c36f85498a1", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888226, "uuid": "cad8c650-d89c-4a70-b5a2-74903e03cd6c", "value": "T18DA330243AFB502DF173EEB55FE4B5AB9E6FF6333A0A646D104103460B12E81DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888226, "uuid": "2acbb5e7-2dd8-4b06-a0b7-f47acdf3b9f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888226, "uuid": "6ddcd008-efd0-48f5-b6de-2250d942dcd2", "value": "3072:7oTxIQr9INiHLPYBtBsGLUS3FTotB5CHcv+q1l3sBJXw:2br9ICLPOB1L330q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679888226, "uuid": "c777ef2b-6ca7-4432-8bba-f4609eb89d4e", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679888226, "uuid": "4f1aa62d-4a49-406b-8879-02841393e210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888226, "uuid": "39c7a46a-aef6-4afd-af53-9eed21037af0", "value": "999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d2656b-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1679894934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894934, "uuid": "dc86ba15-07b0-4353-bea8-eb81334205c5", "comment": "Malware payload (AveMariaRAT)", "value": "8d93c0e9645dd3bddfb8f658c51dc1b3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894934, "uuid": "cf3f15d6-9335-4d7b-af02-1f314a4cd53c", "comment": "Malware payload (AveMariaRAT)", "value": "cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894934, "uuid": "c6581cfa-73cc-4252-9f69-984ff9adf264", "comment": "Malware payload (AveMariaRAT)", "value": "5f2744ef4f6f2930bc320382df3d23d06e7ae9d1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894934, "uuid": "a6b10551-354c-4a82-a6c9-ea7bcb7c4756", "comment": "Malware payload (AveMariaRAT)", "value": "1ba5f29515c1939ebf3ec6d503da294b2897331108cc0a11f2d5583e743d294553f9762d660d63c04c5bc4bc109707b6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894934, "uuid": "2db5900c-7491-4ef1-b09a-9394e84bd1c3", "value": "T13D446A16FAB74105C1EACA3FABB50541DD17B47C4A7ACA46C64C5B9E27AF20209E0F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894934, "uuid": "279ae302-95aa-48bf-a0a6-635e44ccc4b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894934, "uuid": "61ac6fad-470f-47be-8253-8dcc4088ce42", "value": "3072:f66ea8jXuZ6bgAbd2wVH3R8LmzvzzfYuIWYCyXdgCLdCRaOVvVGb31fT0d5Ys:fKg6bgAEoB8LmznfYhWY0+JOm108", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894934, "uuid": "babfd97c-ddf7-49a9-9151-1dbe3664a4e0", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894934, "uuid": "8821cf4c-8f4f-412c-94e0-93cc153e1c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894934, "uuid": "10dc3315-e86e-4206-bf15-4e642fce6f00", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a656b4d-cc4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1679887778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887778, "uuid": "8a041e80-fd53-4c8f-a90d-80724b608e9d", "comment": "Malware payload (Chaos)", "value": "4356759c6249d6de9fcd7aeb5452bd13", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887778, "uuid": "59cee40e-5e53-4456-832f-6e30a8f40df8", "comment": "Malware payload (Chaos)", "value": "cc023cfede805c5e009dc218e2b1d2fbde7b8843d81e615f49f71977d5ee7e10", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887778, "uuid": "d8d659b0-7a78-4e54-a2a8-722d88647d52", "comment": "Malware payload (Chaos)", "value": "75fa257e4c9e4aef59c530e702f16d8ea4bbf1f1", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887778, "uuid": "fa4cd2fb-123f-43c3-9496-8095b61a2b9b", "comment": "Malware payload (Chaos)", "value": "f03d6313fa40f912ae42111ffe159620330d85e343efe6c63fd957afcfc679357f1569d7ad26568fdc5e544057d45c66", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887778, "uuid": "57bfab4e-6547-499e-9a2f-9c6b8e3b3f80", "value": "T151050102F99094B2D67119311929AB60683DBE200F648EEBF3D45E6DF9301E1F735BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887778, "uuid": "f953e1c2-f0af-42ab-9226-4b5f39e88b4e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887778, "uuid": "91ab8da6-086b-44e7-8b23-7a0581c705bd", "value": "12288:VzxzTDWikLSb4NS78GwXSBmNUHPeDy6xLw/j+pCZu+m4O5+/HrlMwLRvtyejsb3E:XDWHSb4NIGUHPeDy4aoWDGKhyeO31n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679887778, "uuid": "df302de4-7f0a-455a-8b40-c1435acc01cb", "value": 838064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679887778, "uuid": "8b7ebc5b-77a7-4404-ac7e-73c240b4b23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887778, "uuid": "87fd99ac-2a7c-4c88-8c92-14b3a18b7339", "value": "IPcheck.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4af9e3-cc87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Babadeda)", "timestamp": 1679911754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911754, "uuid": "0827b508-02d0-4557-a9f6-88eddcc460dd", "comment": "Malware payload (Babadeda)", "value": "71c101b3a23e52ab24da1712afe7bb32", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911754, "uuid": "cfc32ac3-7d78-408d-8055-45ef9f0ca709", "comment": "Malware payload (Babadeda)", "value": "cc8a7336056b2116c83501aa5121c7c8fde943dc42cb2a4700f817d0ffe4b8ca", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911754, "uuid": "7bbed84e-a94a-4f46-a4a5-ceef7464be5a", "comment": "Malware payload (Babadeda)", "value": "2f8ccf9dec13578d505dfdd5e5fa2261ceb3cae8", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911754, "uuid": "3293ce2d-0acb-4530-958f-4cb0a0e9bf6d", "comment": "Malware payload (Babadeda)", "value": "564cf9631ff9c4bd8b686047bd67fcb8f32b1a6456e9d5d26dbf08fa9d6751641fb7d76af644c5f184c6d4cf0a48d8e4", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911754, "uuid": "c31dadd9-1645-4d1a-9fb3-4d35da0d2fd0", "value": "T1EF85A7D80F6C4C96F182FC763675C2229D3948C9864A607ACD195E2BE1BBCECE0C7D65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911754, "uuid": "72d0370d-aebe-4ac4-8da6-2581103283d2", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911754, "uuid": "83405620-c1d9-4d06-bbf8-cabea62268bc", "value": "12288:RoSWNT8EYo1VFnA4r5rraOVokssOcnh2tbbLqhS8aK/:RoS2T8do1V6u5rraOVouOcn4tbbR8aQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679911754, "uuid": "60f483d7-3fc7-48ff-8b20-08a0ed1c7002", "value": 1755648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679911754, "uuid": "ff967ad7-921f-4b3f-b585-b397be3a8b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911754, "uuid": "433d815d-f92f-4e44-8ec2-e94d059a5baf", "value": "HURR-DURR 2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a3da55-cc73-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679903128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903128, "uuid": "4483b396-f17a-4b0c-982f-11588fb9959b", "comment": "Malware payload (RedLineStealer)", "value": "36d283db1baeb1f9234febc0e8b77847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903128, "uuid": "02360b2c-7a4c-46fc-9c77-c6df6ec6fa79", "comment": "Malware payload (RedLineStealer)", "value": "cd2975720f2128167c2550cdad7c52fce440c8fa4c2062c1bca275915b73ad93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903128, "uuid": "ab05b0cf-4044-4cc8-8e3f-76a8798efb1f", "comment": "Malware payload (RedLineStealer)", "value": "d322a15b60c6197d1ecb5be4ffd1896c032241fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903128, "uuid": "38c4f4bb-1ef1-4d34-91e4-f6a948587cbe", "comment": "Malware payload (RedLineStealer)", "value": "8d6801d358439649623715bfe80d45640a165d377735941401cc64ed351f9ef191dea808761bf8f3788874052ee021d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903128, "uuid": "6268f5c4-98a8-41e0-859f-f8e6863837de", "value": "T1AEE41343F3DC4537E9B673708CF641E3193ABDA05878826B2B4A9C9A1CB25C0A935767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903128, "uuid": "cae4c40d-5d96-4570-a195-77295fedc617", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903128, "uuid": "b014ccd0-f106-4689-b407-15c1fbde5af4", "value": "12288:wMrGy90LEYYNVVA6Z4DHF9rHJfrnnIkRv0b+gUOhSHhus43H1/XObmRk:myPY4AI8HFDfrnnI88iR22os8eSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903128, "uuid": "4a8f229c-50c7-4595-a46a-4823a2897a19", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903128, "uuid": "4797f6d7-080b-4b0f-aa1c-272a61761b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903128, "uuid": "77f3227c-6546-4971-bbdb-256336a9eb4f", "value": "36d283db1baeb1f9234febc0e8b77847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b058fea4-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679901559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901559, "uuid": "725976eb-3130-466e-9be3-0ace4bff06d4", "comment": "Malware payload (Formbook)", "value": "e9286af0e6c41541277a9c7c6f0ad36f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901559, "uuid": "8dc78905-3629-4d5f-9f49-8b7e111c523d", "comment": "Malware payload (Formbook)", "value": "cd441b4c9815a2a8c3b5851ecd25c21e174dc34f5ea19c3d1cc6c86e7c70ed51", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901559, "uuid": "0360dff4-0591-43c3-8909-51bb4aff7d61", "comment": "Malware payload (Formbook)", "value": "affb9d957206ee64a70f17a7045616a629b8da71", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901559, "uuid": "475f0496-e399-4275-89aa-0aef98698634", "comment": "Malware payload (Formbook)", "value": "6141bb97804c5ec276e1e3183c74995991212dc661a0ac49684248a4a228510931dcbd14a5ae8e14ce8c41f0f16e8ece", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901559, "uuid": "f1cc0d60-a8b8-47f6-832e-70d843137f57", "value": "T14F642312D27017FCBAD2B66808DE143566BE454EDBFAF95C8918F38F4E39646D42C3A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901559, "uuid": "df82c05b-857c-4bb5-a830-3fe10e5db589", "value": "6144:IdlwBGFn7s7hisY9QfeopCUhqvYoUp0iAeg+hvj+FOs8ZkDOGqO34nu:2wBGFnqhiy2ECVxZnNUr+IODOGhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901559, "uuid": "e32e77a9-3ccf-4537-934f-e68c0a1e336c", "value": 334241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901559, "uuid": "87cbdd7b-bf6d-4180-84ee-96b67a8cb96c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901559, "uuid": "8e714cb5-438e-4a8d-8608-9c8962051360", "value": "RECIBO MTCN_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f224470e-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951491, "uuid": "42013151-eb95-472d-b21d-984c3060bae9", "comment": "Malware payload (Mirai)", "value": "391e6d54abf669aae601ddc0544f9a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951491, "uuid": "0af2d2b4-9727-4b3f-a254-62f2334b8686", "comment": "Malware payload (Mirai)", "value": "cf2aa762e998c4377f0da12830fedb0e8c83f8a76375006b0e47ea7496e4b8ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951491, "uuid": "dbee15a7-cedb-4607-b64f-060a6aad123a", "comment": "Malware payload (Mirai)", "value": "59a396811ba19f6c7874d82f28b6e56037556787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951491, "uuid": "38869771-1703-40f2-ba20-eb7ebf829f14", "comment": "Malware payload (Mirai)", "value": "8267ae7ef0337a0e24a93d74234fe38d86b64a6c1893653be4caa503d58d5908a5ac55b185ed212a08a28d0279250687", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951491, "uuid": "f0489b74-0a50-4ccd-94fc-bbedbd551d8a", "value": "T1D3535CC5B4119E7DFACBE7BE84220E0DB92063A150931B27B76FFC93BD721A44906D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951491, "uuid": "99efaa2e-84f7-40cb-a9d9-430961c6acce", "value": "1536:zCHyfZ7KfAbCeoOX0FdDASl2/3VqqAjio8r:cyfNU78FAuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951491, "uuid": "d1250219-aeb7-4c8a-ab35-e45b43ac1f7a", "value": 66512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951491, "uuid": "54af1942-80c6-466e-afaf-1513185e637e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951491, "uuid": "76f3ec25-1404-48a0-aa8f-86de07dbef8e", "value": "391e6d54abf669aae601ddc0544f9a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0628dfff-ccab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679927043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927043, "uuid": "57dd1e71-7e88-4032-bbe5-cfa221fa5518", "comment": "Malware payload (RedLineStealer)", "value": "f616eefd5bfdb6319b6314777d18cfcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927043, "uuid": "e005500b-d6ff-49fb-b44d-a25eb15cf1fc", "comment": "Malware payload (RedLineStealer)", "value": "cf88c19e1ed803ce213ffd1685f3cbdd787937c918a5dda0f0a2b33d62d18ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927043, "uuid": "35e6c5e0-47a4-4eea-9d72-255b7d03fdf2", "comment": "Malware payload (RedLineStealer)", "value": "c6f6ac1c9418b787cf3e06c1b8ccd737397f9704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679927043, "uuid": "e206c997-556d-4beb-abbb-ff49799dca49", "comment": "Malware payload (RedLineStealer)", "value": "0b817d065116eeaee3f863e83d21ab96bc61623d4d93c32f99a4878dec0895b6766a3467a2b5de407f2b4a09f5ff3e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927043, "uuid": "b192e70b-108c-4010-9db0-da696ca9082c", "value": "T11625235397E40A72CAB1677008FB03930B38BEB45CB8574A3AC9698F0D715D4A63677E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927043, "uuid": "a8f1907a-eee8-4d5a-97f5-33882ed34001", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927043, "uuid": "b971cb21-e69f-4a06-97da-7ab3c8d9ed0f", "value": "24576:fy2IEjzDoJ3CM0yMaBku1LXA/NNMQV2QbRI6nQvZ4V:q/ODoRCzayu1kDMyNQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679927043, "uuid": "dd1cbac1-9d38-411d-9a28-6cb48f4c0514", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679927043, "uuid": "9f67186e-ac44-4b14-ae7b-bf4dbf5a6dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679927043, "uuid": "063bf79e-98d4-4425-a41d-e971f9c89cc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a54c352-cc79-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679905682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905682, "uuid": "db6304da-f99f-44cf-9caa-648cbd9b3b71", "comment": "Malware payload", "value": "4b9ec65b2e276c1c7ae5fe8a337643cb", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "webanexos-com", "colour": "#603FF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905682, "uuid": "e611830f-84f3-41b9-a5d5-8cf8667342a4", "comment": "Malware payload", "value": "cfc36a66e0702395ddbc8c80fbdbf21a92729da53f8ff04549fe75a1cc870325", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "webanexos-com", "colour": "#603FF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905682, "uuid": "a49ea9c6-953c-4530-83c3-e6810aa4dc15", "comment": "Malware payload", "value": "5ac74450dc1ad3338242b9237ee8042a98c67bba", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "webanexos-com", "colour": "#603FF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679905682, "uuid": "214d3211-3380-4b69-a894-be6415f090c0", "comment": "Malware payload", "value": "d5804bfa0ca57f86a0111622c090a1e95c8e1fe3dc05639fcad036a2f9ebd541ae9e0fa3308e4aa18c1559281a850aad", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "webanexos-com", "colour": "#603FF2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905682, "uuid": "6cce0a3b-dba2-43c1-bb6e-4f77d3bdae77", "value": "T1E0E5F0AD8412AFC7E119DD31AC9DB612B7D48305B873E73363090BC73FA8665991272B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905682, "uuid": "7d66ba0f-2fb4-4f1c-b642-5c297e36831a", "value": "49152:H35FPyOhqS268sIyupD2IYcE2VY9TSKSJxFYXvJnLUJw2E23t5gB5HPjFvIOV:H3TPyGAl2IYYVOjixUJnLUxpdiPHP97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679905682, "uuid": "1492734d-4be4-4ce4-a0d2-4217162d8777", "value": 3278299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679905682, "uuid": "a5592e4f-672f-4296-bbff-38b418057569", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679905682, "uuid": "481d1a92-ce20-4c9f-95bf-57e9140cc9e7", "value": "base.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef0272c-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894899, "uuid": "d7cbb44c-4150-47cc-a0fb-bde90e7bf2f4", "comment": "Malware payload (Formbook)", "value": "55928e32379750d6a8de4a645b9c5599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894899, "uuid": "d910aead-30d6-4991-a4f9-d0ed48c1ad81", "comment": "Malware payload (Formbook)", "value": "d0f12689eacf1ad6c798d62635bf7f18a855264a42e072ca9a2cb6a742a39dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894899, "uuid": "e014512d-0693-41fc-9675-fb5478d9c201", "comment": "Malware payload (Formbook)", "value": "74585436b947aa304b26fa718a6e82ce0ee1d438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894899, "uuid": "712f1559-4fd3-4230-b07a-f94a2c5b92ea", "comment": "Malware payload (Formbook)", "value": "e4fc115c52def743fc884de7137ba2303ac019f478a753f348e7fb215c659131377ecd77ec4fa015f4ad4fd288abdd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894899, "uuid": "a5bf33c9-9abe-4292-ac53-4ea0e8344f05", "value": "T15804AE36DA42C071E2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894899, "uuid": "ecfd8848-9957-499b-9ae6-20a19d67c81a", "value": "3072:IbX4kQvFJdO43t/c5scFV6hP/zSJRKUweMoeks3jG1ZlRRR:PU2tk5B6hP/MK9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894899, "uuid": "9da60236-404e-4fe6-b72e-2462f7fc2936", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894899, "uuid": "37f8c3df-65b1-46ae-ab98-70aa88ae3f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894899, "uuid": "3803d5a0-c9fe-44c6-9da4-f024854655b3", "value": "d0f12689eacf1ad6c798d62635bf7f18a855264a42e072ca9a2cb6a742a39dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedd27bb-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Expiro)", "timestamp": 1679901556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901556, "uuid": "0e6c7c5f-437e-4532-a188-b460d744de7f", "comment": "Malware payload (Expiro)", "value": "e3b24ec113f20b978b0219371f76ccb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901556, "uuid": "473332e5-e122-4e89-af82-35c51324c691", "comment": "Malware payload (Expiro)", "value": "d1a8dddd0be7a7932b576b395adf6c8a3ab4796420b0f967c39d6ffe65604807", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901556, "uuid": "d853092b-9664-40da-9565-458317b66dd2", "comment": "Malware payload (Expiro)", "value": "fe3812e07afa7def4224a68a8a3d5db849997e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901556, "uuid": "63c3b1e9-19b2-4b4f-8db8-4b1f1ad9d19c", "comment": "Malware payload (Expiro)", "value": "ac9d83835e06fea99c9c26dc750849984b3dab2611a05f7aa6352a25d2038d7b1494e4b0286fb9cc2594f6fd049db0f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901556, "uuid": "6f5180cb-08b9-415a-b83a-42557eae9d3c", "value": "T1F835339197B4D131E4E94E70B6B851316DDEE24A8D18671E1763B7CC3D530AF8E8730A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901556, "uuid": "1d4807b6-6ee2-4372-b51c-e087f5b87bc2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901556, "uuid": "c1eaa147-f9a9-42f4-95da-37979392dd69", "value": "24576:DYpFDsStI/zStNEjHMjT9MVNRQSXnhRafrMO9RRH:s8+IutNEcARF+fTD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901556, "uuid": "b093fea2-6fe9-491b-b9ac-323c6f8ea600", "value": 1103613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901556, "uuid": "d5546ddc-9f04-41aa-96a7-d6a79326a0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901556, "uuid": "20c660f0-0830-4e9f-a033-07165638a7d2", "value": "QUOTATION _RFQ# 1043999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94c3368-cc9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679921867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921867, "uuid": "a0d5da46-80a2-46c2-9642-50aabbccc529", "comment": "Malware payload (Stealc)", "value": "d7bde048a256ebb4a78abed5f8fce207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921867, "uuid": "9623ac28-e934-48da-ad50-fe2da51f73c7", "comment": "Malware payload (Stealc)", "value": "d25cffb62ca775b060887e2943ddfafe2b183f038e2e416b637fe51853185ddd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921867, "uuid": "292667f8-8357-4e7d-89f6-435565a19cfe", "comment": "Malware payload (Stealc)", "value": "73f28647be2942ca626e17aa951ef218beee8d45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679921867, "uuid": "ef8e3345-a9b0-443f-9d57-a17a6aa826f4", "comment": "Malware payload (Stealc)", "value": "3e87e8ed406790e9dc8ccf2e2503fe7a9f1da2fd08ee1ec2ef19a872c9342a0ba927972c593c22bf4cc4ef959134304f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921867, "uuid": "b3087f92-0b1f-4e28-b2e3-91b1119ca33b", "value": "T11744C02276A0C872E9564534C825CBF86AFBBC705B5949C737846B7E6E307D2EB35302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921867, "uuid": "a07c5cf8-8223-4a2e-94ae-dff4e7faeb00", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921867, "uuid": "40c38dfb-70f4-456f-9f35-a1ac67edb192", "value": "6144:Sm6j+lBknL80Z2uoLb9EH5zTXXp6XCxkibu:ukBkng0ZjPdTXXsSx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679921867, "uuid": "d9bc7bb5-62c4-42b4-ae22-1d860ff4b749", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679921867, "uuid": "d4ec6098-171e-4b9d-8718-9d2ffc60f277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679921867, "uuid": "15768780-7c92-4358-aa21-588c9354515c", "value": "d7bde048a256ebb4a78abed5f8fce207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996d58e6-cc40-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1679881334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881334, "uuid": "90f6a78b-8ad6-4404-899e-811dfc6e15da", "comment": "Malware payload (QuasarRAT)", "value": "aa0bd907cede03c370d7863103f7e153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881334, "uuid": "56216226-8a27-4963-9b58-a5ebaf77951a", "comment": "Malware payload (QuasarRAT)", "value": "d262b02a774635bf5baef0fd67b74dc49ca7cdb3cc96ddad41f36feb727acf89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881334, "uuid": "681b13d3-9eed-42c0-8d3c-8297a851ccd0", "comment": "Malware payload (QuasarRAT)", "value": "4aa0cbbad02417e166d33acb30ed52d385a35c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679881334, "uuid": "1912e422-bc37-4d2a-ae99-db2130b5fa78", "comment": "Malware payload (QuasarRAT)", "value": "17997411e68203557dda4486e3d5d34b02330331daae903463eff92ac9feac5814b023ce715a3bdcb21c4789eb092328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881334, "uuid": "f71a04d4-5a6e-49c1-b755-c0ccfd2f07de", "value": "T144B45B8123FCC52BE1AE57BDE4B14421ABF4F407A6A7EB4F4940A1E92C967429D407F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881334, "uuid": "82840ed0-52ac-4f41-842e-2eb22599b798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881334, "uuid": "e4431e93-48f0-412a-bcfa-1c55f72f6907", "value": "6144:RTEgdc0YJX7IxUpGREWyOdYB8oeRKLEV5guKwJ+KcEBOb8F9GRHClZSscTR3Y:RTEgdfYaxUudYOJv9KwvRp4tClZhcdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679881334, "uuid": "e78c5e10-a4de-409a-994c-ec244684c33f", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679881334, "uuid": "899d0ba7-5048-4cb4-8ea1-76cd66c5d67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679881334, "uuid": "afb7ff82-7c23-42fb-8923-3ad03d6446e5", "value": "CHECKER V2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579ce30b-cc81-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679909141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909141, "uuid": "343c2abf-9663-4ba1-8fd6-92559c20136a", "comment": "Malware payload (CryptBot)", "value": "85caf92b6709de24e1c39c82c32395c1", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909141, "uuid": "59a81e87-dc7d-453a-85df-4c75b616007c", "comment": "Malware payload (CryptBot)", "value": "d2c445a8b7c0f17493dc52fdb23ca0d21231d578d6dd3814f24b2bbb5ddd7c40", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909141, "uuid": "575cbf48-0469-4be7-ba69-7cac1cba97fc", "comment": "Malware payload (CryptBot)", "value": "20f570db9cc7d3b7d70ce155e6631d4305e2d97f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909141, "uuid": "939a05e7-9de5-4603-bede-aab91551d4fd", "comment": "Malware payload (CryptBot)", "value": "f68f49383ae9bc2fbf8467c1f5f1d32955daa5f6e7dd07ef35dee25e6c8e08017566a27f4bb9e7b02677741d83c6a443", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909141, "uuid": "0379b0d0-abf7-4a00-bcb1-e870372911cc", "value": "T11166237347768044E1D1AC7E9137FFE832F653A98B43EC35E6F26DC43525A82AA46903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909141, "uuid": "27302496-4ffe-4098-8b31-b71f96d98e3a", "value": "7d59f1d82b84e111e9b6c1196cc48fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909141, "uuid": "206fabc6-0e2e-4caa-8e52-87ebb21dbe54", "value": "196608:V3i0h4AEWKrehfhTll3MTO2JnnJUaHYppfMn/8sEuF:Bxh4hwlhRyTOCeXMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679909141, "uuid": "1c164939-2c79-4e71-87ed-932d025f0d9f", "value": 6630400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679909141, "uuid": "a582d6ef-ecb2-4680-8076-d40b91828c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909141, "uuid": "4d4c557d-80db-4d1e-afef-3cbf721a3153", "value": "85caf92b6709de24e1c39c82c32395c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22398864-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1679894878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894878, "uuid": "011de9db-d7d2-4b5a-934e-c28bf33c93cc", "comment": "Malware payload (XWorm)", "value": "c9ca161c6fe1c897fe79456bced7385a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894878, "uuid": "b4dd27db-661c-4e07-9ad4-84118e507547", "comment": "Malware payload (XWorm)", "value": "d3560973cf6d7a1faea04ff7aaabc5fac5c8e2c7d5aacbd2fae8423f118ad1ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894878, "uuid": "95f517bb-5ef0-46ef-9f74-1f0fd6912835", "comment": "Malware payload (XWorm)", "value": "2ed335957b7ae95fcdb9b580b77069d02a7bdd55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894878, "uuid": "5b9524e8-649c-49e3-bc7b-9a109bf64be4", "comment": "Malware payload (XWorm)", "value": "4b708d0e11dcbd0f1483a4b4c29909c4007867defaf6c9fff86d1516d9fc850e19c74cd72f5da5958b136d61168669d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894878, "uuid": "466ff866-72bd-4acf-8a67-7e887b090e7c", "value": "T1CC5429133A44DA1AC43C923C6FA2CF896531CAE46DA30757BAF25B15D9B6FEA3D05304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894878, "uuid": "acbf6297-a44e-4bff-9ba6-12da566752ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894878, "uuid": "8d7f6302-3d54-4dc4-9df2-1264830c23a4", "value": "3072:u+SRE3U354nnJDeWmlaiaozyBRIQQ2PIbBtelpGp6ClHtVWp4+f8MMMMMMMMMMQO:25MJ6zVtWIQQ2emI6ClHtVWpaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894878, "uuid": "f9fcde2d-77a6-40d5-b8b7-482d38ccfdcf", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894878, "uuid": "84b85f20-37b2-4bdc-84e5-077a680152d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894878, "uuid": "330b4b74-b759-461c-b6e0-a6701fe0087b", "value": "1220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b51935f-ccf3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679958029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958029, "uuid": "4270a72f-6423-46bb-8a50-0f569a27e44e", "comment": "Malware payload (RedLineStealer)", "value": "afbd8bade4aa62ab02d68ac503a3cbc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958029, "uuid": "e4bb8fc9-ad45-4ec0-8505-ab24edeeb353", "comment": "Malware payload (RedLineStealer)", "value": "d379a37f5c5c7b2da42166112a10412268ed904ffd5f585106cd3462c332bf74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958029, "uuid": "236c9dc6-6ef7-4798-a94d-2a5da43e0313", "comment": "Malware payload (RedLineStealer)", "value": "6e6d97c0d5dc3489672d9b63447546f88b7997ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679958029, "uuid": "6f46d6ca-d0ce-49d7-a410-ba1b313a5e53", "comment": "Malware payload (RedLineStealer)", "value": "4cbf46de56686f05bf9eb943cb36004ffd0bb6ddda312384c21fc15e372da0ae07c624a726f879e6a9abfb0fd5664de5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958029, "uuid": "2857f8f7-6424-4d18-8e27-126296816380", "value": "T168E41342F1E94477D8F51B702CF206831F3ABCE05978C36B7795581A2DB32A1A83276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958029, "uuid": "089adb1b-395d-4310-b3d6-aaba1bc3ff31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958029, "uuid": "b2d17fce-d341-4f94-94f0-716a4a4fa8a1", "value": "12288:rMrfy90OechFFHorvzKdADDAjlMyAaNvj50uDmj7LBq9zjNK:cyj1h8rvu+DDKlMyT50SmHLBq9zjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679958029, "uuid": "6ac6cf87-c93e-4d5a-a842-3e4ad9b0ade2", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679958029, "uuid": "345b6356-afd8-46c7-86f7-eb91ed80ff83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679958029, "uuid": "fdb16bd1-383d-4128-b86b-aa3387b1522b", "value": "afbd8bade4aa62ab02d68ac503a3cbc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d94eab7-cc8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679915137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915137, "uuid": "b746b830-cab7-4490-99ac-bb5e28c2703a", "comment": "Malware payload (Formbook)", "value": "629b9eb152895dffb0f20875ef095662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915137, "uuid": "f52108bd-59bb-466a-8039-25e1abd0ffb5", "comment": "Malware payload (Formbook)", "value": "d47eb4bff603d2015f8dc6512a51e8b37e42c53d7760ceb0bcf34ea875200d14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915137, "uuid": "eef54ce0-d6c5-4f60-b04f-84b5cd8aa4eb", "comment": "Malware payload (Formbook)", "value": "621d9d0399b6ac2dd78cc82ff86df2a4ff8ada73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915137, "uuid": "674c8545-d719-4fde-aacc-74ccccb64f8b", "comment": "Malware payload (Formbook)", "value": "2db41d042e24a31c8e81dca16fe3fa2d6a39c2d6fe0342cbee6e3f91ab222e935ca96b8853ac39d29eb3de714a1c819d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915137, "uuid": "d02086ad-2371-4731-94cb-d49bc580ae64", "value": "T15705F198E3E4AB13E77A67F02AB08940D3BC78E65716DD4E4D8A64C780F57104E47E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915137, "uuid": "809125d5-7605-4b83-9f04-5cba522fabb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915137, "uuid": "5c08df01-34cb-4b3c-9e80-bbf887153bad", "value": "12288:CA5sB0OIZ043Ws3yD/laH3lDhrBbFJeXGSFmwhUq9Nj4ilJhZ:CA5Em+43jW/laHdhJeXGIUq9Nj4iDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915137, "uuid": "4c57310f-2cac-40db-a248-0fd3fd77b2f0", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915137, "uuid": "0fa5dbee-44f9-4562-b0cf-3bb3f076d216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915137, "uuid": "615796d5-0378-4e81-81a5-85580597ae82", "value": "629b9eb152895dffb0f20875ef095662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9c6dab-cca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679923240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923240, "uuid": "4f216dfd-fe0c-4fc3-83b5-92f6450326af", "comment": "Malware payload (CryptBot)", "value": "eef8e729667bcee15a2bb0914868f36a", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923240, "uuid": "08ed6e28-0d37-469d-a369-4d8b0b82c973", "comment": "Malware payload (CryptBot)", "value": "d58c6bfb7dac50a0b5d8604180c31d6192b628d274c329d0d5d54afb0589c6a4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923240, "uuid": "c7f7bcd8-857a-492f-a6ea-8ae330985fa1", "comment": "Malware payload (CryptBot)", "value": "e9d6bf8fd5361b3f3a313b1b44fb757c26662ba3", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679923240, "uuid": "b1df8e53-6a69-4d5f-ab9f-50ad7bd02bab", "comment": "Malware payload (CryptBot)", "value": "65ea68056eb7d61475ed2b32996ef6b9c1c89b9c0cbfa891d93a5551d7b421c8a3901a60068ecc0967a1504c5495a7bd", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923240, "uuid": "b0aecc3a-f38a-42fb-8ceb-f2f1871b872b", "value": "T1A276332312292481F5E48C369A37FDA472F2076D8A82ECBDACA65DC135255E3F713B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923240, "uuid": "a6d0492c-e8b7-411a-b85c-1696df2584e4", "value": "7d59f1d82b84e111e9b6c1196cc48fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923240, "uuid": "17a59e35-3d36-4cdf-84b6-515522190095", "value": "196608:sQxvroiknVp4TygzbPu/33wnH56sYiFP3+m6bDdWpFGJThDlta6aU:FoiknVpK+/3gH5wiFPObwpF4Tdha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679923240, "uuid": "9967fcf7-9839-447e-8419-d66ae201f2d8", "value": 7181312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679923240, "uuid": "027f7ab5-0fc3-46a6-842f-f9055c72ab33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679923240, "uuid": "6ad74e3b-11c9-4de3-9c71-f5f3ae472150", "value": "eef8e729667bcee15a2bb0914868f36a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7848e9d6-cc49-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679885144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679885144, "uuid": "d094767d-b4d8-4993-80aa-a8493e730f92", "comment": "Malware payload (RedLineStealer)", "value": "81c5039c3ca3f2e074775f7472d38f0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679885144, "uuid": "4bf3e4e1-6612-47ca-90b7-bafa4aa7fa1a", "comment": "Malware payload (RedLineStealer)", "value": "d68d2c2c9fcac54a31eb59bad72fc8d7c48d5bcdb39b17cec886e018936165b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679885144, "uuid": "b5ec10a1-bc92-436d-909d-da146b4d9f52", "comment": "Malware payload (RedLineStealer)", "value": "a43ff8435a22f2deeaa8cfdc3c9ab504900b2a65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679885144, "uuid": "846c8bca-97b3-4b0c-952e-678400691a0e", "comment": "Malware payload (RedLineStealer)", "value": "b13b13fec3c5bb675eab379f00f25f909dc2805897f973de1685a6d9f674d5c9135840fa9133cee49dd622246dcbd3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679885144, "uuid": "b4ce1d1a-5869-4d19-8327-163d1ac2f93c", "value": "T1CD25235299E884A3E4B037F01CF517530A35BDB0893C929F3785A8575DB3498A6B2B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679885144, "uuid": "4eb98e13-b719-44c7-a554-b2783875337b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679885144, "uuid": "ba43a2e6-0227-43e2-8095-e118216ccb2f", "value": "24576:Cy4u2oy31+nhZacOFa9eJrzhMWI6wnOW3hr/SY9Qbm//JqNd:pJ2oU1+6a9eJrNJxuOW3tSY2bC/J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679885144, "uuid": "f591c3f2-e966-4b5d-8c04-9513b0d9829a", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679885144, "uuid": "5af21a0a-67cc-4b3f-a8a3-8f233a6473cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679885144, "uuid": "da0ae485-1856-4cc8-9017-0c481523a9cd", "value": "81c5039c3ca3f2e074775f7472d38f0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7225bd8-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Socelars)", "timestamp": 1679913274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913274, "uuid": "5ae5d26b-4046-43f3-b520-5066ea18571e", "comment": "Malware payload (Socelars)", "value": "97d59b6bf9a77d248b1a1175ffce5191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913274, "uuid": "a217f1a2-df4a-4bf2-8b07-151d12ff2b51", "comment": "Malware payload (Socelars)", "value": "d87805d6e7f3b56d268e887b97c3c4fc1a8c4a0a2614867e17677e125462d5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913274, "uuid": "33b389e2-3a6b-4d35-ae09-d16a13ec26be", "comment": "Malware payload (Socelars)", "value": "01a1ab71343fbb007d5c137821d27e38f7d8aa0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913274, "uuid": "edc44d3d-c8d1-4cec-a378-18cff3016cb3", "comment": "Malware payload (Socelars)", "value": "8079f08b3c702d962a37c7f372889420dfbbedb972fe8234c75686dd35beeddb3a5703b7b3df77835a6ec8cc08ef4dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913274, "uuid": "30c29948-835d-409c-8723-7a205c2c7930", "value": "T191658D21FBC26032E8E310B745FF66BE9D3C6A11470894D7D3C81D999B614E27A3B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913274, "uuid": "902f4bd1-a5a8-4cb9-b115-bd655985bdd2", "value": "b1e867ef87efb215fbaa4877aa8fac3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913274, "uuid": "3e1d405d-c236-4a20-8b1b-47c4c2ce79d4", "value": "24576:PGU0HpRGUYHKaPUM0Hqy69NgA+iVvRuPpND5TqJ6y5eXt7dRjA5hgSp:OpEUIvU0N9jkpjweXt7785e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913274, "uuid": "85dee8ad-d43a-41d1-841f-d9d650627c22", "value": 1511936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913274, "uuid": "4199d06a-70a8-426d-9e94-8d783275fe62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913274, "uuid": "127d7b14-e78e-4e6a-a7af-ec886927ef68", "value": "97d59b6bf9a77d248b1a1175ffce5191.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8655ab42-cc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679920815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920815, "uuid": "fb4cff0c-00c6-4b6e-94e5-2f21bf817a80", "comment": "Malware payload (AgentTesla)", "value": "bb692c2529d69ab4e893ca2e30b0d8eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920815, "uuid": "9a2427a1-de26-405f-90ca-c942a5029ac9", "comment": "Malware payload (AgentTesla)", "value": "d9291d64e26f7adb615e269cac4577c1fdd30c2f4f82868d97ff9d1bca4cdb73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920815, "uuid": "abd85e11-0b71-49a5-bf7d-dd926361f970", "comment": "Malware payload (AgentTesla)", "value": "134d722d3d2d64dceb2511ffd65fa65836b7774d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920815, "uuid": "0cbf1043-0dfc-4e8a-b9c8-0bfda48cd15a", "comment": "Malware payload (AgentTesla)", "value": "413452512d9ad5140bfdd45de767b03068f207962c15e9ec2437bbd07a798dc6ae0e716ff606b98b9de46ff16ac31408", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920815, "uuid": "3d1ddf92-15a7-45b3-a45a-ef3f289f7089", "value": "T19E050158F3D86716E7B6BBF069B09500E3BCB4E66B15E98D4E4A20C791F4B104E43B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920815, "uuid": "e810d930-3b5c-450f-8dab-8cda6cc8756e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920815, "uuid": "d2b6e2be-01ce-4f9d-a0de-0d65b0cd9e7f", "value": "12288:vA5xB0OH2J3RcMrPj8gPGr0MdUH38NbC/UkMxFEXkNidD3LLigLJwsuHJhZ:vA5rcFRcMv8mIr6Yp7DsriMysupD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920815, "uuid": "63f9fada-9795-42f2-815c-8406d881dafa", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920815, "uuid": "81e5c9b6-d85f-4e58-ae11-a1a338b648fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920815, "uuid": "51800aa3-d398-4439-8ea1-02428b31847c", "value": "z1RES_AGB_eroFame_EN_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7015c0-cce0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679949926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949926, "uuid": "b34e10dc-b621-4ca3-a4cf-7eb62b6893ce", "comment": "Malware payload (Amadey)", "value": "8b3c6304ff3bd2e35ca474b59ab2e159", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949926, "uuid": "3b465a47-0243-447c-98b0-9c655079bc38", "comment": "Malware payload (Amadey)", "value": "d94601185ca26188c394f7d299828f30caeba8338635565a4cad614b74c945f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949926, "uuid": "60d33c39-9263-4367-9dfd-99ea0cd66f10", "comment": "Malware payload (Amadey)", "value": "2b65edbe590baa889172b574ab33a955f543f194", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679949926, "uuid": "ca16b742-8708-4115-a5f0-40b1f42d4ab5", "comment": "Malware payload (Amadey)", "value": "d0cb1996b20939a61c60c4b6c350ae7ca56e7598e04c7d257323dc3c3b300cd70b576019c9106c6e2df08b5a87c33561", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949926, "uuid": "8ede9190-d2b0-4ba3-bcde-4ec1854df0ec", "value": "T14A352341E9D068B6ED7027B024F702870B36FD669C2453BA3B46989D2CB33C5A572B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949926, "uuid": "3cad8bab-fbe3-4c74-9224-5cdc33c587b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949926, "uuid": "3b7fbeae-1cd7-4e91-baa4-a3d0557d7bc6", "value": "24576:/ybBrPMgGNvZISo3ADC1FB9sAC+X0WKhUo7Djn1fG:KbJgNvQ3AyF7Z3XwH7Djn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679949926, "uuid": "5bf110bd-52ae-4b7f-9f91-3eb88e7daf46", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679949926, "uuid": "47bf4850-de8d-41db-9526-56286e147cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679949926, "uuid": "9ae81024-c471-4fa3-8880-fa3bf978cf00", "value": "8b3c6304ff3bd2e35ca474b59ab2e159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f52995-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679913171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913171, "uuid": "7d0b2831-f03f-4cb5-9c87-ce334cb81ffc", "comment": "Malware payload (Formbook)", "value": "dc3b5dbabdf08531f1ede574276a5bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913171, "uuid": "0b5ac3e8-d250-47c6-b2cd-80f7ed7719b7", "comment": "Malware payload (Formbook)", "value": "da066dd7d70853830debfb1931ab13e48b2556e8b8d116db96749d1f0db43577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913171, "uuid": "4b9ac377-a00e-4641-9dc0-876ec58d718e", "comment": "Malware payload (Formbook)", "value": "8caf527ab8a154579754e3234122866a54811de0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913171, "uuid": "8c440f2d-d292-4fd7-a328-119e290bb152", "comment": "Malware payload (Formbook)", "value": "d35149cc5b2c085d86588ab039c3992b9f3aecf4730184d87eb4d944bdf461dbb504f553d500049cedfadb2722ea0e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913171, "uuid": "89faa406-5033-4e30-9cb1-027928717f35", "value": "T17F05122BE664A211C7A903F51791C944E2AC7CF963A2FE489C8D31D742FB760D993B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913171, "uuid": "33bf66ce-e1c3-41ca-9c6f-a9f9785b12cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913171, "uuid": "226f4dd1-94ce-4b4b-ab84-c5230adc04a0", "value": "24576:rWtNr5pkExWEyAu67/PhhNanqtXi4vbD:CtVfkEAEyA3g2i4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913171, "uuid": "6ebd3f73-eec9-4eae-87c4-208965bc3fe0", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913171, "uuid": "55f4b9a2-5580-4ef5-b19c-695b2829430d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913171, "uuid": "a80c5ee3-1b9b-47f3-83fa-c1d90e7e660c", "value": "dc3b5dbabdf08531f1ede574276a5bbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7a52fa-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679912211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912211, "uuid": "c95b1ce9-8d2d-49ea-9eb5-39000e0b2574", "comment": "Malware payload (RemcosRAT)", "value": "7f2ba5fd227f1d2fd4c4f79e238d4880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912211, "uuid": "7c33a6dd-2c9d-4bd3-a003-2a7cd8e1c7d2", "comment": "Malware payload (RemcosRAT)", "value": "dacbcd625ca7774424759d127d5fd0a02acfd39c9e15caab4b76d64caa6357a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912211, "uuid": "d04482df-2bd5-4796-b519-e1941e759b4a", "comment": "Malware payload (RemcosRAT)", "value": "72d599441201fdce169e270062c59b64607237ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912211, "uuid": "0ee62b4c-5ae9-40a7-8dac-da61b27a052f", "comment": "Malware payload (RemcosRAT)", "value": "1bce1f5c2e5b872894c416182f9980c733e23922772970b0d3d4655bebd8f58b104d26980a55b570eaabd2c17065ec59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912211, "uuid": "8a1e43f8-69a4-4077-89fc-3d3f97eade0a", "value": "T1BC351801BBFACA63E29E1737D4F50D2807F1FC01E662E71F2586629919137A34E49B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912211, "uuid": "3e4b4bca-205c-48b1-b69c-386569e1454d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912211, "uuid": "193aeb01-d5ba-4e98-a13f-28d41f58d6b0", "value": "12288:4nmXI6RRwCGHEdCpGSqgWa+wLEc/VC6o1ujyDr3u3cSVLQBV10QAar7QBMB3Pf6Q:4yGHvGwLEcM6oAcmgBDr7QBMB/fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912211, "uuid": "3a0871c4-f734-44b1-a458-205fe590913c", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912211, "uuid": "b9401d1a-447f-4ea9-a833-bf77a741588f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912211, "uuid": "34c36bab-2cc6-4c1a-a655-7c1403cef995", "value": "Fakt\u00fara BR248527TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d26d63-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679901328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901328, "uuid": "4a3b67b3-62c0-4384-84f6-73f5a4e028e3", "comment": "Malware payload (Amadey)", "value": "b35fdb5ef8a7e82af7204507abbd3ff1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901328, "uuid": "aac78130-908c-4130-85b2-9dda87e1ad11", "comment": "Malware payload (Amadey)", "value": "db6f6b9145322b1f19e1f2a3220476e3e4168d64e2e6a8f4e92a5d16782bfb60", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901328, "uuid": "efd0e0a0-3b8e-47c9-bbfd-fc9708d59a7a", "comment": "Malware payload (Amadey)", "value": "45c3d7b50d6a562cec63f3b2340c9af7051ee940", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901328, "uuid": "0474d046-6a7b-4a96-bd38-8c586ec20b3f", "comment": "Malware payload (Amadey)", "value": "a0ce4d4df33c028bf5c60fd457f2e6a9df51218e8a9012e6d19abd6f200d6526be0aa472fce3063e61a1d374e40540a7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901328, "uuid": "cfa90b4d-021f-41af-8cd2-e7087b3b04d5", "value": "T1ED252312B6D98523D9F633B0A8FB01931B31BEA06D25DB6B23951D1E1CF2E909472737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901328, "uuid": "07174f61-c4b1-4cb1-9163-ae624d9b60b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901328, "uuid": "d3f41721-f986-43d4-a11e-06b74a65fc0b", "value": "24576:myPF0Pf8iATk1mAd1BAY+ep/TMNUHveOvwgHvG6ELWH:19QrATk1m812Go87+63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901328, "uuid": "dcfac5da-00dc-4a90-b7a0-6d8d958903f8", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901328, "uuid": "a993d546-a5a0-4244-93dc-a97cd3ed1360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901328, "uuid": "60ec61be-8cb6-4a3c-af55-f364f6375ea9", "value": "b35fdb5ef8a7e82af7204507abbd3ff1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36ba7f7-ccb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679931226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931226, "uuid": "6c22759f-1bac-459b-82e3-08accd2b7213", "comment": "Malware payload (RedLineStealer)", "value": "cc835924f50ea2bafb2b344179e20459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931226, "uuid": "12608bf9-f083-4eb3-a3bc-4207f052dcb1", "comment": "Malware payload (RedLineStealer)", "value": "db96b96863cf39b3d936fb7591c02c36b7c30287fd1429ef6fec71e929d5be9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931226, "uuid": "90cac89a-3319-421e-a628-375222543e81", "comment": "Malware payload (RedLineStealer)", "value": "4e85d5721418229f85ee5a2925715b83e5652666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931226, "uuid": "c655b25f-a75b-4cae-af57-6ade9a62caf4", "comment": "Malware payload (RedLineStealer)", "value": "d60b740c3cae98894a1c72f22dbb67c979efd8be377453e4c3f8dc883553bc86d19e89e0c4d34d7a54204f2258299b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931226, "uuid": "f4562239-bfdd-479b-9bf8-35529efa8e99", "value": "T12B74E11233B1C872E95655744A22C6F48AFE7870DB9986C73780573E0E383D2DE3A75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931226, "uuid": "6fb1760c-cd1f-4c7b-ad38-ba451850ba16", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931226, "uuid": "6e6ae148-67d0-41af-8c90-45c212c20e29", "value": "6144:LoomuVVTtLQU9MSpNY1PvkKV8j2woP/m0cQPr4hdjZOATN:cEHTt8FCYdvJV8awoP1P0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679931226, "uuid": "db17c419-1df5-4766-b869-0216e6f0e083", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679931226, "uuid": "7a5c0307-8d31-42d1-aa35-dddf96f12f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931226, "uuid": "403845c8-ee9e-4fcc-a986-ea9cb46d95d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc41ea1-ccdd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679948722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948722, "uuid": "475896a2-3e42-4fe4-9da0-aed890e8729a", "comment": "Malware payload (Loki)", "value": "42e18103d12a3f79163c06319e19de31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948722, "uuid": "448f8144-ce57-44d6-a0d6-f6ec8c9e12f5", "comment": "Malware payload (Loki)", "value": "dbfeb751e07116f2eaa7ab39723f044795ae0f222d136011e4d44aa1a999a2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948722, "uuid": "de15ca6c-e844-49a0-b6ef-7fdf129d37de", "comment": "Malware payload (Loki)", "value": "b98b875560d3ddaeba7abf49a909eddf2cd46d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948722, "uuid": "a2e39542-44e9-4efa-adb1-93d04b759628", "comment": "Malware payload (Loki)", "value": "8df1bb765fd0931bb0a46f5e37afd57c83b969a9d04257d7b3c74c20b2886585eb9e8af48ad1c1935d85262428122489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948722, "uuid": "5e9c2463-4a3d-4452-9d20-4ae6ff05d0eb", "value": "T1E084DF016E50F463E7696D31E6F2E30E8A62BE349E015007CAFD763E463F37D6866246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948722, "uuid": "154deb47-3ae4-4882-b0b8-fffee67a0e8d", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948722, "uuid": "b8202265-ab95-4b4e-ab99-ca9663764767", "value": "6144:Ua4TQcaxKCrv7ih8r0ax/gSu+qhgkHWgZDvF7Y+R1O:14cU0O8gOlu+ogUWADvFf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679948722, "uuid": "0b65243f-2498-4ae1-a979-a9d71a4f4aa0", "value": 372929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679948722, "uuid": "41dc807a-0441-4f68-b734-f147c9e5bcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948722, "uuid": "95ae236c-2d9b-46ca-8cb7-2274d35648b7", "value": "Solicitud de Cotizaci\u00f3n (Instituto Polit\u00e9cnic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab19c47-cc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679920984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920984, "uuid": "23a010d7-692e-43e5-8fb8-6b423dce3cc5", "comment": "Malware payload (AgentTesla)", "value": "7dd476ba7d03114a991c49cefec1f35d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920984, "uuid": "6c5e039a-262c-4086-b3d6-ad7af2ebb661", "comment": "Malware payload (AgentTesla)", "value": "df2a750f5f59f60f4c19761ded5aea7cd18fdc31fe19fc8393af535c18179110", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920984, "uuid": "d8995463-5229-439d-af8a-30b720f910d0", "comment": "Malware payload (AgentTesla)", "value": "b882516e17fbc7e1cbb92e1a9a33fe45e07b3270", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920984, "uuid": "14ed5a89-8091-45ba-8e06-7bbd9afb6cd0", "comment": "Malware payload (AgentTesla)", "value": "c7e99badbd223eeb729db23a4abbd9d6cdf62c586d6604ee806ad883eb0fd898d57af6d57b9a5dcb3af2a10103e86a4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920984, "uuid": "70ad5782-fc7d-4a41-9563-dfd209738ea1", "value": "T1D0F433BFB6AD03703518012387837E23ED1DD6F36FEA965D698B59BC2C05909D7252E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920984, "uuid": "70191ecf-2207-406a-aae6-967aa87dc8c8", "value": "12288:+lF3vxFTxs+yECaHdncsGJeNc4/P1OPGzDB8ceuA6RXlAHR8VMXAlPirlScllBNe:MF/xFiE7ncsGJ+P1SGzScdA6RVAHR8V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920984, "uuid": "30237634-eb0c-4779-bddd-32602489afa0", "value": 734091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920984, "uuid": "7f9e62a6-bb6b-4401-b8fb-1129edbb27db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920984, "uuid": "856edd24-a780-4da9-9e3e-6e64e165a12f", "value": "New inquiry - Qingdao Wisdom International Supply Chain Management Co Ltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf634bca-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1679912751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912751, "uuid": "10d666d4-dff2-46d4-8c6a-ce32b68e281c", "comment": "Malware payload (Loki)", "value": "c41e8774f37b9a54c73503a495f790a8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912751, "uuid": "e0896c45-1bf4-435e-b4c4-05b6ca4d564f", "comment": "Malware payload (Loki)", "value": "df7a1c6e8076713e882da40756a2f7496ee2be122203285a4f0a62205188a6df", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912751, "uuid": "e59a93a4-df4d-447d-b33e-cb38a376ae52", "comment": "Malware payload (Loki)", "value": "60c72b5e45ba56c3d318d867a9995ff252fbfc1b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912751, "uuid": "72e6174b-d13e-4186-9cd6-341c50660224", "comment": "Malware payload (Loki)", "value": "83c4224becbb7b50c48a101a2f31bf41890cd1a80df2475aa500627c8713ee37e685a733354511b5eb01a6015745a9a8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912751, "uuid": "9385af16-48b1-4daa-a815-4b9a0165a377", "value": "T1FA551303D045DD8BD0A98378BF237DE6450DBD7272E972C23884B76F5B31E9B854A268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912751, "uuid": "a9cf6a30-bc01-4349-8eb7-821447f9219c", "value": "24576:xLKGWQmmav30xGSSMMednE4P6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXX/4SSMMZ:xLK7QmmQ30MMb6tMQg6dD7hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912751, "uuid": "23d43294-4c8b-440a-9ee4-362acce51efa", "value": 1337344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912751, "uuid": "14d16e69-1674-465b-8856-2e7b710cfd53", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912751, "uuid": "94390c59-984d-476a-ad7b-1df935eadfe5", "value": "Document 00993jj39.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f440c14-cc76-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1679904348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904348, "uuid": "aadceec1-29a0-40d1-b23e-2d8e21c90dea", "comment": "Malware payload (TeamBot)", "value": "37d059689141316003e150dc31a34c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904348, "uuid": "9c72dad0-2d73-48c8-9594-5eb276d3a486", "comment": "Malware payload (TeamBot)", "value": "dfafc19065140674c7b3e3ffe533f121fe6b2fe1ffb9c0a2dfc15a9d030a0630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904348, "uuid": "b2cc75c8-e543-48fe-99e7-0b4015c483c9", "comment": "Malware payload (TeamBot)", "value": "c5ec49918d6b6730c81d2a4285bb2445553dcd02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679904348, "uuid": "321cd452-3c7a-494f-8900-532f36aa5573", "comment": "Malware payload (TeamBot)", "value": "97ea224662bab8e8f5806cec0970961cb38d69cac46af27e6abc5453facf6eee2a4290ec24609e41b8c9f689214f48b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904348, "uuid": "e7cc9228-bae7-4476-9a89-31428458fa77", "value": "T16544BE1172D2C8BED46A41358C21F6FC683BBC715B598ACB77946B3E1D313D29A3A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904348, "uuid": "79130f26-9664-4559-9c5d-3d5d7c086b7b", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904348, "uuid": "85db1afd-c716-4456-90bd-1377d66a205e", "value": "3072:5TlmjeeWXQDwL/5qiFexXUKaKO9y4oeeW2BfsfBXYjzBJzVrsNME4Cs5xbKuEXq:5YXDwLgimX5GdeDBfsJXYjzbiNP45zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679904348, "uuid": "611d2c12-c81d-43e0-b6e1-d3061288f9e9", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679904348, "uuid": "7ba1520f-722b-4f80-8beb-35dd8db25f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679904348, "uuid": "ab6b763b-6c1e-41f0-b9db-3cc45e0334eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcdcd4a-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679913043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913043, "uuid": "cf478fb9-9284-4243-ac5f-fdd22206ab1a", "comment": "Malware payload", "value": "3b652ad93fda4915f60abfa1ec5f826f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913043, "uuid": "9f041efe-e6b5-433d-8fb7-1309934172ce", "comment": "Malware payload", "value": "e0502b775d867bbad6d8843976a1f801336ba3914f5c6623f9486a7b18a2f0c1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913043, "uuid": "96e436ed-0817-41a4-ab67-0c28db478af5", "comment": "Malware payload", "value": "3418a5036c5d45e40f0f5c11b6b25aaebf2fdf73", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913043, "uuid": "b7d7dacc-f5ed-40be-bce7-5c5e160c313a", "comment": "Malware payload", "value": "ec698102259334cafce3d9ccb269273dd0ca9c8cc40cd68857aa430fde76f26e11a3665af2ed4537b22450b4941d9d2d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913043, "uuid": "510fe453-1d1d-43af-b5ec-c2142ad49e4f", "value": "T144617B145BDA0708F3F2AB3AA9BE52594E3B3956ED32C74E0059814E52F1A40DCA3F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913043, "uuid": "1332d744-8a0a-464a-a4fe-669642163be6", "value": "48:8wHaZU9Dmel0iglZ+VslpQfYj1sAT1rTRRSJxodgImcC:8wHxB0+V86YZsErTR0/ygMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913043, "uuid": "c7f39f8b-4bf3-4780-92e7-a4a862b8600e", "value": 3442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913043, "uuid": "ff51a206-a580-42fe-9593-3cd4e09da12a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913043, "uuid": "2f3652d6-87d2-4519-9a0f-dba3bc7f4e8b", "value": "IMG11172453777.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12696628-cc5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1679893563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893563, "uuid": "30c289d3-6ee3-4ca2-9f57-f6f66d42b246", "comment": "Malware payload (NanoCore)", "value": "ccd867cfc63db17919a2f33ad9f62c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893563, "uuid": "09876962-9ee9-4433-9fde-b6f6e8848a5c", "comment": "Malware payload (NanoCore)", "value": "e0e80715b69be95f22d58f621c8e1aa0787fe7975ffa826276f4f5372418f554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893563, "uuid": "c79ff4c8-fae7-4022-b214-c84e6a5c9c06", "comment": "Malware payload (NanoCore)", "value": "59c080b507881b4eabbc6cd8cd017aa00efe51f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679893563, "uuid": "318fb5e9-d943-4e69-bb1b-2831b73ae052", "comment": "Malware payload (NanoCore)", "value": "1168aa45bdf3713290357540f01b54bbf78683743678d2859b4e526672406869e2632cca8b96d61c5f2a6716a3a6c02d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893563, "uuid": "f388650d-317b-4869-b94c-50b5d2e693de", "value": "T1B58412F09A5345B2EBF4A73D01F39934DA36945A26026E74A08157412CBA315FBC7E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893563, "uuid": "02ae0a95-1b24-42cf-a3b7-9184864453bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893563, "uuid": "862e566e-3964-4675-bd07-7bc6203b3806", "value": "6144:tld+RZFkKF5SQBqZq80T4vzTvhM2dOEpPOBVZcA3NjXgU9lKKrsypc/xlf:tldKZeYwfbX3d5O1R9jXdlKOTmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679893563, "uuid": "a15fbbdd-b237-4e99-aaf6-2a6cb8a89a9d", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679893563, "uuid": "0e2ade5c-3c77-416a-96d2-83580bfdd739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679893563, "uuid": "ea52daf7-8bbe-43fe-9381-ee266f521838", "value": "E0E80715B69BE95F22D58F621C8E1AA0787FE7975FFA8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2925e531-cccb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1679940845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940845, "uuid": "9b971152-d096-49dd-9a76-6f61d246e083", "comment": "Malware payload (Stop)", "value": "fc6df56b8d1755886817103249d35cef", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940845, "uuid": "37b80e77-df45-4df9-a77c-888ced60991d", "comment": "Malware payload (Stop)", "value": "e126567c35beb7552d060b99decf67b741751568641f333438b751ea86d41c98", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940845, "uuid": "3d03625b-19a9-4fef-9392-24097a0f31e4", "comment": "Malware payload (Stop)", "value": "0959b12645c9713c2a06485f5190c3e748d3f879", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940845, "uuid": "fe706ddf-f797-4c14-baaa-f1fc755a8a1c", "comment": "Malware payload (Stop)", "value": "c4769367b6ad681f274b57bede49132f4b8648f425f05eec72c81328d006f3d2b079d136e8bfb5f69b7be2cf55c59539", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940845, "uuid": "0f34fb4f-b39a-4b42-a57b-757f1cf60c39", "value": "T190F4132172D0C077CE6107B54820CBE95E3978355F258AEB3F8987692D607D19E393BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940845, "uuid": "3c4f7a01-bb19-425f-a814-75750612135e", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940845, "uuid": "af63cba0-ac1d-4c2a-8839-1debf4958282", "value": "12288:bcK5tjNGhgdLfsyFdheKBvlt/+RhF0fMFP8d5hYhHnYxzBeBB8pAx1mG2I:YYvGh2f9Fdh7BbEhqfMFlVnYXe/82j1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940845, "uuid": "87109fd8-81cf-4f78-bdf9-0eefc30211d6", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940845, "uuid": "25efd719-8f2c-4de7-841c-0053a3a34e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940845, "uuid": "81a23886-e12a-48b4-ab51-4f2d576009c0", "value": "e126567c35beb7552d060b99decf67b741751568641f333438b751ea86d41c98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f146d29-ccb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679931567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931567, "uuid": "65069ab7-19f6-4495-b003-f2d3a5475058", "comment": "Malware payload (RedLineStealer)", "value": "22a52fd6cde6f16f8d8a533cab615d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931567, "uuid": "57858a5b-d2da-4373-a020-77de15e33240", "comment": "Malware payload (RedLineStealer)", "value": "e22cd3a8e74e1e54cdcb25232b5d7c77c8581df0df866725be0cbddfa48404de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931567, "uuid": "2951f50a-63db-48fe-bf9f-6856237c599e", "comment": "Malware payload (RedLineStealer)", "value": "8d650de9ebd4b0d77ef09c271a9e5483874bba30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679931567, "uuid": "683bec4a-c086-4102-896d-29eaee420992", "comment": "Malware payload (RedLineStealer)", "value": "743d93414ca9b62217da102e32e2d412284caa6d7817c88666b2229e3700b728fc9fd5c513ea65a9359baf1f0e54fcba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931567, "uuid": "44f3f606-1470-40e3-9cc4-ceba85d37cac", "value": "T11E7528A36BC6F4F2F96DA13137A26E2444276131FCF5ACFB06441E98262BBC06D31597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931567, "uuid": "6df553ee-0df8-45be-bbf2-29caca3939dd", "value": "0687d0d0d948483526792bab9d2b83f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931567, "uuid": "da4979a4-aab0-47f6-9bd0-3cb5bcca36b3", "value": "6144:2n9R71FvLHFla0OR/AOOp/QP/ojxzPPkq7n+UG39P:2n9R71FO8W59P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679931567, "uuid": "98bb8289-55ca-4f47-97a5-4bc0976c013a", "value": 1573792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679931567, "uuid": "d9f8d996-e730-494f-b32b-b0fcd3d0828c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679931567, "uuid": "92d63d54-0da1-4a7d-b833-8fd6e5d84db0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7664e08-cc6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679901544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901544, "uuid": "c09c3936-4802-4b4b-a8cb-289836aafba2", "comment": "Malware payload (AgentTesla)", "value": "c65ec32aca2b540b8facfa2f6890ddd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901544, "uuid": "3e27657b-c86a-4970-8c8d-9d3e8a08907b", "comment": "Malware payload (AgentTesla)", "value": "e31e0251690d0da33289eff6d43dafb913314b28637667b2017bae3d99e95119", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901544, "uuid": "1ec70008-2875-42d2-8310-f577bac28604", "comment": "Malware payload (AgentTesla)", "value": "5a253163a6d61d5a5f5c8da3e2fccbec0d448f07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901544, "uuid": "4e600a59-5510-445a-91e8-7a38ffce7219", "comment": "Malware payload (AgentTesla)", "value": "bac7c7d1a00a1630713b21952f6e304bf4551cd56ad5fdb8a1bb7b8b10ecb798ac37a63e9a92e8da0d51c5fbe8386561", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901544, "uuid": "2b0d4d1a-5033-4f8a-ba13-641dcbd592f5", "value": "T11C15E08C7B6875DEC927C9728A646CE8E620287B530BD213A407159DDACE9D7CF112F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901544, "uuid": "93d364aa-1338-4fcd-909f-044c215926a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901544, "uuid": "2ef44a38-2d60-40ea-91b1-dfee7e19adf1", "value": "12288:AaR2SUvKjY2y5Fa6Klyz2PeCTvPIp7BL4DQo10MsNp4wE5WcTXuXTD6cyV7DbtIB:J+Bs6Kk2RvwpNL4DMp4f+XTec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901544, "uuid": "a3049611-911d-475d-8e14-fd3e11a9971e", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901544, "uuid": "0d246e02-3c51-499b-be84-32c62f8ef182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901544, "uuid": "1a196c13-b78f-4732-a7ee-181614d8e1a9", "value": "DHL Airwaybill & Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adf181b-cca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679924071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924071, "uuid": "4b8b38f8-67ff-49f6-9401-15c77bd305af", "comment": "Malware payload (Smoke Loader)", "value": "18bf796bed3dca32beeea437de1127e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924071, "uuid": "69712fe8-3cf5-4ab8-b571-d7ed3b5c5897", "comment": "Malware payload (Smoke Loader)", "value": "e39d66d4711d41ca30da9a9d16376774b4d5a0f106fea8bc943b885da998e00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924071, "uuid": "b7bea657-a70a-4f74-894d-fd8d37f42094", "comment": "Malware payload (Smoke Loader)", "value": "d0153f48dda4d62c6dba55955edd2eebef008e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924071, "uuid": "0997643c-3cb2-4e95-a8cd-b8bb4cdc071d", "comment": "Malware payload (Smoke Loader)", "value": "9b10e39c361c58a37f43de5885b7bcfc948d54ec5e84491fc0ebb0c7fb08545aa881a82f7d1c4ccafa4e6b5f2452540d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924071, "uuid": "1952b2f0-1fca-41fb-9882-da188d11b4b7", "value": "T1F244CF1E37D1C872E85741758822CBB46A3FBC714B6686CB3794163E5E307D2EA3630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924071, "uuid": "2d844e77-fba0-404e-b34b-813154f80825", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924071, "uuid": "8b195ebb-671a-4944-be1d-599316fcbced", "value": "6144:Up4MCykkLckNafcRBInLTwpnGANKfD+EUBuO+:GeykkYkAUvI/XAsJUBup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679924071, "uuid": "2428631d-1661-44f7-9e6d-2ae3cea79a2e", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679924071, "uuid": "491ae6cb-fac5-4093-80c2-1c60720b809a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924071, "uuid": "00085120-63a7-43b4-b6c6-dbce14ea41a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d5bfead-ccb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1679930920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930920, "uuid": "729b0cb5-2855-4c0d-96b0-b1f6bfba2f78", "comment": "Malware payload (CoinMiner)", "value": "6263d643c0d58b6c2a93a84b52305cab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930920, "uuid": "022bb417-63bf-4d92-8eb9-a111167d5f88", "comment": "Malware payload (CoinMiner)", "value": "e3b2d5d28090159d5f3e1587633085ece2fc54a369f2685252909f1bbb28cc3a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930920, "uuid": "110b5661-6fd4-4b20-955e-81d98cfc9e4a", "comment": "Malware payload (CoinMiner)", "value": "e7170cb232b503e0f4e855cd971a4fb85b7fad01", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930920, "uuid": "3306224c-119b-4486-9219-f75798963942", "comment": "Malware payload (CoinMiner)", "value": "6d3dfd1859696b7a932100a50a990ec6d9405ed0a4a34f2ba15decdc300dd4f9534499b1733fbb5f06c0474ff50f4ae3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930920, "uuid": "7a7853a7-b426-47b0-a570-379b19782388", "value": "T15144CF223691C432D45B01375866CBB8EA7BBC71FB6686CB2794173D4E313E2DA39346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930920, "uuid": "b3a7ba25-e40b-4486-8172-908221636086", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930920, "uuid": "6cc3aec0-de20-409d-a800-2458cdc2e8f7", "value": "3072:f15ld/jSIFzGdkYLYtKy+UUOrD+tVVe71rOFqdbRzSAvX0pj4yMvfj5qvEPbX:dLdDz+kYLgKbUpro81OFqLvqj4yMAvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679930920, "uuid": "ce805a6e-6b4d-480e-9717-d6720ebe97f2", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679930920, "uuid": "08ce96db-de6f-4887-a0fc-052bae4e4af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930920, "uuid": "0401f469-ade5-441f-b6b5-79fa424d5f4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e96e30-cce9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1679953884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953884, "uuid": "6035d710-599b-477c-9e78-cb6565dcdc93", "comment": "Malware payload (Tofsee)", "value": "cd8743aa91752e2e02571b2fe3a1c27b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953884, "uuid": "c7fdf8d0-61c6-4d8d-bb61-e265e9b3eab7", "comment": "Malware payload (Tofsee)", "value": "e3c7793b26883da4922c5bc91a769b0c1345badc04c967e5f89177aaf8364ea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953884, "uuid": "5e28383e-d19c-4f84-b85f-139aa029f44f", "comment": "Malware payload (Tofsee)", "value": "3ba45028288170cfa3f137f5ce8924f0fbf6d36f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679953884, "uuid": "833676cc-814c-4598-95a9-91e2cae69476", "comment": "Malware payload (Tofsee)", "value": "435f69c3932fd0c76fbdfb96c149d4decd9d7cb523c5c96d4bd970b761007ff91eed4bbacc51878bb0f206bf805bafad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953884, "uuid": "e3b1b2d5-68db-4f5c-8b2b-a8350dcf216f", "value": "T10644D022B681C473D91F01BA4C16CFB46E7A78B14B69CAC76B4406BE4EB17D29F36305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953884, "uuid": "ed15eeab-6662-423a-ae71-851b9e6bed02", "value": "d233995a591f0c21b167474a8600ae08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953884, "uuid": "0b43890a-2b72-497a-b73a-d5445c00600b", "value": "3072:FzSyRHyNFTsVxLZfLOAFGCluuTqoJUR1d5rFIjRu4xDYFLdBL5kMpDCU3wsUf2:9P5yNmVxLt4KmoaR1d5ralfxDYRSMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679953884, "uuid": "d51f3ab9-3eb1-4162-8503-149330935a30", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679953884, "uuid": "e22aaab5-a819-46b4-8e7a-766ff6ff7f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679953884, "uuid": "94322ffa-5454-4580-ad22-c963f99d7c7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a43225-cc88-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1679912176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912176, "uuid": "cf95fd79-e087-42a9-8367-904fd6c3aa41", "comment": "Malware payload (RemcosRAT)", "value": "a241cd7ad49853340fe96b8133de78ee", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912176, "uuid": "6de96016-2822-4883-b92c-db7d52a5542a", "comment": "Malware payload (RemcosRAT)", "value": "e4bfe77c15d0ce69bde5baf8e5d6f311f0782cedbd35efb4d1e8925462a7c19e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912176, "uuid": "a5f91fda-3e5d-4d06-8f7f-db4de1f54771", "comment": "Malware payload (RemcosRAT)", "value": "cfa5bba8b276d9206a58b4162fba83b0e6411013", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912176, "uuid": "50a1e19a-52fc-4920-bdf6-a5c4c0c6b339", "comment": "Malware payload (RemcosRAT)", "value": "af808c1e1790ad5ede32dc00009468d3cd358cfe6fb3b040aa01d002003c1faae07e839c3f3b3d91482fa9b727c5e322", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912176, "uuid": "a24af2f1-e05d-4d0c-8b33-1922cf61b4b2", "value": "T1DDE40142EFB6EF72EE30117F8694B7398F6E5E9510F6391A3118B6643EB9C10D048396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912176, "uuid": "9d46b82c-e31b-4f6f-bda9-653856225cef", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912176, "uuid": "b39dbc47-90cc-4289-bcb4-02ce7674bb66", "value": "12288:yYY1maMbGfNs6AgprwTx9VEH/RC/AGht+Cna3+PjJNdk2EtLKqTl:yYY1A2O6priKfArICn8+rJNd6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912176, "uuid": "4c0142b8-6af1-4bef-8f35-c07dc47ae410", "value": 705756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912176, "uuid": "41a9cea7-14e6-4834-8ede-01d8ef63b532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912176, "uuid": "8213ff15-8dc0-4f0f-8ba1-cadabf142c21", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4351f62e-cc53-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679889350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889350, "uuid": "cd07baba-e7e4-4729-aa73-b4295518b46d", "comment": "Malware payload (Amadey)", "value": "130d0256a34019d5b47c5d12bc79a5bc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889350, "uuid": "a7844063-c5c9-466c-bbe3-af19a6c7f45a", "comment": "Malware payload (Amadey)", "value": "e5695e72ba1c8e424955676b346a790e356ea647830df26be721ea039345b16b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889350, "uuid": "b9f26cbf-0a3f-4fd8-acce-d15a3f111b8d", "comment": "Malware payload (Amadey)", "value": "e9d6d952198fd71d29a9dec9d547782d53478768", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889350, "uuid": "6c492cac-6d0e-46f1-8802-faf7debe3913", "comment": "Malware payload (Amadey)", "value": "1ce8b07eaee8d9e667708c218a8bcfcc98798e77840e41292442801130b5ee98c7d41051ad5e56b9ca644887938fe88d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889350, "uuid": "643853a1-51ef-4769-bf81-9a626cf2b989", "value": "T118252353B7E841A7E9B017B048FB51C3073BFE621979926B77829C4D1DB2A84B931336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889350, "uuid": "ebbb6257-8230-4189-8a89-d65413896150", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889350, "uuid": "afc606c6-12c1-49b5-b41f-c3d0e54c5dc3", "value": "24576:ey3T9BxCAtYwUNoCj7eH+K407swUFpygfadQZd:tsOUGyei0wwUFM1QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679889350, "uuid": "3f9a458c-6ce3-4d0b-9c2f-39be2c6d3b26", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679889350, "uuid": "74e318af-097e-4d62-bdb8-f67904c6b83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889350, "uuid": "d32a4738-ec35-479f-a9e8-29ff7678e070", "value": "130d0256a34019d5b47c5d12bc79a5bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4f2961-ccea-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679954190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954190, "uuid": "bf17ebe5-3f54-4bbf-b575-63fd9ced2f3d", "comment": "Malware payload (RedLineStealer)", "value": "50bed3c6bba6670db4c9867393328d90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954190, "uuid": "38ea4b66-8565-486e-840b-b1b75bc86067", "comment": "Malware payload (RedLineStealer)", "value": "e8061c4a5d44143d2b0df94c2563f57e8518eea615c25c9263954a2e54e72cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954190, "uuid": "42a5c857-1491-4510-980c-80fc39d807fc", "comment": "Malware payload (RedLineStealer)", "value": "6739115ec4db3c6107b69386c665373c4bba4d99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954190, "uuid": "e4a51b6f-0a69-4beb-a4c2-c5fcd3d90c94", "comment": "Malware payload (RedLineStealer)", "value": "94850e21b866a3b1a2743d69def4212a5684fbc7d4429985ee837d40902a4930f58fef06bddfb42b17eba94df0257ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954190, "uuid": "c42777a7-7083-43cf-a399-d6d67bec6a65", "value": "T1A474F1517682C0B3E91E06F48916EBB5AA7E787187D849C7BB4417BD0E303E19F3631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954190, "uuid": "4869e182-9e81-4ae6-8c9a-352c2165477f", "value": "d233995a591f0c21b167474a8600ae08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954190, "uuid": "9544f8a8-9c48-4fee-9b3d-332e48dda32d", "value": "6144:2CF5yUCQYLtIrS9cFYih8wDhJuMRFRvowlszw5NXQteVtAK:PQQYZIrQLi2wDWM9oyaaNgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679954190, "uuid": "cfc3e96a-3cb6-48d3-8047-c8d9bde54a15", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679954190, "uuid": "6e5fc6ec-1417-493b-a5c3-048efe9114a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954190, "uuid": "abb0aa37-c35a-4709-b8de-85df8e1952d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2137f8-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679895054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679895054, "uuid": "f8540d51-ac7a-4195-877e-dffadf012c9c", "comment": "Malware payload (RedLineStealer)", "value": "af8818d249818aa7ef4c0ef7f2fe0f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679895054, "uuid": "b2a4366b-67ed-4f7e-845b-cf210dbef74f", "comment": "Malware payload (RedLineStealer)", "value": "e88df728437f4b3dfb47b686246fc520bb9bd03364b34590502403008e2b4faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679895054, "uuid": "df39c1fa-c3d7-476b-8a43-004b41e5c916", "comment": "Malware payload (RedLineStealer)", "value": "046d89a6ee946302fb95f3646fa2b82f8e1b6f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679895054, "uuid": "bb8fb6d4-675d-4ec7-bd5b-aea42bcc25ae", "comment": "Malware payload (RedLineStealer)", "value": "a8606e4c521afde184cb9e3d2e71432d964ed0f4c0cb9cd363da08f2c66cc98b2eca8f5888d20f79b8626302b16d1b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679895054, "uuid": "587abb25-880c-4a06-8abb-35a4df951f64", "value": "T10F252203B2D9C462DABE13704CF717971B35FCA29E3593A6775A9D2A1CB25C4603232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679895054, "uuid": "f3342f8d-5c4c-4eb5-9914-3c11ccfa034d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679895054, "uuid": "8851fcef-4fcb-47ae-a168-ce11419bfd9f", "value": "24576:ryqLmwcXYHyevjY28Ll6AN1nbn1NgBIk4Q8Z:eq4oDvcl9nwx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679895054, "uuid": "fc79835a-0d44-45fc-8ded-2fac33e52983", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679895054, "uuid": "58ec99de-f945-4cca-a790-06ff094f5ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679895054, "uuid": "b406dd60-633f-4643-bbb3-5514777cf61c", "value": "af8818d249818aa7ef4c0ef7f2fe0f08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8b3249-cc3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679878839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878839, "uuid": "82d70327-b326-4992-ba59-80e3c18101fd", "comment": "Malware payload (Smoke Loader)", "value": "5bddf17d5b2dabe75e5d6fd83d5d5ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878839, "uuid": "e2d81786-8e20-46bc-9ac3-785d95dc1ba9", "comment": "Malware payload (Smoke Loader)", "value": "e8fc6b6e611781efb27929ce87e7a052f2864c89b4a7b345eb683fa287858627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878839, "uuid": "6c9812d6-904c-472f-b044-a4447bcce9e4", "comment": "Malware payload (Smoke Loader)", "value": "e5820df5153dad7eea52facd6b94c7ba4e17f1c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679878839, "uuid": "42073d0a-dead-48fc-8a07-31429dd506e2", "comment": "Malware payload (Smoke Loader)", "value": "2b9a6826e373963c730512e5617aa492b430e1a6f218d93eb83c263dce08f360c26b0b5699393be9667adee2c6ae8d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878839, "uuid": "64df62ed-af2f-4f90-9316-5dd9348e746d", "value": "T1B6547C2AA3F46820E5734732BE2EC7F42A1FF8615E577B5E2648A93F0970761DD62304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878839, "uuid": "f3b4dd0b-e73c-4f10-a0c3-8335a2ea064c", "value": "87d886eda68b09da2d904f9205843127", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878839, "uuid": "e25af54a-ddd2-4b4d-b92f-684768e5d783", "value": "3072:03sIzoBeraWdiVXYaGOd0dIVzH+6FSYMXxAv6rR25b8fX4Tn78Ug:aOX88XYUq0SZC5Yv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679878839, "uuid": "af3e7cc4-5cd7-46ff-b2b3-e8b2e3056842", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679878839, "uuid": "7f4e17f8-37d4-4311-9af1-cd8c80498e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679878839, "uuid": "9df293db-abd5-4f81-a8aa-982ddac27dc0", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb1ed7e-ccca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679940425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940425, "uuid": "071f3086-0869-4fa3-8560-f35ab4680c2e", "comment": "Malware payload", "value": "8ee82932641f3f527110b0f8ce6b11ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940425, "uuid": "005f4e05-6312-42df-8a7c-b507a6cd1f4c", "comment": "Malware payload", "value": "e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940425, "uuid": "40cf15e2-b2f5-43a3-b6d2-2ff00f74abb2", "comment": "Malware payload", "value": "fef4e9bc0d20f52423e02ec0bc6a52ea36af97a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940425, "uuid": "014fc168-402d-4087-a3c4-eb65936e823b", "comment": "Malware payload", "value": "3d9a81622129d2ad2e4454dedb168429d9110d9b53ce7769f8648a14be8a459defc68bcc6b2ab35f134be52461732cf4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940425, "uuid": "b57087ba-2aec-48e7-b0d9-91b1ef9dbd3f", "value": "T1B8E3BE0C33958037E6A20DB44CA37BA2A96BB8776970505B3D5431781AF4EC07D79BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940425, "uuid": "c803b3c3-7e6a-4dcb-a426-f4750fa8c14f", "value": "e2923526c1025bf81115648776bcac8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940425, "uuid": "535c12b5-cf0d-4091-a7a4-4bd246814bc5", "value": "3072:tjQgjwASUryVehsZnsTQqLSA/thZhUzcB4r50W23HnBB:R9iV3nspZ/t/6KWmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940425, "uuid": "064d7c88-a9b2-47b5-a0db-4d4cc487debd", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940425, "uuid": "ffb0d1ee-6985-43d7-888a-4063bd35de2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940425, "uuid": "3f718e4e-2074-4760-a23e-3ac36c75ce4a", "value": "bacon_2018-04-13_22-27.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f090496-cccb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679940936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940936, "uuid": "a3300f61-8f96-4359-a19d-03b33235f6d3", "comment": "Malware payload (Rhadamanthys)", "value": "49cd88e363a5f738cbbd54d592512330", "object_relation": "md5", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940936, "uuid": "3ab8e12a-b236-4094-a074-c40908c8c572", "comment": "Malware payload (Rhadamanthys)", "value": "e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d", "object_relation": "sha256", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940936, "uuid": "87c75198-0f95-4ca1-b803-553866d335fc", "comment": "Malware payload (Rhadamanthys)", "value": "f37c06f3f2f9e57a47a1715ad868b08e8266c28a", "object_relation": "sha1", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940936, "uuid": "c91347ca-ece8-4869-b53b-681af24a8ba9", "comment": "Malware payload (Rhadamanthys)", "value": "35515eb7d87dea97112219bc66e77e3bd91976e16637c11bc4f2f3e26f758336a5366d3a45ae96e1de0475af40fad921", "object_relation": "sha3-384", "Tag": [ { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940936, "uuid": "c7941b86-494d-429a-8ead-687fcfb7d1b2", "value": "T16344DF1272E1C433E96602B94925CBB59E3ABC704715C6EF3B445A3E1E213E2DF3635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940936, "uuid": "47b1e8da-727e-471c-9059-470d61f608b5", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940936, "uuid": "ab416b1a-976b-49d9-b22e-1fc8e7e07812", "value": "3072:9F48sKF1adV2dk5LySNCA/N/fJAsZSsUzD/qC+1VSPJBfZNWa+84Dj5qsyLCU3wZ:jzsrVOk5LlNF/1fJpUDqC+IJxHtTsym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940936, "uuid": "9ef08bef-43f9-4cdb-bc96-e9633b31d8f2", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940936, "uuid": "65a335ea-b244-4f49-9fa7-5d0fca27e805", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940936, "uuid": "88dbc55b-ec8a-488c-afdc-9004effd879a", "value": "e9cdefece19e843004c7f3db7eb8fe6408ee5ae9760e82906c762a12e124516d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22db976b-cc3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679879417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879417, "uuid": "7eb046b6-abee-4fa7-b136-2c3f0912aac2", "comment": "Malware payload (Smoke Loader)", "value": "72f8d289fba464c2202292f0013ec032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879417, "uuid": "3fbb8dd6-3073-4423-ad1e-62558358d6f8", "comment": "Malware payload (Smoke Loader)", "value": "eb2a81873467dd77ad98de250ee4de97a681051b8fdf1d9b3e1108777fe20f02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879417, "uuid": "b5d2c8f1-b9fb-4f04-801a-97e32896bc7c", "comment": "Malware payload (Smoke Loader)", "value": "1bd02e687888e43e1e652b831dfb27786797ff7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879417, "uuid": "34d68276-3761-4c22-a766-7346a7fd8c3d", "comment": "Malware payload (Smoke Loader)", "value": "e4e379ac8d12c48f0c73dff2ad0b977ac3e2061577b4894d0c2e8aecf815723200f50b009ccaa62e60fcbd8bf0759666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879417, "uuid": "af85b3ad-309c-46e4-980f-0173b26609f0", "value": "T18F546B3293F06C60E562D7328E2BC6FC2A1FB9219E556BBE12595A7F09702B1C173335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879417, "uuid": "dbf4659b-8e8f-4dd0-a686-2c432adf71aa", "value": "c5c75c5b6a7ab4fe20f346e6d5121c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879417, "uuid": "01192687-9197-4436-888f-d3a0579b09dd", "value": "3072:O3YPCOt43uLvsLuxVu6FCbZsEQGrvzpWUSBfJHpJfa1yP5g/gpNN4TJY:Jguv2uxUQUwfJJJf6/ONN4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879417, "uuid": "1e6cacdf-5b85-4609-b58e-6b255e82c12f", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879417, "uuid": "526bdaeb-fea3-4cb4-a19f-8cc007b1560c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879417, "uuid": "a790455d-7c23-4c47-9700-4bfc6b6a3cfb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f767462d-cce3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679951499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951499, "uuid": "48d0b841-e6c4-4233-925f-2d1f5f832b42", "comment": "Malware payload (Mirai)", "value": "01ea58eb06b95b0d41ca14c85e15ca0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951499, "uuid": "d853af85-336e-45bd-82e5-c6ccec0039af", "comment": "Malware payload (Mirai)", "value": "ec05cc8d17d939515dbc63253e912ebfb6e5fc459d8609d970726fa28751a9a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951499, "uuid": "78a7841f-0d93-4c4b-9f46-8f0e171c6df0", "comment": "Malware payload (Mirai)", "value": "d8bfff840e84b1cfb7da3c5d9489eba055d91c82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679951499, "uuid": "329f64ac-a1f3-4af5-8cdd-a26169122f91", "comment": "Malware payload (Mirai)", "value": "9e4466bfc70aa2b0ea27034627ea0423fba98d99234e25141fdfecd6aa6535202e3e7545fad316eb3b3c3bc5349bb50f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951499, "uuid": "8d48f2b9-2cbd-44a3-92e2-99f270da9354", "value": "T1DAE2E12013563982C630D4B8BABDEE8915A6462296FF346304F54E329D53FDBE2EC5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951499, "uuid": "b6abb8d9-9908-4766-be5d-518f87cd2f02", "value": "768:CvD6vwaec12cTojCCEPkX1nmCmix37I8eWwrvHU2sLpi9n9q3UEL5mj/:TvNDfU+CE0miJvl0ALW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679951499, "uuid": "5781d69d-5980-47d0-b8ff-10c34757542d", "value": 32956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679951499, "uuid": "f099ba0d-f024-4803-b2c1-b3f7bd059ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679951499, "uuid": "db8bb67c-4c25-446f-9e4b-40ae533e9c2a", "value": "01ea58eb06b95b0d41ca14c85e15ca0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec369615-cce1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679950622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950622, "uuid": "21810373-1f17-40df-985a-a026b6ecc62f", "comment": "Malware payload (Mirai)", "value": "60d4585731b70039928ef1855b59a63c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950622, "uuid": "daeacd1a-4fe3-49b9-b8eb-3fc1f90624fa", "comment": "Malware payload (Mirai)", "value": "ec92133c328453008075f49b1545b49b1e33059c93d271be8b8b7e23894743a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950622, "uuid": "71de08db-1218-40a5-bca8-771402fc036d", "comment": "Malware payload (Mirai)", "value": "94312d9bdf6ae08dac84a48c389a42ff1e723b4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679950622, "uuid": "639593e7-8991-40cf-ae43-b7b999fab04c", "comment": "Malware payload (Mirai)", "value": "e2cc363cd04b85bb6492846ba75f1106425c110a02e3408cf5decf42815a804f550aff54e06df67dfaf02360b958e5b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950622, "uuid": "a9602213-5862-45b3-9069-10d804b909d4", "value": "T159C2E1ECF37A077FF8523130259DCDBB827ED866D71C11998688B80A6B5B138096B437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950622, "uuid": "2223e4c5-f401-4e3f-a5a2-41b1cd315f47", "value": "384:MD4/DspditzTavDetlvIrRsjukIdIQ5gv0t+qH98r0xovT+a73TguDL8m7mROt30:7LsitiKtuRcGI48EtaDHwJOgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679950622, "uuid": "6d4d098f-b040-4509-a8cb-ac9c84ba9a03", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679950622, "uuid": "b1e26ad3-008e-42ae-ad44-4f6a67bd17b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679950622, "uuid": "2c37f94a-d14b-4181-be72-0698089f68c1", "value": "60d4585731b70039928ef1855b59a63c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7a4779-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1679913284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913284, "uuid": "235d7ffb-32c6-476a-8bd1-0ba26419a63c", "comment": "Malware payload (Nitol)", "value": "894cabf40598fc7cd2fd2ece717644b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913284, "uuid": "0469f5da-114f-42d7-9cc6-e676e6074f72", "comment": "Malware payload (Nitol)", "value": "ed26e16e74e691c68bf57a22086dc936c24022740718ebc93c794236b7affba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913284, "uuid": "d891b968-eac2-411e-8352-f582d08fd9d4", "comment": "Malware payload (Nitol)", "value": "f8ffc78e53a969bf35b715658a4478ff75d71c6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913284, "uuid": "1d2588a6-823b-4622-88e1-aa4a012690b4", "comment": "Malware payload (Nitol)", "value": "8f878d8af1fcee0dbde87af44f022a683eb1a0af530063adb115711494d5713ffd03e5c6a8d1a716e99d97c1705c44fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913284, "uuid": "6ead338f-1ca7-4933-9708-8e88ca4e900a", "value": "T1E11522424BB75B50E7E20EB6096991463DB4F821AD554B31C2E0FA1ABC72FC0BC3196B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913284, "uuid": "77a67c92-beef-47cb-b29e-850dccfad1f1", "value": "8f7c8aa291bb0443289869d3cd046569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913284, "uuid": "ffe9915a-c712-4baf-ae0d-d8dd23c22efe", "value": "12288:agfLDRq1mDO/YpHn5oOJTYYv4n4fuSVF+R47bJwO8s4rUiBoGP0NBsybssHhlvVM:Z5frNFJTVvjfuS3hXR8f1vyIsHhSdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913284, "uuid": "1a73c4db-5b49-4299-9ec1-56499772aa0c", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913284, "uuid": "2aa176b2-ffdc-4f28-a535-b664d4ecf869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913284, "uuid": "ff4c4c5d-035d-4c33-98c4-63e2db841105", "value": "894cabf40598fc7cd2fd2ece717644b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3becf8-cc34-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679876158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876158, "uuid": "41dfdd31-775f-4446-8020-b5fff3da8de4", "comment": "Malware payload (njrat)", "value": "a95001e31746034a0b4eed22c681c97d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876158, "uuid": "1f78bca4-d6b7-4379-82df-30fc5c9f5d39", "comment": "Malware payload (njrat)", "value": "ed87ee556f8f1294bb9b0db913f794b8687c7331ed29efe99f31291ec3651500", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876158, "uuid": "3431e95a-fcd6-4fea-8131-7a4153327cd8", "comment": "Malware payload (njrat)", "value": "4f9adfadf1ab3bf172b8d08f5553d9af032b957b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679876158, "uuid": "8e71a6af-32c3-4e47-b9de-77423c93bc7c", "comment": "Malware payload (njrat)", "value": "73691e11e20a454d1e497ba93af1fca6c8831a3878b99b744a50c3cc4a652ff3cf961b7ad8c3986566d483dd6a9e02b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876158, "uuid": "fbf4abdc-c59d-46ce-afa9-830a134aabbb", "value": "T1BBB4BF239F84D472E26028F852B1DA9E5575BD200F298A47E7FA7C7DE73C3817929207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876158, "uuid": "e8452a06-2d09-4f3f-b37a-033b322e8464", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876158, "uuid": "cac938eb-e36b-4c2e-839b-6261257e124a", "value": "6144:g8JsLcpjzTDDmHayakLkrb4NSarQWrCIoLAYLFeVVmkjTwiDZrwhjaiT0CXel0t9:tzxzTDWikLSb4NS7apTXdCXeyd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679876158, "uuid": "746839c4-6503-4059-9260-840f7c4fa281", "value": 539276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679876158, "uuid": "1953dae0-0f14-4b56-80ee-cf7c8e1bb056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679876158, "uuid": "64197262-8ad8-4bc3-b323-341fe21d9806", "value": "a95001e31746034a0b4eed22c681c97d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5a3582-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894896, "uuid": "871587fe-9feb-4af7-93e1-d30522403494", "comment": "Malware payload (AgentTesla)", "value": "4a650b7b95c38fc8f562e58fa1ca7c44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894896, "uuid": "721cd184-bbe8-40e5-b08d-24a0efc30061", "comment": "Malware payload (AgentTesla)", "value": "ee45e5f9139a9847a69ef74bae50bea593d4634ca770de055fa734248375cdd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894896, "uuid": "515f5774-7d32-441a-8886-9e55de452773", "comment": "Malware payload (AgentTesla)", "value": "28c169574ec40cd6000cdad25ceb61eacd38d0a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894896, "uuid": "6a286ffc-5a81-461d-a957-87105481addb", "comment": "Malware payload (AgentTesla)", "value": "3590a2c6a620d376403e39992cd0d9ba3ef4359ad0b9564bd4967974bf020e3d208c0fdd81b7b9937d4b478b3531802b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894896, "uuid": "5d0f4a13-5ac6-4b8f-878b-ee96a0bc1472", "value": "T1E034127463D0C433D8F317B25E7D2A7A26AA68031958468E37241E593E733879E4FBB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894896, "uuid": "25cf47a8-ca8d-4aa0-b980-1b6deca00c5a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894896, "uuid": "fa08b9ed-c3cc-40f7-a7fa-023baebb555d", "value": "6144:vYa6377SIh9UL0WDatqI6CYib6uTFuZGP6f:vYNaIXU4WOgI6CYibnG8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894896, "uuid": "f929721e-dc9a-44f0-bf83-6bc594329ab5", "value": 237158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894896, "uuid": "ce731e58-774c-4589-8faa-aea2c206f181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894896, "uuid": "53663191-8c4f-4978-8665-32f99a33ec68", "value": "balance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d784683-cc70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679901849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901849, "uuid": "ab4449c5-823f-41a4-b8a6-bd02201f365b", "comment": "Malware payload (Mirai)", "value": "69e03cc330fa8497f0bb847cdc77168d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901849, "uuid": "62c93656-4607-401c-8d5f-a85666dcfca1", "comment": "Malware payload (Mirai)", "value": "ef0e3649fe05746d8e5fd12598f777acb2c34f3173a6d07a49a1a004f590a010", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901849, "uuid": "1da4b656-fdb9-4dd3-814e-575e1dafdd72", "comment": "Malware payload (Mirai)", "value": "a0f1a44667851e22eea1112802a3a942a7636ecb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679901849, "uuid": "f7ff8377-118a-4b8a-a719-69c4de242b07", "comment": "Malware payload (Mirai)", "value": "c5a82097be7c9010b8a1e8c1acfbff7ec4f57aca8b28cd3cc823c713a01e955d46e33252c6dc2a7ffb8cb430b00f2e6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901849, "uuid": "b8c5e6dc-257a-45e6-8824-6f022df04115", "value": "T11E632851BC819A13C6D1127BFA6E028D3B2623E8E3DF73179D225F2037C696B0D27A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901849, "uuid": "ca4cad42-bead-4c12-8720-4bbd5f112958", "value": "1536:iNSlxAmiik110lOO//kWIj7ZisI3AA8PNRu5AvbWF:iN/CbkZvZisI3/+Vbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679901849, "uuid": "2c88ed78-3690-4522-b713-0bb97f67410c", "value": 66916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679901849, "uuid": "9e880c02-8a35-4744-8fa1-0a98f8fe02ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679901849, "uuid": "310e6ec2-ff87-4f82-8790-ae9824430360", "value": "69e03cc330fa8497f0bb847cdc77168d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cefec2e-ccec-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679955025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955025, "uuid": "f1253a5a-f82e-4ef9-a134-6f462a15f271", "comment": "Malware payload (RedLineStealer)", "value": "de1eea25820f29bb1577de6c94741223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955025, "uuid": "693cc9c8-5f53-4be9-9cd6-c9a5d4daea06", "comment": "Malware payload (RedLineStealer)", "value": "efe0d4a3c991303083fd4ba828c9f898bdcb12a0d76b98b2193ade32c2f329af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955025, "uuid": "470697c5-869d-465b-a359-3f3fe26bf902", "comment": "Malware payload (RedLineStealer)", "value": "b111f79864ebdfd08a4f46798572eaabeb463d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679955025, "uuid": "a6f4a871-95f3-4fcd-afe3-0306f208bb6f", "comment": "Malware payload (RedLineStealer)", "value": "b5cca2f100b395f64d1c0b71ee611690efd91d22c2c05a33b027d6ca54958bce7cda61af019e2bf22e4d9023d8404771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955025, "uuid": "3c1cfd3c-b217-4515-bbdf-23eff857abf0", "value": "T13BE41247BAE84433DCB41B710CF613830A3BBCA15D7983AB2B45A51B4C726D2B47676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955025, "uuid": "1f8e3c90-8964-43ad-b529-cf25f36d386e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955025, "uuid": "c6f27cb3-d8aa-45a1-9c07-b8bcd834da81", "value": "12288:gMrby900qvhf41tO6hFwMf9DSrcAL8F38pOmEPWUBgjquP4XbKRbkxdqaABpH:ryqf41k6hn+L8VAsDg+uP4XbKlidqxBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679955025, "uuid": "f9959c40-cb62-4d27-959d-1f161c1738ac", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679955025, "uuid": "709a4196-b37f-4f37-9c27-69335b083621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679955025, "uuid": "f4abf120-4b5d-4fe5-bd75-75ac314379ce", "value": "de1eea25820f29bb1577de6c94741223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9866da-cceb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1679954726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954726, "uuid": "8250193d-3ddb-462d-9f16-8d89398f465c", "comment": "Malware payload (Pony)", "value": "a012ea7953293c568c474301838e653c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954726, "uuid": "c4a87104-944e-4ccd-898a-dac04626dc0f", "comment": "Malware payload (Pony)", "value": "f078ff57bfb8da5ccb26d1c77bffc97b4ce67f2eae7fb22d5a544ce8a28c8aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954726, "uuid": "145f60ba-f50a-4c98-973b-62aa363b293e", "comment": "Malware payload (Pony)", "value": "ffecf15fceb89c31b387e712155e582ec6ebf721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679954726, "uuid": "8d48b836-45a1-4fb6-b7e3-2ee18897d019", "comment": "Malware payload (Pony)", "value": "7e637f630b0e4662824e742b487872a2b91edf199f74b7f93f0e9ce110689f1ce113de911a745d2d1bc165e25e22d8bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954726, "uuid": "f652062b-e9d5-4474-a0e9-2c2516b32a76", "value": "T15E949D58739C6E02D1BE06B595F613A80730FC1BDA9AD70E78846AFE2CB13DA414275F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954726, "uuid": "19504c9b-d458-4882-bd31-5c71a2474051", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954726, "uuid": "5dcc874a-827b-4530-b2f7-ec5180a46457", "value": "6144:R0+VNlPdwzTzgnDbVeMMEI408lMRcH9QZpYcwIe9DkL3pR:qm3azXcMEI4FlMudQZsDU3pR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679954726, "uuid": "d92b844e-e27b-4719-8888-45985f59bb78", "value": 411464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679954726, "uuid": "5ea1bd47-74d4-4313-95ce-47118a9e06b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679954726, "uuid": "2bd10226-84cd-41d3-a66c-d1a55e4fb09e", "value": "a012ea7953293c568c474301838e653c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f73fe8-cc67-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679898030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898030, "uuid": "dd804466-b583-4dbe-9987-a4bdca5193a7", "comment": "Malware payload (RedLineStealer)", "value": "aca7c5393dbf4ea98de959b461b8f87a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898030, "uuid": "afcebb7c-7e18-450a-af99-c85c8c670a09", "comment": "Malware payload (RedLineStealer)", "value": "f2b95db9dece11e69268474e58eea71f5a9776bb6c482f3d7f5e612cf0031b78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898030, "uuid": "5e7a8ee7-8a64-4618-b328-b41718ae52b8", "comment": "Malware payload (RedLineStealer)", "value": "057a4ba71f605b67057427d546e43ed2f5118eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679898030, "uuid": "9f396c78-294e-424e-ba6d-3819da110327", "comment": "Malware payload (RedLineStealer)", "value": "cbb1d5e14941121a753d0fc0cf144eae9f23575ac8bbaeb5367838668dc50882561eaf722ba30db9c73060604cf27105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898030, "uuid": "3ea1be88-064e-4fd2-998c-4238ff608db6", "value": "T124E41211BAC88436DCB92BB158F313D70B35BCA54974936B2781AD5E1CB2EC0E836776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898030, "uuid": "0de511f3-45b3-46de-8612-e7293fe6e02e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898030, "uuid": "805b1e32-78b2-4077-b6ae-854b7dfb29bc", "value": "12288:gMrGy90wpc0XV/lbUAvb4YJVPHLgeGT0cO4gIq1AfS6PztL1WA6Ak:2yFF/yAz4YJVPSTk4gxyqYztL1WA6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679898030, "uuid": "04b1722d-0d3d-49c9-a4c4-2343b7e06470", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679898030, "uuid": "ea936a73-369f-445f-8cb4-47cb50080cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679898030, "uuid": "fee9126e-58fe-43ed-8e14-0ed7a1d556e6", "value": "aca7c5393dbf4ea98de959b461b8f87a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e371ccd4-cc8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679913241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913241, "uuid": "19510201-148a-466f-a981-0c2604e0878b", "comment": "Malware payload (Smoke Loader)", "value": "55ff284619ebfcbc5ec3d780d6b63da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913241, "uuid": "6fcb719f-5ccd-4f9e-ad7b-a7300838b202", "comment": "Malware payload (Smoke Loader)", "value": "f39dff118d357bd5d8ee143137933ce306331c002ba0162546c280234d4eed95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913241, "uuid": "67f252b2-cf53-4966-8ae5-b209af279c4d", "comment": "Malware payload (Smoke Loader)", "value": "d14274888f4918bc74e5c26d31d46894920214e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913241, "uuid": "48e0843c-7701-43c1-908f-f8a148a1fc22", "comment": "Malware payload (Smoke Loader)", "value": "4873b807bfa3f855c5326fa98bec464f8e7216028d80cc62dd102b514c75587a5a6e9f1b7f700843eb6561d2009e0c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913241, "uuid": "b18b5d1c-dee1-4719-9395-5d66d5d5e173", "value": "T1C9448D1AA3F46870E5734732BE1EC7F42A1FF8615D177B5E2648AA3F09706A1DE62700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913241, "uuid": "bc14bc97-020a-40c1-aa42-a156a2463441", "value": "e995a4cf6af4dc2215ec1060df8374d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913241, "uuid": "fc8968ec-3c29-404a-83c5-a785c560ced5", "value": "3072:JXhLFwA+dFGqxDHd+Dq+v06BTuFPjZtEP2bMrzBtN1YwWNmOSpn6Pan78F:xwnYqxD9+DnuFrMptNSvNZEn6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913241, "uuid": "31209b97-f3b5-4a08-824b-252ac57dac9e", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913241, "uuid": "5eeefd19-e591-48af-81d5-d4f5dc9c013b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913241, "uuid": "0663536a-3d8c-4773-b85d-1db571927219", "value": "55ff284619ebfcbc5ec3d780d6b63da2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fbeeb9-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894911, "uuid": "1e6282f4-e0e7-4ae6-8d38-b676dae8b408", "comment": "Malware payload (Formbook)", "value": "73a18d1698b2f97ac50770986326e2e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894911, "uuid": "b1ab8de6-b42c-4b55-98c8-e0811d65c2b2", "comment": "Malware payload (Formbook)", "value": "f3bc0aabd3ffd26912977ae43d90b5ee187da63436b4395489f75a13012e7dda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894911, "uuid": "b2484dcb-8cef-4303-a074-2b8a37983842", "comment": "Malware payload (Formbook)", "value": "4dff3f670c0e3d35f6e1b492221452ce379d12c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894911, "uuid": "44e8829d-dc23-4425-be60-13f0c36d3e06", "comment": "Malware payload (Formbook)", "value": "f73dd285465d97b1a70c60b446a1a8ac461ac40457cb9dbd9963c61113f046266ff6ae13600721aebad1040b87e7b521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894911, "uuid": "fb502cb8-e64b-441b-b91b-adb8bbe1070a", "value": "T1EB04AE36DA42C071F2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894911, "uuid": "13e2d838-845e-4a1e-852c-6a76a35fa0b6", "value": "3072:obX4kQvFJdO43t/c5scFV6hP/zSJRVUweMoeks3jG1ZlRRR:vU2tk5B6hP/MV9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894911, "uuid": "20e639be-255f-4530-ac73-b939d4018bfc", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894911, "uuid": "b2d4f9b7-a881-43c0-a30f-0325370d91ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894911, "uuid": "57250812-8320-4077-b033-236d54ddd986", "value": "f3bc0aabd3ffd26912977ae43d90b5ee187da63436b4395489f75a13012e7dda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1596ac7c-cc4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1679887555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887555, "uuid": "02be5dd9-5030-4500-8065-48278e2abdac", "comment": "Malware payload (LockBit)", "value": "af9ff037caca1f316e7d05db86dbd882", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887555, "uuid": "00ecfb72-3c4c-4861-97d7-8f22ea4845d7", "comment": "Malware payload (LockBit)", "value": "f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887555, "uuid": "f25150e4-f2b0-4698-aa1a-896c0dfd256b", "comment": "Malware payload (LockBit)", "value": "844e9b219aaecb26de4994a259f822500fb75ae1", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679887555, "uuid": "de0f9653-8019-40ab-ae10-ed993c403e69", "comment": "Malware payload (LockBit)", "value": "98f047718f1e20d443fb3e5f4d3a945a314d60777fd3d1131159bf5b126da2072c44b1106a44dd58d7a5c46d612f578f", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887555, "uuid": "48b8da99-f33d-49cd-8098-2dc9a5ef2d8d", "value": "T16F155D1997028F56CC13207691FD9DB3A8760730937F0CE66BC466DC82E2FE9636A356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887555, "uuid": "a7cafa19-84d8-418a-9d47-d5cbd74ce6f4", "value": "24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q1F:dAfSrWW4g+7Ht+UmxJeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679887555, "uuid": "c108c5ba-80a5-43cc-acfb-d981ad6b13d6", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679887555, "uuid": "a27e9b7d-0fa8-48b4-b523-524a4d277f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679887555, "uuid": "c277f961-ca88-4850-a463-eef84e6a7d4d", "value": "VirusShare_af9ff037caca1f316e7d05db86dbd882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd99d87-cc97-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679918489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679918489, "uuid": "05c61c26-0f34-4856-91f0-0c3f27e23534", "comment": "Malware payload (njrat)", "value": "469135b3bb637a5e43a6dea563cb4312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679918489, "uuid": "55a8f43a-060b-48a9-93e4-d6a1c05b1d77", "comment": "Malware payload (njrat)", "value": "f4145e8894212b1afc5362ee2417d5b7b0882179ae79dd09e73eb8e1a527865c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679918489, "uuid": "9fdd526d-4d42-4d95-b6de-544a2904cadf", "comment": "Malware payload (njrat)", "value": "6ddeb77b150eb449ddf1195d22d17693049bae85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679918489, "uuid": "10a54721-2102-4dc5-9a8c-8934d4dcbdfa", "comment": "Malware payload (njrat)", "value": "4f45ac119cfbca75ebe98c95ab32f209e272d73fabe98ce51c9f50c14298f0abd39e6f4c1d59c074ab41e51c9ec4fa8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679918489, "uuid": "bf9e2999-c50d-46d9-8721-d25fcacbbc40", "value": "T1B1F2295D3F918172C2EF2B7046A2DB2142F2D1075A17EB5F4CC884FA6B773D04A81AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679918489, "uuid": "ac947e77-9459-4389-97b1-88c87418cd23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679918489, "uuid": "ef7d37e1-57e2-4079-978a-3c19df36f933", "value": "384:5LdClEUdi/dMkt1QsYeX75xeP1Y2OzRLTm3yilqr6uTeivGE:JUEUdi/dMc19v7TetsNZvGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679918489, "uuid": "94383067-23dd-4820-b3e9-35cfc1b8f95a", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679918489, "uuid": "b7d26efd-c7eb-4fb2-b7f8-67757fa192fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679918489, "uuid": "6fa42f06-29b1-4413-9554-23468b700cf0", "value": "bKJ8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b2b769-cc82-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679909510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909510, "uuid": "168d6aea-d2f9-4704-895b-a09f52138102", "comment": "Malware payload (AgentTesla)", "value": "7d9216d1682b03cbc334625141e2a512", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909510, "uuid": "2563c3fd-a0c1-479d-95df-0562437f8bd5", "comment": "Malware payload (AgentTesla)", "value": "f4e535a66881a91014aa12b837175eb110849a0d387a925444576387aafd633b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909510, "uuid": "4f566468-80a4-470d-a1d3-69be22872cc4", "comment": "Malware payload (AgentTesla)", "value": "b516d984e819dc86eb94e96560f7999d01d0f8b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679909510, "uuid": "0b3bcc6a-78be-46da-a41f-32d525ba85f7", "comment": "Malware payload (AgentTesla)", "value": "9ff265eb738d0371dfa1874268da106d05c805f63965ce37590ea60b3248765b70b09b41d44a21eac5ab37c0432221cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909510, "uuid": "62985040-7d40-40b3-ae44-c8c52a04cafc", "value": "T1E805126BE760E715C7B582F412D08584C6BC68E62B96FE081D9C34CB02FBB905E57E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909510, "uuid": "b8099891-3be5-422e-b15e-05c0a320b370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909510, "uuid": "8d6249fb-eefb-4170-bbe1-a7089a5e782f", "value": "12288:PUJB0O6JhZGsIpdg6AkkUNtzwjwnIGE22JbZRQRiB0iZnsn0p:ECDKs6AkkqRw8IhZR8isn0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679909510, "uuid": "3c83f75a-fc95-49df-b2f8-8d18862c1711", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679909510, "uuid": "19113bc1-ae56-4eff-91f4-c35b71fae2c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679909510, "uuid": "e8b3c1e6-2611-4f7e-9004-f92f2761eda9", "value": "ORDER 0393U.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc96782-cc86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679911543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911543, "uuid": "5c1f5d53-a782-49e8-8473-c34f23ff2e33", "comment": "Malware payload (RedLineStealer)", "value": "716c49fac01b83bb33c4ecb02e0f3ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911543, "uuid": "c1c2178e-38f1-445f-84df-0f7b3f982848", "comment": "Malware payload (RedLineStealer)", "value": "f55736ed3624c6f49eccf9c7048709b794b527c364026318e02294e1fab21826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911543, "uuid": "8b6886bf-d557-4e73-83a1-440eed0ded64", "comment": "Malware payload (RedLineStealer)", "value": "b468dd27655dd509e47bced734f43a702c602ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679911543, "uuid": "a5495ec0-5eac-48a5-af41-6f2bed3fa915", "comment": "Malware payload (RedLineStealer)", "value": "b6a4dcd2f3565240016181690bb7b093e723fb5be6a9fee25d4cc6e158dc30678547ea47e0128562220dfb13d4e71ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911543, "uuid": "2c39bf9a-dd7c-4865-8ae3-dfbb2b4198cf", "value": "T12564F1A177D0D072D95684756821CAF47E7EBC309AB5858B73983F6B2E703C1A727322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911543, "uuid": "2a85e87a-fe5a-435c-96f9-420c7b30086a", "value": "b4caf46136c63a95a01f90b173e613db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911543, "uuid": "6974a804-f4f2-4260-b234-112f449f180c", "value": "6144:Zqecw8LQ7R5ckc5c2gU1U0hXBiVlRFdMa7qVnE+iMIDX:Zow8E7RKc2jm0xIPLdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679911543, "uuid": "0c66eb9f-b8e8-4f88-b93f-650ad9bfa191", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679911543, "uuid": "cdd56756-e563-49d6-8b65-1385b710167e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679911543, "uuid": "0b8bab18-8e9a-4a32-bb01-e2ea4cba1699", "value": "f55736ed3624c6f49eccf9c7048709b794b527c364026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a256193-cc9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679920714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920714, "uuid": "f9920063-c086-427f-8c82-b3a0c06cce1b", "comment": "Malware payload (Amadey)", "value": "fde26eb8c09066b3c490e1350906e941", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920714, "uuid": "6c9e68de-0eff-4a37-9e0d-576c22ba87e2", "comment": "Malware payload (Amadey)", "value": "f56c5a8b0f93cb5ee3f14e5fdab4466999a3c305bd0f3ee4384d57e38e868a16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920714, "uuid": "9c76ce13-effa-4dc6-8137-e446ae88f6a8", "comment": "Malware payload (Amadey)", "value": "be0954dc552656cf0d8845ed94eb35f473e43b59", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679920714, "uuid": "d8f335c7-3cb9-4a12-a44b-7f7f4c0cbcff", "comment": "Malware payload (Amadey)", "value": "38897fb21be035aa129e6e422fef445ca654b2389aa889c351ecc158b6b45edd07edc0b8c1fa859a564f1caced7ef4e3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920714, "uuid": "d2a99b9f-706c-49d1-bbbc-dd43c981f09f", "value": "T19444CF227291C872D99644348826C7B86AFFBC709B5546C737942B3E7D313D2AE3A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920714, "uuid": "c8b0f60d-6e90-4ad4-adf8-c0ebf5c0dd8f", "value": "d74655147abdbbd28f9cbdc19367e2ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920714, "uuid": "d78a53e8-b1e1-4dd1-bb08-82435641c9a7", "value": "3072:p1ZOh38zlnVg6xkCLHrwZYtadGqJydBBeN9tO8b6UKgj5Wu6NXv:XZ83+gWkCLLwZGadGqJydBBeBnOv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679920714, "uuid": "e5640428-fb28-476a-a497-7c512213fde7", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679920714, "uuid": "efb805cf-76ee-4b16-9a59-8467564a007d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679920714, "uuid": "382ae492-fb2f-4e4f-8a23-70d9fa919869", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56841683-ccb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1679930614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930614, "uuid": "aa74e948-25db-425f-a406-0f77ba21e4d0", "comment": "Malware payload (Amadey)", "value": "9d29f5640c968ae41824e3999937b4ed", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930614, "uuid": "fed16ecf-28d0-417a-baaa-20dfe80684e8", "comment": "Malware payload (Amadey)", "value": "f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930614, "uuid": "8584e00d-3606-43b1-8742-b45e1b83d815", "comment": "Malware payload (Amadey)", "value": "31560a3776918e01b6cd2e9d87fbf2ad1028ec7f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679930614, "uuid": "6a90ae9f-498d-440f-9f7b-5e89efadac28", "comment": "Malware payload (Amadey)", "value": "115992813e3a8a22bbf23c42a8bee360c7a01e10928400029cd105ac8a3a6b19143adca6d431589b6cf02981a4bb3d94", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930614, "uuid": "ecaece30-a3be-4dd7-b642-cd8f4188077a", "value": "T1C744DF2272DDC832E55B01744615CBB46A3EB8339B6586DB378406BE4E317E2DF3A316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930614, "uuid": "a7789186-a807-480a-b775-ed77960aba53", "value": "2f460961725ca1bacd7af1f08dcd53a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930614, "uuid": "2b688d10-ad6c-4c8c-b3ef-2e9e65d5371b", "value": "6144:Ci3VWOkGLWA36gvapL8sl40HzdYl7qSGM6g:bkOkGKAqgvapL20TI7qS1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679930614, "uuid": "21a999f4-96bb-41b3-88e2-9de4393fc675", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679930614, "uuid": "779ba06c-2f6c-48e2-81aa-9d4f1fb1cff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679930614, "uuid": "122d397d-66c6-438e-b069-ae9a3dd23b29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2df52f-cc74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679903431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903431, "uuid": "9bcb8ada-db94-41aa-98e2-9bcd30413704", "comment": "Malware payload (RedLineStealer)", "value": "cbd84c741e7ca361645c1542ea5c7131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903431, "uuid": "4dee2742-f141-42e0-a8b2-c69b927f4e8d", "comment": "Malware payload (RedLineStealer)", "value": "f5b3c296484c5e8aaf165b36f62f5bca75acd3c452603fb262ff334c8a65d390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903431, "uuid": "890a2f02-fe87-4c63-9019-af5590d4c018", "comment": "Malware payload (RedLineStealer)", "value": "d8c2438061d125824b228f68bd3406c8317b321a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679903431, "uuid": "568e268f-82cc-4fcf-8523-2cccc721eb79", "comment": "Malware payload (RedLineStealer)", "value": "8221f593f3becdf2f3da3c043ffaddb96c628703839001caefe4aaba71f33d74c2959f76d37acb4f0abbbf26a5ccf78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903431, "uuid": "ba66ecd2-fbb6-4dc9-a88f-099671ccee59", "value": "T1D1E412617D91C0F2D59F803C4925CAB06D7B7CB19739468B32A827AF1F343D0AA3576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903431, "uuid": "03094764-4edd-4d27-bdf9-e110b20b3ae1", "value": "b4caf46136c63a95a01f90b173e613db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903431, "uuid": "316ba3b7-4e66-439a-bb66-a4be91423193", "value": "12288:TZJAbAI7qpMP9chlQDrgyhSuEu3OXN/BPoqtEypPxUwyZkDiRpj6pz:tcADS9cHQPDhkzdhoqWypeZkap4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679903431, "uuid": "93a506c3-2ff2-4d73-bf65-cdf17899a533", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679903431, "uuid": "0b538ae6-c4bf-43d0-a7a5-37e0647825b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679903431, "uuid": "f623f3b3-fc01-48c6-8ab3-cc6c253ff8cc", "value": "cbd84c741e7ca361645c1542ea5c7131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b4d0f0-cc63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stealc)", "timestamp": 1679896258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679896258, "uuid": "6e1cbaf1-a863-411c-991d-937d6cafd061", "comment": "Malware payload (Stealc)", "value": "8af3ec4b29900ba45e8396e75723910d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679896258, "uuid": "41be1ea1-ecc9-4a46-b56b-18b89694e972", "comment": "Malware payload (Stealc)", "value": "f639530345c52597fc8d4f6ccc98b71f03088a0c330a7df97cf4e3099da918b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679896258, "uuid": "76a5303b-e9bd-417a-bb2c-897838383c0c", "comment": "Malware payload (Stealc)", "value": "b9e2b80ceac51ac75121605deaa43777dad688f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679896258, "uuid": "09b9aac4-a6f3-4215-a613-ed3b4d8958a7", "comment": "Malware payload (Stealc)", "value": "80e3333fe1ae4aadf18d022577e07c3bb795c5cad9bfac7cbe8f2a9e71e9468610f0709f7d13f8874494e52487177c9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679896258, "uuid": "06388cb8-a0e5-463e-88e4-11f681956378", "value": "T1D944D02276C1E872D89A41394865C7F47D7ABC729B5886CB77842B3E1E303D29F3534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679896258, "uuid": "58caea0b-08de-4562-8fc2-687ddde0b069", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679896258, "uuid": "a7ec9d6a-c59a-4a55-94b4-ae0542d2a69f", "value": "3072:yT5/jenm+QDALP5ayFeBbBGpeWIQIkAB9quZcedzIQw94wf2cuQs5xbBFzwRn:yF1DALAyWbEIlki9quZc0zIQO9urNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679896258, "uuid": "93bbc970-32fc-4509-b511-fda1e5585059", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679896258, "uuid": "1f8ed0e7-7c23-487e-a1d5-76c375219943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679896258, "uuid": "301362a1-19d9-44a9-aea3-8e76817768b1", "value": "8af3ec4b29900ba45e8396e75723910d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410db2ab-cca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679924135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924135, "uuid": "199cd6ec-97e8-484a-a957-2dd49142537d", "comment": "Malware payload (RedLineStealer)", "value": "a76c5b96dc760f120ca5648ff469abd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924135, "uuid": "b59f394f-e908-43b2-9ad6-a1835974d042", "comment": "Malware payload (RedLineStealer)", "value": "f74d44fd46f445f4346eed0236faaa4b932e675b315dccffd1f4476d3559bc93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924135, "uuid": "8a9ffed7-2af4-4211-a4c0-bd180bcf2381", "comment": "Malware payload (RedLineStealer)", "value": "81242e373931fdfbcb947969d8e4bd4360654fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679924135, "uuid": "94179b7a-f5fa-44f7-9abb-ce4742427500", "comment": "Malware payload (RedLineStealer)", "value": "39e9c8beb1d74e02f472533ff1ed2f209df4d4fd38ea8fba84e3cc652501ad8bff17630b52d8493aad48534e9791e8ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924135, "uuid": "c116286d-9d86-4288-905b-6ad2fcb0f026", "value": "T11DE41313BADCD133E87527709CF603831B3ABD66597887AB13455D0A4D72A90EE31B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924135, "uuid": "943f7707-576d-40c1-9d81-604e60c43b2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924135, "uuid": "ea5d731d-f77c-48b3-8da5-7097a66b250c", "value": "12288:EMrPy90UKsnoVh888guM/AhTzPyoJ0Fukp7qHOk40a2mFG6Z0U4oX0LquNeSnDjd:7yVKbVS8RuQAhnD0Fuk5JPYe+U4TqSnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679924135, "uuid": "f246e7e4-4452-4007-8835-d2fc65a14839", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679924135, "uuid": "01893c5d-cd35-4ed5-84ec-072cfa32fa87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679924135, "uuid": "c0ed37d2-d902-4a94-ab0a-93fe418abfcc", "value": "a76c5b96dc760f120ca5648ff469abd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccba1703-cc8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679913632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913632, "uuid": "371464d3-bbbd-48e9-98ac-b6a4cda395bd", "comment": "Malware payload (RedLineStealer)", "value": "5c82bb282e09d48f8949debc0efd8603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913632, "uuid": "7dc3c531-3333-441a-b2a1-7a5e3eb1e538", "comment": "Malware payload (RedLineStealer)", "value": "f75e5636c02279031def2844cc529c9e0aa8a2c82a81f18e36c1701317d9ab4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913632, "uuid": "d9182c16-b22f-4c78-927c-6c1416f8ab92", "comment": "Malware payload (RedLineStealer)", "value": "df93d49995a1b39a8efe6ff8bd434a8ce76d2ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679913632, "uuid": "376be206-aca4-416e-bd3e-e4babc489b50", "comment": "Malware payload (RedLineStealer)", "value": "51c56e11600d41b465a517e89899aa6bf365527cd54493e5852f6692aacd095e6c2c122f178af243b9fce086b0540760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913632, "uuid": "65891cba-f726-4623-8a46-5aec944becb9", "value": "T16D252246BAF99032D5302F3058FA13930F35BDD0AC38837F5682A99E58726E59932777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913632, "uuid": "ba9c3120-057d-4648-a574-0c034b33de3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913632, "uuid": "e6a3398b-ec2d-420f-9540-d695a6634cf4", "value": "24576:QyGPzQ9nF/1FeRZkTNf3ajxMf37rS1AChD:XGrQ1prerkTNyMf3aqCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679913632, "uuid": "e9c95edd-ef95-4190-9097-404013f8b6e0", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679913632, "uuid": "9b7f852c-07fa-4eb1-8edb-f4d1e16da699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679913632, "uuid": "0fc7d589-f457-4756-857d-d2c731752a5d", "value": "5c82bb282e09d48f8949debc0efd8603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dd2046-ccdc-11ed-88f6-42010a9c006e", "comment": "Malware payload (CryptBot)", "timestamp": 1679948415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948415, "uuid": "9013c796-3d12-4ce2-953e-c4dc3597b9b7", "comment": "Malware payload (CryptBot)", "value": "6d72e0d0887eaada746fcd3e4826ae26", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948415, "uuid": "af437e8c-1fed-441b-8d29-66871f323f91", "comment": "Malware payload (CryptBot)", "value": "f84feaefe643ef0719ee089d4ba8300b2591dc9127afc38cd8824ea9bca68216", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948415, "uuid": "5092dc1e-2cb2-4e06-a950-ae502b737c38", "comment": "Malware payload (CryptBot)", "value": "0dda5cf9abfcadfed7a08f462391afe14f742dc6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679948415, "uuid": "f6f2d067-38da-483c-8738-e0eab80e4acc", "comment": "Malware payload (CryptBot)", "value": "e578df5515d2f777a3e6e0f7181185072059d4e10ff6285c4ac944b9e712149f1dd608a18611320a6266b66364c495d7", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948415, "uuid": "17640799-739c-472c-895f-29ff2697f5c1", "value": "T16956237312690149C5E1CC79C727BDE471F71B9B9F827C7975AABEC825328A1E203983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948415, "uuid": "9c791cf1-fbe2-4028-b498-0b77d80e0d18", "value": "7d59f1d82b84e111e9b6c1196cc48fca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948415, "uuid": "3c256c33-bc69-44ce-84f6-d1691e99b7f3", "value": "98304:8/xUvBHLYg9I/9IWAVDOTGwCbxdbFVApup8ex0LdWdCtoKzjmaXrHJy9oFW5nlwA:8/WBHJhKm53ALeK5WZOmazJFUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679948415, "uuid": "4367d692-c469-44a4-9aad-822ddada6a55", "value": 6400000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679948415, "uuid": "86ed275a-a593-460c-a44f-7ae27c6960bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679948415, "uuid": "209c0590-d15f-47d9-8b87-d16301720ef9", "value": "6d72e0d0887eaada746fcd3e4826ae26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a182aa8-ccf6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679959450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959450, "uuid": "39700fbe-69d0-4d67-8757-d31b3f74c3f7", "comment": "Malware payload", "value": "5ec52304a076938dca2be4c3bd82511a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959450, "uuid": "0c0e61fe-d259-4b57-857a-1b9b3cc9e537", "comment": "Malware payload", "value": "f8e2c6ca151095a5077ea3263baa26130050534495c7255d1fc6f920df24125f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959450, "uuid": "b67b0037-3d62-4190-8cab-af0e8b0ddcf9", "comment": "Malware payload", "value": "8a02450ae27f98d94553c77c51575413f8803e34", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679959450, "uuid": "bc973798-c2ad-4b49-939b-42394766ec4b", "comment": "Malware payload", "value": "fa09406f674f13e0837a79a5b6f158762170211f613cb3357b5090b8979913334ef26a99e531f369bcdce1a5105f6bf8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679959450, "uuid": "571e8b68-9608-4cc5-be8c-a1f49a7c938d", "value": "T180559D86FAD9A057ECF7C23293795A7650068C194B43E687195473BC28FBEE04A46FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679959450, "uuid": "dc2019d2-be93-4df9-bff6-098b40aced0b", "value": "24576:T7qu7yL1DjwQinPgvWm67+vaqmcSELrN6qXUR2P/:T7qu7ypDcQinPmWmjvaqPvrN9XURi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679959450, "uuid": "fa8a50b2-9a67-44b1-ae45-0c69beef862c", "value": 1398505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679959450, "uuid": "526acf52-9e3a-41c0-a8f4-2375463776c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679959450, "uuid": "79e1eea8-84a3-4842-94cc-24968d2e0165", "value": "Hazarat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cd07a4-cc50-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1679888060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888060, "uuid": "f9e06f60-42cf-4f3d-97b6-a7641a58debf", "comment": "Malware payload (njrat)", "value": "c34ca33d0bc86805d19819f58716a69e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888060, "uuid": "281dd977-e63b-4514-85b6-1116ca860575", "comment": "Malware payload (njrat)", "value": "f992830e9ea85867dceb3bb510420545fded1c2f769f7269960559ab80da7bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888060, "uuid": "465daefb-b7a0-4bac-b8b1-08b8e51bb4a0", "comment": "Malware payload (njrat)", "value": "0a0b3210e74d62659d8c0a06b7588bc584f100c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679888060, "uuid": "9b6a6071-67c2-41b9-a30a-ff4a72f31dc5", "comment": "Malware payload (njrat)", "value": "bc391d64b4667e526ea48ec5fc6d3b8f05bb5b4cb8ab5aa366723ba9f07f9bd3f8fc2fb2a472689814bc44e21cf6e7b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888060, "uuid": "35299904-016e-4c09-b36c-c3db236e8d15", "value": "T1C7733A4877F54A12D1BF0EB5897292220B35FC076D26F76D09D174AA5FB36C08A09FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888060, "uuid": "d18b40fe-3486-4b5e-8760-265bbb83586b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888060, "uuid": "48ecd42a-34a1-46f8-a72f-5dee058b75e0", "value": "1536:StK+6Y9yhU19DpfS5wpOk3JCK6pFNRXd6fOpd/9nEh9TGQJmR:5hU1LQwpOk5CK6cO/9ESQJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679888060, "uuid": "496600b4-dd57-42ce-9b7e-5938bc70ffcc", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679888060, "uuid": "58824b58-0ac8-47c1-8d27-e96567c17615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679888060, "uuid": "d9c5ab43-d655-4d62-a0c3-9f8351b21998", "value": "xgBW6KM9LuYw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c6eada-cc89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1679912538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912538, "uuid": "672224bd-adc5-4c72-ba83-dbb8f2f904cc", "comment": "Malware payload (Rhadamanthys)", "value": "ba56e67cda1b2dae602ff5bfe16f8982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912538, "uuid": "754e5662-3830-4c9a-8ebe-933d927fef52", "comment": "Malware payload (Rhadamanthys)", "value": "fa0854b2e8a021f34477236f87fd599e00ec663f0f532a5af2eb76d2b0d4fb7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912538, "uuid": "2bb1b85e-0869-4f21-98ec-29ed9da23244", "comment": "Malware payload (Rhadamanthys)", "value": "aea4eaea84436be70221e3ee5ddf0645be576be7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679912538, "uuid": "9f14f1aa-b3a9-467d-8ed9-de72bd13e38b", "comment": "Malware payload (Rhadamanthys)", "value": "6eb650121b4006eb9dc5a0608c7c2e6fc25fbea4a2490edb318c066a0bd5e1acb0c36a4c671f53bbc0a892a310ce89a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912538, "uuid": "e4534b9f-f82d-4003-ae48-afc73a0e42ec", "value": "T1D164E0117292C472E46A41718C71C6B1AD3EBCB19B548AD77BA4277E1E307D2EF36382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912538, "uuid": "ef9a781c-a799-4a80-9a89-5df8d35831c9", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912538, "uuid": "8e49a477-7aed-4d95-a368-632dd044807f", "value": "6144:MKYdkCLRTqU+f2VI81e/UP+AvR/aOISUEHk7vhsg:KdkCVTqU+foIHcGS9aJEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679912538, "uuid": "e044635e-c298-4c88-aa72-f7f3e3f55bbe", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679912538, "uuid": "f0a7ede4-0849-4fd8-ba7b-de3ea96234f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679912538, "uuid": "520e6166-660d-4350-ab05-e797b70f6c83", "value": "ba56e67cda1b2dae602ff5bfe16f8982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166d364e-cc56-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679890563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679890563, "uuid": "98dea623-f3b4-4370-86ae-37e33dbb7982", "comment": "Malware payload (RedLineStealer)", "value": "be7c53d729a1066cd5c26891066af4ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679890563, "uuid": "2cdf6c3d-fbb2-4167-9a57-9c5409960569", "comment": "Malware payload (RedLineStealer)", "value": "fa40f83acf34e534ce882247921e3a06f3035a1dc7a53e372bc82849fd308ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679890563, "uuid": "27092f34-3a46-491d-a11c-53a59123c3d2", "comment": "Malware payload (RedLineStealer)", "value": "fa1dfaf50fd9287715fc967738925b76037c8b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679890563, "uuid": "6e864b65-a6db-428c-aef3-c7634fdec308", "comment": "Malware payload (RedLineStealer)", "value": "460af57b90454ee027405c61c319c7a8e1cf7117bff130f4613fb9d427de90dce68d8563b84ddadaa9b628b76375040c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679890563, "uuid": "fde89ab1-61b7-4a13-b5ac-e518b3ce1683", "value": "T15805709A90D4638BD97B33F8573404E5C371CE1201BADAEB409D74FA9D9EE31AB35806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679890563, "uuid": "f8e4bee3-0861-4c04-b96a-a2ac074d8d73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679890563, "uuid": "b4eb1d28-fe42-4f9c-8782-a195bbbea000", "value": "12288:8KTZVw/T+6QT0SeOwUsCEhuH6FpjeKg5qHCb11Fo:UBKtP4SJYCb11Fo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679890563, "uuid": "3948aeb9-b4a9-4263-a4c3-748d5fcc459c", "value": 810152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679890563, "uuid": "f925059d-c608-4288-8683-289510f3db9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679890563, "uuid": "e6f37b8c-2e20-465d-89e0-b82f576c7d54", "value": "FA40F83ACF34E534CE882247921E3A06F3035A1DC7A53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b806da-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1679894912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894912, "uuid": "c74495d3-0a76-4ce9-8cca-91426ff4666b", "comment": "Malware payload (Formbook)", "value": "f7a88d9f0c5de7367498989139aec2b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894912, "uuid": "6b44498a-5313-430e-ad92-fa565a65e415", "comment": "Malware payload (Formbook)", "value": "fb4c3c803b69b2823f0bb584ef77da38f17eaf18184058249b6dd7664234cb53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894912, "uuid": "0374b3f9-a1f1-46e2-8203-f26e4f69f922", "comment": "Malware payload (Formbook)", "value": "9fc08d5def106aba0a0d828738ea95300d98c184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894912, "uuid": "2778ba30-3737-45b2-96e8-5289f1a6c430", "comment": "Malware payload (Formbook)", "value": "344cf3f2ea197a515d7d0b93cf0734cc1f787473cf56773f46d103c392d94a4ba142d9a4a86f4cac78247302bb6bb5af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894912, "uuid": "69edb94e-0d0f-4b42-97eb-4bf3bb68d927", "value": "T10404AE36DA42C071E2B211B4B6B91B7B493E0D343295A5EAA3E619E01FF44A5F43931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894912, "uuid": "d3e87b14-2bd1-4e0f-848b-a8400ded15d7", "value": "3072:3bX4kQvFJdO43t/c5scFV6hP/zSJRXUweMoeks3jG1ZlRRR:GU2tk5B6hP/MX9e3eHzG1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894912, "uuid": "c3e27926-d18e-42b9-afd9-7cf01300ab47", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894912, "uuid": "6995fed2-0b3f-49cd-9e82-ba161f632e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894912, "uuid": "73c472f7-720d-4d04-9838-ae1b2ac9a247", "value": "fb4c3c803b69b2823f0bb584ef77da38f17eaf18184058249b6dd7664234cb53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a22c3ac-ccca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1679940444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940444, "uuid": "12f677eb-0bd3-4272-bc01-cd3c863af061", "comment": "Malware payload", "value": "1fd4bd709ba9d02f7bbbdd82fed2e27c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940444, "uuid": "d2fe9b5b-3e6c-4fad-ad97-d72a475f1a34", "comment": "Malware payload", "value": "fb8ae13e0e48f69f3a6969fc39a698440810f1a73fbdb0e4577bca6751785b91", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940444, "uuid": "bea80da6-b8b0-4019-a053-1bc9a3d672c0", "comment": "Malware payload", "value": "3486cf4591c6a599dea1bd26c0ab0ad50ffd38b9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679940444, "uuid": "2f480620-7e48-4329-b506-9d1390cf5803", "comment": "Malware payload", "value": "6aa397b6e6dfa84b2684c37699a751486b71ff4581ee4922fa60ed15a36c15785c1b8f77a023b40af5844c9c50558639", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940444, "uuid": "fd245e70-13e9-4042-a444-f588458fc255", "value": "T1FF5533A35CD6C38D63B69CA17E4EFAF3D9DF25228E220C6C0594412297D3AF621345ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940444, "uuid": "226f1540-ac65-4ea4-9cab-e941e7cc626b", "value": "24576:iTz7+4zyekQ0WD5c75vo3VzLVc6MaKQb3pO5DQ6dv9GjjEHAmFg+admr4LsNkG:i7dGWPFm6hb3Y50631go54LsSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679940444, "uuid": "44177e63-cad4-4915-9afd-0664cb036fdb", "value": 1355559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679940444, "uuid": "d9b4c8fc-acd5-44cb-8be1-af361ef1de99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679940444, "uuid": "1dc9a04e-e77b-4e38-949a-21b22ee07f79", "value": "New Prices List.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37840089-cc60-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1679894913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894913, "uuid": "039881f7-05ca-4160-bee4-b99283d582ef", "comment": "Malware payload (AgentTesla)", "value": "1e302f38d0015490410265839870145a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894913, "uuid": "2951353f-1648-4605-af39-00da0f47fa1a", "comment": "Malware payload (AgentTesla)", "value": "fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894913, "uuid": "a6daf11c-7c69-44aa-be89-90f034152726", "comment": "Malware payload (AgentTesla)", "value": "d87da41895d82b0254df1b42135df2a71a3a4645", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679894913, "uuid": "147e2a25-e3e1-4828-a0bf-b7bc6f6a9c6a", "comment": "Malware payload (AgentTesla)", "value": "fb7e61641bdda16adc2cb86957459587441108f25b40623f62407842807220993daf7009cf7cc36427483c71ce9a74c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894913, "uuid": "b9ab34cf-4a2b-4a2d-af21-bc474854a3f0", "value": "T17C2429566315D561CB5F417FC016820831F1DB07A72AE38F1AA6D8FA1F812CEF92B8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894913, "uuid": "94d8caf9-995a-46ab-a395-0d49b6fc1b8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894913, "uuid": "20c2d18b-1a3f-48ab-9439-051464e98d92", "value": "3072:HbstfsajUzAqkrLAxRUXuiUiKTutdR9AT6GDAvPJfALZR05FP/xdu6C9bwtWtHZ:kPjqkrsxqTUdu4AXJscTcBUWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679894913, "uuid": "ae043aba-a7a5-402d-831f-63fea8bf1c43", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679894913, "uuid": "e302ce32-1aa3-444e-a249-e066a2d504bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679894913, "uuid": "8e12ca36-4362-4c6d-aedb-221dbbe73420", "value": "fbc02c3151bf5e0071db721f9d02b2003f896d4d14a6f4e91a336b386c678e04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48de0a7e-cc8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1679915129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915129, "uuid": "70c31c80-9803-43fb-b37e-fefbba194050", "comment": "Malware payload (SnakeKeylogger)", "value": "e90d3ec392d44522f55a0cf054c211a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915129, "uuid": "322733e0-4ea6-4551-9dfc-cba64d5dd844", "comment": "Malware payload (SnakeKeylogger)", "value": "fbca5195cab9ea8df36b6123fd0e23f2e1ca97cd0b61d6d40ecee6611f31c8ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915129, "uuid": "f01d4bc7-dec3-4fd5-bef4-de39c06a8e1a", "comment": "Malware payload (SnakeKeylogger)", "value": "0c6247533089c0b7bb4a29a08a6434bfad26b0bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679915129, "uuid": "d718de15-2741-47b4-9c5f-5588bdceb0d8", "comment": "Malware payload (SnakeKeylogger)", "value": "4c4501cc92b36e421d301c6ec2648a43e5f4fe98099aeae2922eb6c457abbf116cb86a81e25a9482646c01fa6871c3e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915129, "uuid": "58cdbf0e-ab65-4dc4-9f1c-e4590b8328fe", "value": "T125F4F148E3E4A712E7B667F46AB09500D3BCB8EB6B56DA4D4D8A10D780F17508E43F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915129, "uuid": "497688eb-510d-4044-9644-57e516fd0e00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915129, "uuid": "8bf78f9b-a692-4759-9631-8adb2f821bbe", "value": "12288:DA5YB0OlJhZ5tgLV/651iqUGqGATBAoWL1EoU1cWT6p7r+72KQoIX9ie7zQpSQo:DA5AVDb2/65IqUJA1vycWOqvVIXQeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679915129, "uuid": "67220be9-2e29-4105-a93e-0d87026a2ae8", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679915129, "uuid": "f919341f-f74d-44ad-8f12-5b10e99708f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679915129, "uuid": "9f897f99-feb2-4ef5-aa65-df828d5955bf", "value": "e90d3ec392d44522f55a0cf054c211a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cf3cb0-cc4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1679886824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679886824, "uuid": "9448bc39-2e53-4dc6-b0cb-0f756b0e3132", "comment": "Malware payload (Mirai)", "value": "cbfaf411ec065ca3461b2048eaff2bc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679886824, "uuid": "2e350d84-133a-4c90-8acd-5b9d8c67df2d", "comment": "Malware payload (Mirai)", "value": "fd6b9a69bb498d9b7e578af3607c9a7e3445201480ab6c6691d8d79f86c4bae7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679886824, "uuid": "820c0b94-5b1a-49e6-afda-c1620e36abbe", "comment": "Malware payload (Mirai)", "value": "576ddd48c43e002edd4569e046dcc810a593ca7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679886824, "uuid": "43aa7c6c-89f7-4006-abe3-76bec2b827ef", "comment": "Malware payload (Mirai)", "value": "623d653cffc37bd65f18a503e8979a9b611569d509d5b7faf9509465f2fdb0ac8c4f4b2efec9d9efbc429218578051dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679886824, "uuid": "af54672a-7a30-4652-a3f0-794f633a0d2e", "value": "T1096329C8F84B80F6C45B4D3051B7FA3FCE31D9B981B0965EEF9A9F36DA635029102649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679886824, "uuid": "1409289a-76f5-437e-b2d4-49fecfb72202", "value": "1536:tamyeOnom3fxoI/bcB4dSaUeW5xjThEz6ewSsV7eQT+3nC:tamCnom3fx7/bcBMSahwxfez6ewh7eGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679886824, "uuid": "1b2054c3-8e55-42c5-8bfe-547bca1a707e", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679886824, "uuid": "11b5d659-a9be-4389-9c27-63dbfcd9ee82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679886824, "uuid": "886376cd-7f5f-4e55-bd64-ec5eab2cdb4e", "value": "cbfaf411ec065ca3461b2048eaff2bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a95f07-ccf1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679957426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957426, "uuid": "2c1e0d9a-c286-444a-9892-661141b1df7d", "comment": "Malware payload (RedLineStealer)", "value": "051f8e19ea61defac87c4595da2812d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957426, "uuid": "a7ebc7fe-4711-4900-8262-c7d34a9e02c6", "comment": "Malware payload (RedLineStealer)", "value": "feb4b373b4fc2b6e5d099f60171390d14a5a4f42dc8c1bc6f079d2bc234b3db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957426, "uuid": "43da3ece-5ec5-46bb-9bb8-925d424fe970", "comment": "Malware payload (RedLineStealer)", "value": "038e31c7e3791ff2222b100bf82bb1f38b4c3bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679957426, "uuid": "052722fd-6826-4b7d-b127-72a6bb71bef3", "comment": "Malware payload (RedLineStealer)", "value": "53cce85bf37833311e366e5b846ffae16982dc712574b1ee0941d900723d38af248b27954cb6a755fc31670ccbadff25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957426, "uuid": "d088fd7e-6ccc-4a08-9def-6cfc69326dde", "value": "T147E41212B382C073F22A0AB50A26CA759D3A747597694AC73B1C177A0F313D1DF7A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957426, "uuid": "1c20d7ac-7a4f-4401-b229-1c990668f946", "value": "d233995a591f0c21b167474a8600ae08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957426, "uuid": "1d2b2ef6-be14-4cdf-988f-6e7f46ba5123", "value": "12288:kQ8/I5IsZj2qAcsbAWDLCHSJnITSFpVudjtcKl7R9ntzafhs46FeTkH:kQ8SZ2qdD8gqITyGdhcKtntufhspFeTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679957426, "uuid": "6df3db02-d2a8-4e34-911d-493ab45d929a", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679957426, "uuid": "eb006bc4-33b0-45b9-8d5c-3a5a1727069e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679957426, "uuid": "705d071f-3b94-4927-9dca-7810a35d6e1d", "value": "051f8e19ea61defac87c4595da2812d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da68e182-cc53-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1679889603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889603, "uuid": "5111af59-7fa3-42ca-9259-e21808790b97", "comment": "Malware payload (Sodinokibi)", "value": "c24e1c04cefda3041f4af2398a43ae32", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889603, "uuid": "33e0d16b-573f-4a03-9306-8ba74d6fdba0", "comment": "Malware payload (Sodinokibi)", "value": "ff0d99ed61293668c0a81cc3e0ead43d1c7392ac351e34e1219f22a1b671aa72", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889603, "uuid": "acbcf075-f519-414c-ba9f-c786a82c0e57", "comment": "Malware payload (Sodinokibi)", "value": "15e1a4bbe48616a72445b73abb667ebb0803f98d", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679889603, "uuid": "5ed60325-53c7-4e7a-8d54-4764ee1e2db9", "comment": "Malware payload (Sodinokibi)", "value": "609a09661ea3e088c7934be6502ac8aeed370d6fb4e7422dc2cec9264fe20e909c8bb08aa1f13064e62b0b1bffbb4f86", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889603, "uuid": "faa83f36-54b1-4a38-bdfd-0af8dc5cf1c4", "value": "T1C6B3CF27A85043F3C9C343FA027A2E1E7AFEBD340732115593618A5E9F791919A3B74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889603, "uuid": "79c5684c-7fb3-4c53-8e26-25148ca1d60c", "value": "5a3546240d37d021c851e7e73f0188e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889603, "uuid": "fc00742b-0a0a-4f7f-91e2-4560294a5082", "value": "3072:UJtj87Z4KefVptsisi0HjUyWr4X5FTDUAN:CBgOPXttsiqfW8X7DUAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679889603, "uuid": "367c30b9-1ff5-4d9a-bebc-f980cf3bb447", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679889603, "uuid": "59dda9a4-08d3-4597-8d35-5ca62fbde2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679889603, "uuid": "8ab648fb-b658-4ff3-bc79-3e78afb98682", "value": "VirusShare_c24e1c04cefda3041f4af2398a43ae32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee97e47f-cc3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1679880188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880188, "uuid": "74bb07d2-7017-4528-97fb-c37028a7b4fd", "comment": "Malware payload (Smoke Loader)", "value": "2144c8e0d1460cdf01d0987db923b51b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880188, "uuid": "c8e28c6b-3870-4a6c-9b5f-ffc21b666590", "comment": "Malware payload (Smoke Loader)", "value": "ff2349d0baa3d38b56f1251ad1299c07d9ebf947a38c6bce1122482ed4aa48c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880188, "uuid": "bd516626-8465-4606-a7ac-46354c5cba4b", "comment": "Malware payload (Smoke Loader)", "value": "e6deda28bc839e84ded290581e5a53c69b2be2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679880188, "uuid": "e6f3e1f6-37b3-4da6-b4c4-ebb0bf7f3a3a", "comment": "Malware payload (Smoke Loader)", "value": "de26e91bdf83642381c35c6e5ba6e53b890c866eb30f8b87fac2867a57ad5c4cec064fa30bee084b64b18482e06c02c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880188, "uuid": "43e74ba4-6c0f-41a7-949b-43c7871ccb39", "value": "T132547D3263F07860E563D7328E2FC6FC2A6FB9609E156B7E12455A7F09B02A1C172735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880188, "uuid": "c97532ef-de65-4993-b9be-6bdda9bd7dfb", "value": "59edcf4038e73a659a2ff6e04ad467ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880188, "uuid": "69b71715-4849-40f3-9c11-01a1f21d8b60", "value": "6144:6BTRXMOh6XFaUYsljv013RoSdl/mNN4T:6TRXNh6XFNYs5v013eSdYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679880188, "uuid": "bfc4f937-8943-4af1-84f8-5095874d4fc7", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679880188, "uuid": "52be731b-f9ac-4509-b175-ecd408424595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679880188, "uuid": "7ccc65a3-beb0-4f93-8a51-470f2ba62e13", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36765cc7-cc3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679879450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879450, "uuid": "65c4f1fe-5447-40d4-aee3-dd7c38955405", "comment": "Malware payload (RedLineStealer)", "value": "5e15bf1b945013a8df627c0cee2447af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879450, "uuid": "ebe79365-c7c6-4437-8250-2bf4f0db4b66", "comment": "Malware payload (RedLineStealer)", "value": "ff556d834094729d1d1bb1ff1a2c9efa30d8da5cfb6d2745f82606dc908e4054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879450, "uuid": "452b835f-567d-46cb-8dc2-f95c81038233", "comment": "Malware payload (RedLineStealer)", "value": "76b25a4ffdcf2bed38fcf18445791c3de81e9ba1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679879450, "uuid": "77de15e6-b9b3-4f0a-9a8c-0e604a335cbc", "comment": "Malware payload (RedLineStealer)", "value": "c3323820dd42a23cfe3b70f40bc03c6edacea0fe19c11fabbfdb0d3c604aebee46fd1caefc377c8e0d8fd29bcc65eda0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879450, "uuid": "c1afe84d-ec59-48c7-b040-e3a6391ffaef", "value": "T1122523026BE85263C8B52371C4F943830E37BC9369B8937E3385DC1E5DE26599D7272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879450, "uuid": "f4f491ff-bde3-439b-ae43-e6e1adcfb20d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879450, "uuid": "5a7d7b25-31fd-4db2-8082-522f65544091", "value": "24576:Zy2L0HtdK8b+YYIwfX+5YToRMFqtiWcl6L5hajSjf:MPdyzIw7ToOFqtDc+Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679879450, "uuid": "51b80396-ee60-48af-bbdf-2397c1e9d179", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679879450, "uuid": "3a1bf927-2465-48d4-8c26-c6869b2e8460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679879450, "uuid": "644703f2-e4da-4cb0-ba51-fab691f35f94", "value": "5e15bf1b945013a8df627c0cee2447af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbcf8d0-cc6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1679900128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900128, "uuid": "deb870b4-6f82-4c59-a16c-b1e408c0e526", "comment": "Malware payload (RedLineStealer)", "value": "f7dedacf106bb036f9491b8b282bd2c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900128, "uuid": "f0dc3161-b5cd-4378-b27a-446542a256e0", "comment": "Malware payload (RedLineStealer)", "value": "fff6a6eb6660003361333231bbb001ce7c99396ae603f3d3568928b9df30cc10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900128, "uuid": "b467c3f1-dffd-4649-95e2-5f04cd97ff87", "comment": "Malware payload (RedLineStealer)", "value": "d9071376c810e7a460395255e8265a6966f38361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1679900128, "uuid": "4fdd97e9-9e6f-42c4-96e9-2754da695b81", "comment": "Malware payload (RedLineStealer)", "value": "99e015a60297e0c1496f32e6187fb4237f8847933d3b483cf92746bde0a691eb7bed2c66c4d3a9b0ba71f55f79639596", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900128, "uuid": "82e42a49-9ff1-466a-a681-ac3c003141fc", "value": "T144E40211F7C2C472F06681308C26C7B56976FCB2CF968AD337442B2E6E352D29A7435A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900128, "uuid": "8bcb042b-e3cc-4226-a1f9-0053c576f460", "value": "21829bcb83e2224c2104cf7cefe96c53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900128, "uuid": "359af26d-81ed-49cf-a053-9329027fca94", "value": "12288:mxV4x1IbmWw7VY7dEqih3LLOL1RtcdsFAKIOTw42z:Qy14mWw7VYpEqih3OL1Rtcdsan4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1679900128, "uuid": "a7d4949b-28dd-4fe6-be42-ebf4e2c28258", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1679900128, "uuid": "dad241b3-8f87-4fa4-b0ac-ef3ff9d3b01b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1679900128, "uuid": "42882ffc-f760-48ce-9ca4-0cbad4fe6942", "value": "f7dedacf106bb036f9491b8b282bd2c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }